build(deps): pin mcp SDK below 2.0 ahead of protocol RC (#5953)

# What does this PR do?

Pins the `mcp` Python SDK dependency to `>=1.23.0,<2.0` across all five
declaration sites (pyproject.toml core, type_checking, test-common, and
two provider registry specs). This prevents fresh installs from pulling
an incompatible SDK version when the MCP 2026-07-28 Release Candidate
ships, which introduces breaking changes to the session model, transport
layer, and protocol handshake.

Partial #5952 (this addresses the immediate dependency pin; the full
migration is tracked there)

## Test Plan

1. Verify all `mcp>=` references are pinned with `<2.0` upper bound:
```bash
rg '"mcp>=' pyproject.toml src/ogx/providers/registry/
```

2. Run pre-commit to confirm no regressions:
```bash
uv run pre-commit run --all-files
```

Output: all 40 checks passed.
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5953"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------

Signed-off-by: Sébastien Han <seb@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: leseb

pyproject.toml

@@ -71,7 +71,7 @@ dependencies = [
     "aiosqlite>=0.21.0",                              # server - for metadata store
     "asyncpg",                                        # for metadata store
     "sqlalchemy[asyncio]>=2.0.41",                    # server - for conversations
-    "mcp>=1.23.0",                                    # for connectors
+    "mcp>=1.23.0,<2.0",                                # for connectors
     "zstandard>=0.23.0",                              # server - zstd request decompression
     "models-dev>=1.0.398",
 ]
@@ -176,7 +176,7 @@ type_checking = [
     "sqlite-vec",
     "faiss-cpu",
     "lm-format-enforcer",
-    "mcp>=1.23.0",
+    "mcp>=1.23.0,<2.0",
     "ollama",
     "langchain-openai>=1.2.2",
     "langchain-core",
@@ -188,7 +188,7 @@ test-common = [
     "aiosqlite",
     "asyncpg>=0.29.0",
     "chardet",
-    "mcp>=1.23.0",
+    "mcp>=1.23.0,<2.0",
     "pgvector>=0.3.0",
     "psycopg2-binary>=2.9.0",
     "pypdf>=6.10.2",

src/ogx/providers/registry/responses.py

@@ -29,7 +29,7 @@ def available_providers() -> list[ProviderSpec]:
                 "pillow",
                 "pandas",
                 "scikit-learn",
-                "mcp>=1.23.0",
+                "mcp>=1.23.0,<2.0",
             ]
             + kvstore_dependencies(),  # TODO make this dynamic based on the kvstore config
             module="ogx.providers.inline.responses.builtin",

src/ogx/providers/registry/tool_runtime.py

@@ -90,7 +90,7 @@ def available_providers() -> list[ProviderSpec]:
             provider_type="remote::model-context-protocol",
             module="ogx.providers.remote.tool_runtime.model_context_protocol",
             config_class="ogx.providers.remote.tool_runtime.model_context_protocol.config.MCPProviderConfig",
-            pip_packages=["mcp>=1.23.0"],
+            pip_packages=["mcp>=1.23.0,<2.0"],
             provider_data_validator="ogx.providers.remote.tool_runtime.model_context_protocol.config.MCPProviderDataValidator",
             description="Model Context Protocol (MCP) tool for standardized tool calling and context management.",
         ),