[dependabot]

MCP SDK 2 replaces the SDK 1 server entrypoint and dispatches synchronous tools on worker threads. That breaks the existing import path and silently drops telemetry on the thread-bound SQLite connection. This change selects the installed SDK's native server API and registers an asynchronous adapter that runs the existing synchronous helper on the event loop. Direct Python helpers remain synchronous, with their signatures, tool schemas, fact attribution and telemetry source preserved.

The MCP dependency range becomes >=1.28.1,<3, while the lock retains the merged security fixes. CI now runs Python 3.11 and 3.12 against both MCP majors, resolves the chosen major explicitly, verifies it, and runs the full suite. Real stdio regressions cover initialization, all seven tool schemas, separate session identities, repeated fact confirmations, and complete telemetry under concurrent requests.

Validation of the final source tree: all 843 tests pass in each current Python/MCP combination; supported API floors 1.28.1 and 2.0.0 pass compatibility and stdio probes. Independent real-stdio probes on both current SDK majors produce all 75 telemetry rows for three batches of 25 concurrent calls and exactly 15 repeated fact confirmations. Fresh native dispatch checks across four SDK releases preserve all seven signatures and retain all 71 observed callbacks. Public commit metadata and the exact GitHub CI result are checked separately before merge.

GitHub validation: all four Python/MCP jobs passed at the exact reviewed head: https://github.com/jkubo/gaius/actions/runs/37729372886

[jkubo]

Migration check on current main d4199177b09634e7161037333b80846cb1668973:

• The four security dependency updates are merged and the repository now has zero open Dependabot alerts. Main tests pass on Python 3.11 and 3.12.
• MCP 2.3.0 still fails the existing two attribution tests at from mcp.server.fastmcp import FastMCP, because that module was removed. This PR remains blocked until source compatibility is implemented.
• A diagnostic that substitutes mcp.server.MCPServer for FastMCP in child-process memory successfully completes an actual stdio initialize/list-tools/call-tool round trip. All seven tools are registered. Two fact calls retain distinct session identities and produce a confirmation count of two; all three calls emit MCP telemetry with the supplied session identity. Only temporary databases were used. Production source was unchanged, so this is migration evidence, not a completed fix.

The fix must preserve compatibility with the supported MCP 1 series, widen the dependency constraint, regenerate the lock from current main without dropping the security updates, and pass the full test suite plus the stdio check under MCP 1 and MCP 2. Code execution is pending the repository's device-signed build grant.