Pin mcp below v2 to fix pip resolution and avoid a breaking-API bump

[JSv4]

Summary

• requirements/base.txt pins mcp to >=1.28.1,<2 (was unbounded).
• Dependabot's Update mcp requirement from <2,>=1.28.1 to >=2.0.0,<3 #2207 (mcp>=2.0.0) hits pip's resolution-too-deep: pydantic-ai-slim[mcp] → fastmcp-slim caps mcp<2.0 across its whole published range, so the unbounded pin was only ever resolving to 1.x by transitive accident.
• mcp 2.0 is also a breaking rewrite — mcp.server.lowlevel.Server drops decorator-based handler registration (@mcp_server.list_resources() etc.) for on_*= constructor kwargs with a new (ctx, params) signature. opencontractserver/mcp/server.py uses the old decorator API at 10 registration sites across create_mcp_server() / create_scoped_mcp_server(), both of which run at Django/ASGI import time — forcing the bump would break the MCP subsystem at process startup, not just in CI.
• PR Update mcp requirement from <2,>=1.28.1 to >=2.0.0,<3 #2207 is left open/unmerged. Revisit the mcp 2.x migration as its own scoped task once fastmcp-slim ships v2 support.

Test plan

• pip install --dry-run against the updated requirements/local.txt resolves cleanly (previously ResolutionImpossible/resolution-too-deep).
• pre-commit run --files requirements/base.txt passes.
• Changelog fragment added and validated (scripts/collate_changelog.py --check).

[claude]

Reviewed the diff (requirements/base.txt + changelog fragment). This is a clean, well-scoped fix — nice work tracing the transitive cap through pydantic-ai-slim[mcp] → fastmcp-slim rather than just bumping blindly.

Verified claims:

• opencontractserver/mcp/server.py does indeed use decorator-based registration (@mcp_server.list_resources(), @mcp_server.list_tools(), @scoped_server.call_tool(), etc.) at multiple sites in both create_mcp_server() and create_scoped_mcp_server() — confirms the "would break at ASGI import time" claim isn't hypothetical.
• No other requirements file re-pins mcp (checked local.txt, production.txt, test.txt, and the ingestors/postprocessors/analyzers subdirs) and there's no Python lockfile, so the constraint change is isolated to the one file as intended.
• Changelog fragment follows the changelog.d/<slug>.<type>.md convention correctly and includes file/line pointer + rationale per CLAUDE.md guidance.

Minor/optional notes (non-blocking):

1. The old comment URL (https://github.com/anthropics/python-sdk) was actually wrong before this PR too — good catch fixing it to https://github.com/modelcontextprotocol/python-sdk, but worth calling out explicitly in the PR description since it's a drive-by fix bundled into a dependency-pin PR.
2. Since PR Update mcp requirement from <2,>=1.28.1 to >=2.0.0,<3 #2207 (the Dependabot bump) is left open, it'll likely just get closed automatically or re-flagged by Dependabot next cycle unless this PR's pin causes Dependabot to recognize <2 as the ceiling and stop proposing 2.x. Might be worth closing Update mcp requirement from <2,>=1.28.1 to >=2.0.0,<3 #2207 explicitly with a comment linking here, so it doesn't linger as a stale "conflicting" PR for other contributors to trip over.
3. Consider filing a tracking issue for the mcp 2.x migration (10 registration sites) referenced in both the pin comment and the changelog fragment, so "revisit once fastmcp-slim ships v2 support" has a concrete place to live rather than just prose in a comment/changelog. Otherwise this constraint risks going stale and no one remembers why it's there in a year.

No functional/security/test-coverage concerns — this is a pure dependency-constraint fix with correct, verifiable rationale documented inline and in the changelog.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!