diff --git a/pyproject.toml b/pyproject.toml
index ebabf741..ab10e27d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -68,7 +68,7 @@ mcp = [
     # WebSocket Host/Origin validation required at Roam's MCP boundary.
     # SDK 2 / FastMCP 4 change transport and sampling APIs. Migrate and validate
     # that protocol generation explicitly instead of silently accepting it.
-    "mcp>=1.28.1,<2",
+    "mcp>=1.28.1,<3",
 ]
 metrics = [
     # The numeric stack behind the spectral metrics: `Algebraic Connectivity`
@@ -138,7 +138,7 @@ dev = [
     # registry (``_TOOL_METADATA`` is empty without it because the
     # decorator becomes a no-op).
     "fastmcp>=2.0,<4",
-    "mcp>=1.28.1,<2",
+    "mcp>=1.28.1,<3",
     # PyYAML is the canonical parser for .roam/rules.yml + .roamignore-findings.
     # In production it stays optional — the in-tree _parse_simple_yaml /
     # _emit_simple_yaml fallback covers the documented shapes. Pinned here