security: update supported MCP v1 dependency to 1.30.0

[ayhammouda]

Vision — automated project maintainer

Summary

Closes #140. Raise the MCP lower bound to >=1.30.0,<2.0.0 and lock 1.30.0. Only pyproject.toml and uv.lock change; no transitive dependency changes. Vision explicitly approved this narrow dependency-field edit in #140. MCP v2 #123 remains a separate migration.

Evidence

• Local implementation base: 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b; local head: 2b23177ec9e31e66db97f509d3cb93236651e1d0. Published broker head: afc32485ae5744dc7b6e8ad0e684488644516dac; tree matches the reviewed local implementation. Mandatory independent prepublication review passed (pdctl publish exit 0). Exact-head PR verification remains pending.
• Isolated developer: locked sync, lock check, canonical ruff/pyright, 571 tests, doctor, frozen corpus validation, build and installed-wheel stdio 4 tests passed.
• Same retained 1603-document index: 65 cases, 34 hits, 69 citations, all case outcomes unchanged except measured timings. Full tool schemas/annotations equal at base, head and installed wheel.
• Fresh base/head pip-audit reports no known vulnerabilities. This does not supersede the five upstream advisories affecting 1.28.1 linked in security: update MCP v1 dependency to supported 1.30.0 #140. The default stdio server is not assumed vulnerable to HTTP-only issues.
• Owner reviewed exact committed diff, bundle/tree, absence of transitive churn and MCP artifact hashes against PyPI metadata. No contributed code ran in owner account.

Limitations and gates

Retained index is not a fresh source-pinned rebuild; developer evidence is Linux/Python 3.12 and SDK stdio, not named-client qualification or release evidence. Initial diagnostic-only schema assertion and missing uvx path were corrected with raw failures retained; no product tests weakened. Independent prepublication review, exact published-head verification, required CI and review triage must pass before merge. No release is announced. Outcome review 2026-10-17; revisit immediately for newer supported v1 or contract/retrieval regressions.

Acceptance checklist

• Narrow MCP lower-bound/lock change, no transitive churn or public tool schema change.
• Developer gates, installed-wheel stdio and retained-index outcome preservation.
• Mandatory independent prepublication review through pdctl.
• Exact published-head pdctl verification and all 11 GitHub checks.
• Review triage, SHA-matched merge and all five main workflows.

Why this triggered supervisor review

The runtime dependency constraint in pyproject.toml changed. Vision explicitly approved this narrow supported-v1 security maintenance in #140; MCP v2 remains out of scope.

Verified merge and post-merge result

Vision — automated project maintainer: exact-head pdctl verify and gated SHA-matched merge succeeded for afc32485ae5744dc7b6e8ad0e684488644516dac. All 11 checks passed with no unresolved threads/findings. CodeRabbit skipped and is not independent review.

GitHub proves merge/main 49d307b814d254961ee7a7392e4620aebd87d2e8. CI, Product quality, Security Audit, CodeQL and OpenSSF Scorecard all passed. Product quality performed a fresh index build. Independent review reports 570 passes and one skip, not 571 passes, with a fresh 1,603-document index preserving 34/65 hits and 69 citations. Developer results above are separate. No release was made.

Exact-head verification · Merge decision

[coderabbiteu]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b52ecafa-6751-4d63-9fa6-938ddc099a37

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• pyproject.toml is excluded by none and included by none
• uv.lock is excluded by !**/*.lock and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 25ad259b-2040-4732-8298-0e21a3fecd10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ayhammouda]

Vision — automated project maintainer

Independent verification (temporary credential): success

Head: afc32485ae5744dc7b6e8ad0e684488644516dac; main: 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b.

{
  "head_sha": "afc32485ae5744dc7b6e8ad0e684488644516dac",
  "base_sha": "10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b",
  "approved": true,
  "summary": "Independent prepublication review passed. The complete diff changes only the MCP requirement from >=1.27.0 to >=1.30.0 and the corresponding lock entry; no transitive packages, source, tests, workflows, corpus, baseline, or policy changed. Upstream advisories confirm 1.28.1 is affected and 1.30.0 is patched, without establishing that HTTP-specific issues are reachable through this stdio server. All six registered tool contracts match the base. A fresh 1,603-document index produced identical base/head outcomes: 34 retrieval hits and 69 citations across 65 version-specific cases, with no regressions. The full suite had 570 passes and one skip; the skip is not a pass. The locked dependency audit found no known vulnerabilities. The head is unpublished and has zero hosted check runs; required CI remains pending and must pass before merge.",
  "commands": [
    {
      "command": "git clone --filter=blob:none --no-checkout --depth=1 https://github.com/ayhammouda/python-docs-mcp-server.git repo",
      "exit_code": 0
    },
    {
      "command": "git fetch --depth=1 origin afc32485ae5744dc7b6e8ad0e684488644516dac",
      "exit_code": 0
    },
    {
      "command": "git fetch --depth=1 origin 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b",
      "exit_code": 0
    },
    {
      "command": "git checkout --detach afc32485ae5744dc7b6e8ad0e684488644516dac",
      "exit_code": 0
    },
    {
      "command": "git diff --find-renames 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b afc32485ae5744dc7b6e8ad0e684488644516dac -- pyproject.toml uv.lock",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv sync --locked --dev",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked pyright src/ benchmarks/",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked pytest --tb=short -q",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv lock --check",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv pip compile --quiet pyproject.toml -o /tmp/requirements-check.txt",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked python -m benchmarks validate-corpus --corpus docs/benchmarks/corpus.yml --schema docs/benchmarks/corpus.schema.json",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv build",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked pytest tests/test_stdio_smoke.py tests/test_schema_snapshot.py tests/test_retrieval_regression.py -q",
      "exit_code": 0
    },
    {
      "command": "XDG_CACHE_HOME=/tmp/heimdall-afc3248-cache /usr/local/bin/uv run --locked python-docs-mcp-server build-index --versions 3.11,3.12,3.13",
      "exit_code": 0
    },
    {
      "command": "XDG_CACHE_HOME=/tmp/heimdall-afc3248-cache /usr/local/bin/uv run --locked python-docs-mcp-server doctor",
      "exit_code": 0
    },
    {
      "command": "XDG_CACHE_HOME=/tmp/heimdall-afc3248-cache /usr/local/bin/uv run --locked python-docs-mcp-server validate-corpus",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked python -m benchmarks.regression --index /tmp/heimdall-afc3248-cache/mcp-python-docs/index.db --output /tmp/heimdall-afc3248-head-regression.json",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv run --locked python -m benchmarks.regression --index /tmp/heimdall-afc3248-cache/mcp-python-docs/index.db --output /tmp/heimdall-afc3248-base-regression.json",
      "exit_code": 0
    },
    {
      "command": "cmp /tmp/heimdall-afc3248-schema-0.json /tmp/heimdall-afc3248-schema-1.json",
      "exit_code": 0
    },
    {
      "command": "/tmp/heimdall-afc3248-wheel-venv/bin/python -m pytest --import-mode=importlib /tmp/heimdall-afc3248-test_stdio_smoke.py -q",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv export --locked --format requirements-txt --all-groups --all-extras --no-emit-project --no-hashes --output-file /tmp/heimdall-afc3248-audit-all.txt",
      "exit_code": 0
    },
    {
      "command": "/usr/local/bin/uv tool run --from pip-audit pip-audit --requirement /tmp/heimdall-afc3248-audit-all.txt --no-deps --disable-pip --progress-spinner off --format json",
      "exit_code": 0
    },
    {
      "command": "git diff --check 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b afc32485ae5744dc7b6e8ad0e684488644516dac",
      "exit_code": 0
    },
    {
      "command": "git ls-remote origin refs/heads/main",
      "exit_code": 0
    },
    {
      "command": "curl -LsS https://api.github.com/repos/ayhammouda/python-docs-mcp-server/commits/afc32485ae5744dc7b6e8ad0e684488644516dac/check-runs",
      "exit_code": 0
    }
  ],
  "blockers": []
}

[ayhammouda]

Vision — automated project maintainer

Merge decision for exact head afc32485ae5744dc7b6e8ad0e684488644516dac against main 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b: proceed through pdctl merge.

Mandatory prepublication review and exact-head pdctl verify succeeded. Independent evidence includes a fresh 1,603-document index, unchanged 34/65 retrieval hits and 69 citations, unchanged six-tool contracts, locked audit, installed-wheel stdio and canonical gates. The verifier reports 570 test passes and one skip, not 571 passes. Its cached prepublication narrative predates hosted CI; fresh GitHub evidence now confirms all 11 checks succeeded on this exact head. No submitted/inline findings or unresolved review threads. CodeRabbit skipped, so it is not counted as independent review. The root-owned broker receipt—not this comment—authorizes merge.

Scope remains the supported MCP v1 security maintenance only; no transitive changes or MCP v2 migration. Post-merge CI will be checked separately; this is not a release announcement. Outcome review: 2026-10-17, or sooner for a supported-v1 advisory/regression.