fix(deps): cap mcp below 2.0

[jessie1111101]

What

Change the root mcp dependency from mcp>=1.27.1 to mcp>=1.27.1,<2.

Why

mcp is a root dependency — everyone installing the benchmark gets it — and it currently declares a floor with no ceiling.

The api harness imports the MCP client surface directly:

# devops_bench/agents/api/mcp.py
from mcp.client.session import ClientSession
from mcp.client.stdio import StdioServerParameters, stdio_client

Semver puts no constraint on what a 2.0 release may do to that surface. Until the cap exists, a routine uv sync, a lockfile refresh, or a fresh install on a CI runner can resolve a breaking major without anyone touching this repo. The first symptom would be a benchmark run failing on a dependency nobody changed — an expensive thing to debug mid-eval, and an easy thing to prevent.

This is the standard reason to cap a direct dependency at the next major, and it is worth doing pre-emptively rather than reactively because the failure lands on whoever happens to sync next.

Blast radius

Resolution is unchanged. mcp stays at 1.28.1 and no other package moves — the entire uv.lock diff is the one specifier line:

-    { name = "mcp", specifier = ">=1.27.1" },
+    { name = "mcp", specifier = ">=1.27.1,<2" },

So this is a guard, not an upgrade. Lifting it is a deliberate follow-up once the 2.x client API is known and the harness is ported.

Testing

uv run pytest — 1212 passed.

Context

Noticed while adding an ADK agent harness (#137). ADK's McpToolset caps itself at mcp<2, but only under its mcp / all / test extras, so that ceiling does not enter our resolution. Capping at the root covers both consumers. Filed separately because it touches the api harness and every future MCP consumer, and deserves review on its own terms rather than buried in a feature PR.

Tracked by #138.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jessie1111101
Once this PR has been reviewed and has the lgtm label, please assign janetkuo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 43b11356-e7a8-49d1-b743-fb778a2340b4

📥 Commits

Reviewing files that changed from the base of the PR and between 1907bf9 and 48a5818.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (1)

• pyproject.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kubernetes-prow]

Hi @jessie1111101. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.