diff --git a/package-lock.json b/package-lock.json
index 86547c555..98967cb6c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2865,15 +2865,15 @@
       "license": "MIT"
     },
     "node_modules/@modelcontextprotocol/client": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.2.0.tgz",
-      "integrity": "sha512-LxCou/CSYQ6dwEnjhLZY0KnEuc8V4UJ3IEQCl/uR2yHobSQIEdJKUlKLRYRF5i5FqRGHy1eK7une3aAWDHLtig==",
-      "license": "MIT",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.3.1.tgz",
+      "integrity": "sha512-mIGZXpHsjnZ6lD+gD/WCMpR5k8yVQQ8nNFH1N0Srf7AvnwTUMYD6pvTY8ng2+He5FfV7YMZLmrjL7cLa/cc3dQ==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@modelcontextprotocol/core": "2.2.0",
+        "@modelcontextprotocol/core": "2.3.1",
         "cross-spawn": "^7.0.5",
         "eventsource": "^3.0.2",
-        "eventsource-parser": "^3.0.0",
+        "eventsource-parser": "^3.0.8",
         "jose": "^6.1.3",
         "pkce-challenge": "^5.0.0",
         "zod": "^4.2.0"
@@ -2882,6 +2882,18 @@
         "node": ">=20"
       }
     },
+    "node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.3.1.tgz",
+      "integrity": "sha512-laVmIhPGpWi7rG9q+0UigblRN0Hws/Yjlb6qLFtVqryXVLkc4h+yN8z731POD2LnAGQlFe7/tXhUm7Bi0YB91g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/@modelcontextprotocol/core": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.2.0.tgz",
@@ -24988,7 +25000,7 @@
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@jmespath-community/jmespath": "^1.3.0",
-        "@modelcontextprotocol/client": "^2.2.0",
+        "@modelcontextprotocol/client": "^2.3.1",
         "@modelcontextprotocol/core": "^2.0.0",
         "@modelcontextprotocol/node": "^2.0.0",
         "@modelcontextprotocol/server": "^2.2.0",
@@ -25267,7 +25279,7 @@
       "version": "0.1.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@modelcontextprotocol/client": "^2.2.0"
+        "@modelcontextprotocol/client": "^2.3.1"
       },
       "bin": {
         "amcp": "dist/index.js"
diff --git a/packages/backend/package.json b/packages/backend/package.json
index 37fd96888..795cb11b8 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "@jmespath-community/jmespath": "^1.3.0",
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.1",
     "@modelcontextprotocol/core": "^2.0.0",
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.2.0",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 0efd566fa..8df755801 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -11,6 +11,6 @@
     "lint": "tsc --noEmit -p tsconfig.json",
     "test": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node --test dist/cli.test.js"
   },
-  "dependencies": { "@modelcontextprotocol/client": "^2.2.0" },
+  "dependencies": { "@modelcontextprotocol/client": "^2.3.1" },
   "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.9.0" }
 }