[rajivpant]

Moves Ragbot from mcp 1.27.1 to 2.3.0, the current release. This replaces Dependabot #148, which could not carry the change as a version bump. The full record is in the "mcp 2.x port" section of docs/security/dependabot-triage-2026-11.md.

Port

• Client primitives: paging through params=, string URIs, ClientRequestContext callbacks, snake_case attributes.
• synthesis_engine.mcp.tasks: 2.x has no client task helpers, so the module sends the 2025-11-25 task requests itself and polls at the server's suggested interval.
• Streamable HTTP client built on an httpx2.AsyncClient carrying headers, timeout and OAuth. The OAuth callback returns AuthorizationCodeResult, including RFC 9207 iss.
• RagbotMCPServer: handlers are passed to the 2.x constructor. Tool calls validate input and output schemas and return structured content plus error results, which 1.x did implicitly.
• Proxy relays pages by cursor and returns tool results whole. Under 1.x it dropped isError and structured content.

Defects fixed along the way

• The agent loop read isError. On 2.x that attribute does not exist, so failed MCP tool calls would have reached the agent as successful output.
• The HTTP bearer token was passed to the tool handler through a ContextVar the SDK's session tasks may not see. The handler now resolves the token from the request it is serving, and refuses an unauthenticated HTTP request.
• The HTTP app never started the session manager's lifespan. It now wraps the SDK's streamable_http_app and serves at /mcp.
• The OAuth loopback page echoed the error query parameter unescaped.
• The API's tool and resource JSON now matches the snake_case keys web/src/lib/api.ts already declares.

requirements.txt: mcp>=2.3.0,<3, plus httpx2 and jsonschema declared because Ragbot imports them directly.

Verification: clean Python 3.12 install, pip check clean, 1035 passed / 13 skipped (main: 1015). New tests cover:

• task polling and paging over real JSON-RPC;
• proxy pass-through;
• schema validation and error results;
• unknown resources as INVALID_PARAMS;
• fail-closed bearer resolution;
• a Streamable HTTP round trip through Uvicorn: 401 without a token, allowed_tools enforced with one.

🤖 Generated with Claude Code