diff --git a/pyproject.toml b/pyproject.toml
index e484f732..585acfed 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -66,7 +66,7 @@ server = [
 mcp = [
     # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly
     # recommends the <2 cap because stable v2 is a breaking line.
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "starlette>=1.3.1,<2; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
@@ -118,7 +118,7 @@ all = [
     "python-dotenv>=1.0",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "sentence-transformers>=2.7",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=48.0.1; python_version >= '3.10'",
     "tree-sitter>=0.23",
@@ -148,7 +148,7 @@ test = [
     "python-multipart>=0.0.31; python_version >= '3.10'",
     # exercises the real sqlite-vec ANN backend (k=? KNN + filtered widening) in CI.
     "sqlite-vec>=0.1.6",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=48.0.1; python_version >= '3.10'",
     "tree-sitter>=0.23",
diff --git a/requirements.txt b/requirements.txt
index 9f21a6bf..8420dcf4 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,6 +15,6 @@ numpy>=1.24
 pydantic>=2.0
 python-dotenv>=1.0
 sentence-transformers>=2.7
-mcp>=1.28.1,<2; python_version >= '3.10'
+mcp>=1.28.1,<3; python_version >= '3.10'
 pydantic-settings>=2.14.2; python_version >= '3.10'
 cryptography>=48.0.1; python_version >= '3.10'