fix: cap mcp below 2.0 (nightly CI break)

[Mhemd139]

What happened

mcp 2.0.0 was released. Our dependency was mcp>=1.10 with no ceiling, so the scheduled run on main installed it and failed — while every push/PR run from a week ago had passed:

• contract-check: ImportError: cannot import name ''streamablehttp_client'' from ''mcp.client.streamable_http''. Did you mean: ''streamable_http_client''?
• test (3.12): mypy flagged the same attribute; 3.11/3.13 were cancelled by fail-fast.

The fix

mcp>=1.10,<2. The defect is the missing ceiling, not the import — a SemVer major is allowed to break, and an unbounded range on our core dependency invites exactly this.

Why not migrate to 2.0 in this PR

2.0 is a real migration, not a rename:

Change	Impact on Covenant
streamablehttp_client → streamable_http_client	one-line rename in introspect.py
mcp.server.fastmcp removed	examples/mcp_server.py and the entire contract-check demo depend on it
HTTP client moves to httpx2	the Layer 1 proxy is built on httpx and would have to follow

That deserves its own spec and PR, not a hotfix for red CI. The cap is deliberately narrow so lifting it is a one-line change when that work lands.

Verification

Clean venv, fresh pip install -e .[dev] — the cap resolves to mcp 1.29.0 (newest 1.x, not just the 1.28.1 we had pinned locally), so this is tested against the version CI will actually install:

• pytest — exit 0
• ruff check . — clean
• mypy covenant — clean (strict)
• covenant check — exit 0, no drift (the job that failed)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the MCP dependency version range to support 1.10 and later releases while remaining below version 2.0.
  • Documented considerations for a future major-version upgrade.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 55f48ade-3617-4ab8-bdcc-152166ba1ae9

📥 Commits

Reviewing files that changed from the base of the PR and between 0773887 and b5817ad.

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

The project now requires mcp version >=1.10,<2. Comments document compatibility-breaking changes expected in mcp 2.0.

Changes

MCP dependency constraint

Layer / File(s)	Summary
Constrain MCP dependency versions pyproject.toml	The mcp dependency now requires versions from 1.10 up to, but not including, 2.0. Comments document future migration work.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the dependency cap and its purpose of fixing the nightly CI break.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/mcp-2-cap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}