build: update mcp requirement from <2,>=1.27 to >=1.27,<3 in the python group

[dependabot]

Updates the requirements on mcp to permit the latest version.
Updates mcp to 2.1.1

Release notes

Sourced from mcp's releases.

v2.1.1

What's Changed

• Point imports of mcp.server.fastmcp at the migration guide by @​maxisbey in modelcontextprotocol/python-sdk#3388

Full Changelog: modelcontextprotocol/python-sdk@v2.1.0...v2.1.1

Commits

• 0921d94 Point imports of mcp.server.fastmcp at the migration guide (#3388)
• 4d6f87e Build releases with the pinned hatchling and a publish action that accepts Me...
• c5d7d0b docs: refresh translations for recent English changes (#3379)
• d8b6383 Give recursive tool return types an object-rooted output schema (#3376)
• 56af447 Log MCPServer handler exceptions by kind and keep crash details off the wire ...
• f1c40b0 Accept boolean sub-schemas in 2025-11-25 tool schema properties (#3354)
• 57394b0 Apply the request body limit to the SSE and OAuth endpoints (#3336)
• 0cee624 Hand TypedDict tool results to pydantic natively (#3331)
• 0d92192 Shorten stdio test comments (#3329)
• b2025ab Acknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry (#3326)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[CameronBrooks11]

The gate is right and this cannot merge as-is. Recording the diagnosis.

Widening to mcp<3 resolves mcp 2.x, where FastMCP was renamed to MCPServer. This repo already anticipated that:

ModuleNotFoundError: No module named 'mcp.server.fastmcp'.
This is mcp 2.x, where FastMCP was renamed to MCPServer ...

That message is deliberate — the repo raises it precisely so this failure names its own cause rather than surfacing as an opaque import error. So the guard worked exactly as designed, on the first real occasion it could.

Widening the range is therefore not a version bump but a migration: the MCP surface has to move to MCPServer first, and only then can the ceiling lift. That is real work with its own decision to record, not something to merge from a dependency PR.

Leaving open rather than closing: it is the tracking artifact for that migration until an issue supersedes it.

[CameronBrooks11]

Correction to my earlier comment on this PR, and the real work is now tracked in #35.

I wrote that netspec "raises a deliberate error naming that migration, and it fired correctly on its first real occasion." That is wrong on both counts, and I established it by running the thing rather than reading it.

The except ImportError at mcp.py:212 is a guard for the mcp extra not being installed. ModuleNotFoundError is a subclass of ImportError, so under mcp 2.x it swallows a message that names the rename, the new import path and the migration guide, and replaces it with netspec-mcp needs the mcp extra — advice to install a package that is already installed. Measured on mcp 2.1.1 with this tree: exit 4, wrong reason.

What actually reports the truth is pyright in the Check job ("FastMCP" is unknown import symbol, lines 36 and 113), which only runs in CI.

#35 carries both halves: stop discarding the cause, which is worth doing whenever the migration happens, and the migration itself.