AI-2165: upgrade mcp==1.22.0, fastmcp==2.13.1 and other libs

[vita-stejskal]

These upgrades unfortunately do not fix the security warning -- Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default. The fix is present in mcp==1.23.0 which is incompatible with fastmcp==2.13.* versions. We will have to wait for fastmcp==2.14 or newer.

Plus there is a regression (2524)[https://github.com/jlowin/fastmcp/issues/2524] in fastmcp==2.13.2 which breaks the tools that use Context ctx parameter (i.e. all our tools).

See also:

• https://github.com/jlowin/fastmcp/releases/tag/v2.13.3
• KeyError: 'ctx' when registering Context-dependent tool wrapped by async decorator (fastmcp>=2.13.2) jlowin/fastmcp#2524

[linear]

AI-2165 [MCP] Upgrade mcp and fastmcp libraries

[AidanAllchin]

Got a PR up for the regression FYI, hope it helps

[mariankrotil]

Approving and can we upgrade to fastmcp 2.13.3 now when the regression is fixed? It seems that the mcp 1.23.1 version is now used in the fastmcp/pyproject dependencies.

[vita-stejskal]

Approving and can we upgrade to fastmcp 2.13.3 now when the regression is fixed? It seems that the mcp 1.23.1 version is now used in the fastmcp/pyproject dependencies.

Yes, I'll do another PR and upgrade to the fastmcp version that contains the fix (i.e. PR#2563) once its released. The fastmcp 2.13.3 does not contain the fix. You are correct that the main branch of fastmcp project already contains the fix and uses mcp>=1.23.1, but it's still yet to be released (presumably as fastmcp 2.14.0).