Skip to content

fix(deps): pin mcp SDK to <2.0.0 in MCP server examples - #46

Open
Dao-you wants to merge 1 commit into
RichardHan:mainfrom
Dao-you:pin-mcp-below-2
Open

fix(deps): pin mcp SDK to <2.0.0 in MCP server examples#46
Dao-you wants to merge 1 commit into
RichardHan:mainfrom
Dao-you:pin-mcp-below-2

Conversation

@Dao-you

@Dao-you Dao-you commented Jul 29, 2026

Copy link
Copy Markdown

Problem

mcp 2.0.0 removed the legacy Server decorator API this server is built on, so the
package now fails at import time:

File "...\mssql_mcp_server\server.py", line 131, in <module>
    @app.list_resources()
AttributeError: 'Server' object has no attribute 'list_resources'

pyproject.toml declared mcp>=1.0.0 with no upper bound. uvx --from git+... launches
re-resolve dependencies on every cold start and ignore uv.lock, so every client using
that install path broke the moment 2.0.0 hit PyPI — no config or database change involved.
The only workaround was --with "mcp<2.0.0" in each MCP client config.

Change

  • pyproject.toml / requirements.txt: mcp>=1.0.0mcp>=1.0.0,<2.0.0
  • uv.lock: regenerated (also picks up the stale project name mssql-mcp-servermicrosoft-sql-server-mcp)
  • README.md: new "Dependency notes" section recording the pin and the condition for removing it

Verification

  • uv pip compile pyproject.tomlmcp==1.29.0 (this is the path uvx takes)
  • import mssql_mcp_server.server succeeds
  • Test suite is unchanged by this PR: the lockfile already resolved mcp 1.2.0, so the
    pin is a no-op for uv run. The 39 pre-existing failures in tests/ are untouched.

Follow-up

This is a stopgap, not a migration. Removing the upper bound requires porting
server.py to the mcp 2.x API.

mcp 2.0.0 removed the legacy `Server` decorator API (`@app.list_resources()`,
`@app.list_tools()`, ...) that src/mssql_mcp_server/server.py is built on, so
an unconstrained install crashes at import time with:

    AttributeError: 'Server' object has no attribute 'list_resources'

This bites `uvx --from git+...` launches in particular: they re-resolve
dependencies on every cold start and ignore uv.lock, so the server broke the
moment 2.0.0 hit PyPI. Consumers had to work around it with
`--with "mcp<2.0.0"` in their MCP client config.

- pyproject.toml / requirements.txt: mcp>=1.0.0 -> mcp>=1.0.0,<2.0.0
- uv.lock: regenerated (also picks up the stale project name
  mssql-mcp-server -> microsoft-sql-server-mcp)
- README.md: document the pin and the condition for removing it

Verified: `uv pip compile pyproject.toml` now resolves mcp==1.29.0, and
`import mssql_mcp_server.server` succeeds. This is a stopgap - the real fix is
migrating the server to the 2.x API.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant