fix(deps): cap mcp<2 — mcp_server is broken on main (no bumps available)

[petronijus]

Monthly automated dependency maintenance. update_policy: patch.

No version bumps — and that is the finding

requirements.txt and mcp_server/requirements.txt contain only >= floors, no pins, and no lockfile. There is nothing a patch-level bump can act on: every install already resolves to the newest release on PyPI. The one-line change in this PR is a repair, not a bump.

🔴 mcp_server is broken on main

mcp 2.0.0 removed mcp.server.fastmcp, which mcp_server/server.py imports. Against the unbounded mcp>=1.0.0 floor, a fresh install resolves 2.0.0:

$ pip install -r mcp_server/requirements.txt   # resolves mcp==2.0.0
$ python -c "from mcp.server.fastmcp import FastMCP"
ModuleNotFoundError: No module named 'mcp.server.fastmcp'

mcp>=1.0.0,<2 resolves 1.29.0 and mcp_server/server.py imports cleanly again.

Same root cause is live in ustredna — see petronijus/ustredna#1. Both repos import mcp.server.fastmcp behind an unbounded floor.

What was verified

There is no test suite, no lint config, and no build step beyond the Docker image (and this box has no Docker daemon), so the available gate is an import-surface check against a real resolve — a fresh Python 3.11 venv matching the Dockerfile, installed from requirements.txt.

Import used by the app	Result
apscheduler.{executors.pool,jobstores.base,jobstores.sqlalchemy,schedulers.background}	✅
authlib.integrations.flask_client.OAuth	✅
flask.{Flask,Blueprint,has_request_context,…}	✅
flask_limiter.Limiter + flask_limiter.util.get_remote_address	✅
flask_talisman.Talisman	✅
flask_wtf.csrf.CSRFProtect	✅
werkzeug.middleware.proxy_fix.ProxyFix	✅
dotenv.load_dotenv, pytz	✅
mcp.server.fastmcp.FastMCP	❌ before → ✅ after this PR

The app was not executed: importing mindbaboon.py starts the scheduler and sends a startup email, which is not something an unattended run should trigger.

Worth noting what today's floors actually resolve to — several are well past their floor:

Declared	Resolves to
Flask>=2.3.2	3.1.3
Flask-Limiter>=3.5	4.1.1 (a major above the floor)
gunicorn (no constraint)	26.0.0
SQLAlchemy>=2.0.0	2.0.51
Authlib>=1.3	1.7.2

Flask-Limiter is already a full major above its floor and the import surface still holds, but that is luck rather than design.

Recommendation

Pin these. Either commit a compiled lockfile (uv pip compile requirements.txt -o requirements.lock, install with --require-hashes or the plain lock) or add upper bounds. As it stands, every docker compose up --build is an unpinned resolve against the live index — the container that ships is not the container that was last tested, and the mcp break above is exactly what that costs.

🤖 Generated with Claude Code