fix(ci): pin mcp additional_dependency in mypy pre-commit hook

[JSv4]

Summary

• The mypy pre-commit hook's additional_dependencies list pins nearly every entry to match requirements/base.txt, but mcp>=1.0.0 had no ceiling — pip resolved it to mcp 2.1.1 in the hook's isolated env.
• mcp 2.x renamed/removed fields and methods (Server.list_resources, uriTemplate→uri_template, inputSchema→input_schema) that opencontractserver/mcp/server.py (written against the 1.x API; requirements/base.txt pins <2) still uses, producing 48 mypy errors unrelated to any PR's actual diff.
• This has been failing linter/backend-ci-gate on every open PR touching backend code (confirmed on PRs chore(deps): bump flower from 2.0.1 to 2.1.0 #2291, chore(deps): update openai requirement from <3,>=2.52.0 to >=3.6.0,<4 #2292, chore(deps): bump cryptography from 50.0.0 to 50.0.1 #2293, chore(deps): bump posthog from 7.35.4 to 7.44.2 #2294, and present on main's current HEAD before any of them existed).
• Fix: pin mcp>=1.28.1,<2 to match the runtime ceiling, same convention already used for openai>=2.11.0,<3 and anthropic>=0.45.2,<1 a few lines above.

Test plan

• pre-commit run mypy --files opencontractserver/mcp/server.py passes locally with the fix
• pre-commit run --files .pre-commit-config.yaml (full suite) passes
• CI green on this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_0199pawBYHjfsWUyPyrhRRtu

[claude]

Reviewed the diff — this is a clean, minimal, well-targeted fix.

Correctness

• Verified requirements/base.txt:85 pins mcp>=1.28.1,<2; the new hook constraint mirrors it exactly, so mypy's isolated env and the actual runtime env now resolve the same major version. That's the right fix for the root cause (unbounded mcp>=1.0.0 letting pip pull in mcp 2.x with its renamed Server.list_resources/uriTemplate→uri_template/inputSchema→input_schema API).
• Consistent with the existing convention a few lines above (openai>=2.11.0,<3, anthropic>=0.45.2,<1), so it doesn't introduce a new pattern — just applies the existing one where it was missing.

Code quality

• The added comment explains why the ceiling exists (a hidden constraint — mismatched hook/runtime mcp versions silently breaking CI on unrelated PRs), which is exactly the kind of non-obvious rationale worth a comment per the repo's comment guidance.
• Changelog fragment follows the changelog.d/<slug>.<type>.md convention correctly and is appropriately detailed (file, symbols, impact).

Risk / scope

• Config-only change, no production code touched, blast radius is limited to the mypy pre-commit hook's isolated environment. Low risk.
• No test coverage gap here — this is infra/tooling config, and the PR description notes local verification (pre-commit run mypy --files opencontractserver/mcp/server.py and the full pre-commit suite) as the practical validation, which is appropriate for this kind of change.

No issues found. One very minor, non-blocking thought: since this class of bug (hook dependency drifting ahead of requirements/base.txt) has now broken CI twice-ish across multiple PRs, it might be worth a follow-up (not this PR) to add a lint/check that diffs pinned additional_dependencies versions against requirements/base.txt for the packages that intentionally mirror it — but that's speculative scope creep, not something this PR needs to solve.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!