diff --git a/mcp-server/requirements.txt b/mcp-server/requirements.txt
index a5aa6e2..d4498f9 100644
--- a/mcp-server/requirements.txt
+++ b/mcp-server/requirements.txt
@@ -1 +1,4 @@
-mcp>=1.2.0
+# Pinned below 2.0: mcp 2.0.0 removed mcp.server.fastmcp (and the 1.x
+# lowlevel/transport_security layout this server imports). Migrating to the
+# 2.x API is a deliberate change, not a rebuild side effect.
+mcp>=1.2.0,<2