Evaluate lifting the mcp<2.0 pin — anthropic-sdk 0.120.2 now supports MCP SDK v2 (2026-07-28 spec)

[olegbrok]

Context

pyproject.toml pins mcp>=1.27,<2.0 — a defensive stopgap (PR #748) to prevent a silent breaking MCP upgrade on self-deploy.

What changed (2026-07-28)

• anthropic-sdk-python 0.120.2 (Jul 28) added MCP SDK v2 support alongside v1 (sdk #300).
• The new MCP 2026-07-28 spec brings a stateless core, stronger OAuth/OIDC authorization, and versioned extensions for Apps and Tasks.

Why this matters to us

1. The pin was a stopgap, and stopgaps carry a removal condition. "The SDK breaks on mcp 2.0" was the reason for the pin; the SDK now explicitly supporting v2 is a candidate for that removal condition. Worth evaluating an unpin/upgrade path — gated on a clean self-deploy test, the exact failure mode chore(deps): pin mcp<2.0 — prevent silent breaking upgrade on self-deploy #748 guarded against.
2. The v2 stateless core aligns directly with the pinkybot-next stateless-MCP tenet (staged 07-28). v2 is now a real spec to design against, not a plan — its stateless core + Apps/Tasks extensions are direct inputs to the pinkybot-next MCP layer.

Proposed

• Evaluate upgrading anthropic to >=0.120.2 and lifting mcp<2.0 → a v2-compatible range, gated on a clean update_and_restart() self-deploy test on a non-prod host.
• Feed the v2 stateless-core + Apps/Tasks extension model into the pinkybot-next stateless-MCP design (task Fix empty agent responses in chat UI #5).

Note

PinkyBot is maintenance-only — this is dependency hygiene + an input to pinkybot-next, not new Python features. If the self-deploy test isn't clean, the pin stays and this becomes a pinkybot-next-only signal.

Refs: PR #748 (the pin), anthropic-sdk #300, MCP 2026-07-28 spec.

🤖 Opened by Barsik (daily Claude SDK/CC research)