diff --git a/package.json b/package.json
index 35cfef99..e947ec39 100644
--- a/package.json
+++ b/package.json
@@ -60,6 +60,7 @@
   },
   "pnpm": {
     "overrides": {
+      "@modelcontextprotocol/sdk": "^1.26.0",
       "@types/uuid": "^9.0.8",
       "hono": "^4.11.7",
       "uuid": "^10.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5ade2a9d..09334de7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -36,9 +36,6 @@ catalogs:
     '@microsoft/agents-hosting':
       specifier: ^1.3.1
       version: 1.4.2
-    '@modelcontextprotocol/sdk':
-      specifier: ^1.26.0
-      version: 1.29.0
     '@openai/agents':
       specifier: ^0.7.0
       version: 0.7.2
@@ -94,7 +91,7 @@ catalogs:
       specifier: ^9.39.1
       version: 9.39.4
     express:
-      specifier: ^5.2.0
+      specifier: ^5.2.1
       version: 5.2.1
     jest:
       specifier: ^30.2.0
@@ -125,6 +122,7 @@ catalogs:
       version: 8.59.1
 
 overrides:
+  '@modelcontextprotocol/sdk': ^1.26.0
   '@types/uuid': ^9.0.8
   hono: ^4.11.7
   uuid: ^10.0.0
@@ -487,7 +485,7 @@ importers:
         specifier: 'catalog:'
         version: 1.4.2
       '@modelcontextprotocol/sdk':
-        specifier: 'catalog:'
+        specifier: ^1.26.0
         version: 1.29.0(@cfworker/json-schema@4.1.1)(zod@4.3.6)
       express:
         specifier: 'catalog:'
@@ -545,7 +543,7 @@ importers:
         specifier: 'catalog:'
         version: 1.4.2
       '@modelcontextprotocol/sdk':
-        specifier: 'catalog:'
+        specifier: ^1.26.0
         version: 1.29.0(@cfworker/json-schema@4.1.1)(zod@4.3.6)
     devDependencies:
       '@eslint/js':
@@ -737,7 +735,7 @@ importers:
         specifier: 'catalog:'
         version: 1.4.2
       '@modelcontextprotocol/sdk':
-        specifier: 'catalog:'
+        specifier: ^1.26.0
         version: 1.29.0(@cfworker/json-schema@4.1.1)(zod@4.3.6)
       '@openai/agents':
         specifier: 'catalog:'
@@ -1825,6 +1823,7 @@ packages:
 
   '@ungap/structured-clone@1.3.0':
     resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
+    deprecated: Potential CWE-502 - Update to 1.3.1 or higher
 
   '@unrs/resolver-binding-android-arm-eabi@1.11.1':
     resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==}
@@ -3555,6 +3554,7 @@ packages:
 
   uuid@10.0.0:
     resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==}
+    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
     hasBin: true
 
   v8-to-istanbul@9.3.0:
@@ -4894,7 +4894,7 @@ snapshots:
   '@types/jsonwebtoken@9.0.10':
     dependencies:
       '@types/ms': 2.1.0
-      '@types/node': 20.19.39
+      '@types/node': 25.6.0
 
   '@types/ms@2.1.0': {}
 
@@ -4912,7 +4912,7 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 20.19.39
+      '@types/node': 25.6.0
 
   '@types/yargs-parser@21.0.3': {}
 
@@ -6062,7 +6062,7 @@ snapshots:
   jest-mock@30.3.0:
     dependencies:
       '@jest/types': 30.3.0
-      '@types/node': 20.19.39
+      '@types/node': 25.6.0
       jest-util: 30.3.0
 
   jest-pnp-resolver@1.2.3(jest-resolve@30.3.0):
@@ -6615,7 +6615,7 @@ snapshots:
       '@protobufjs/path': 1.1.2
       '@protobufjs/pool': 1.1.0
       '@protobufjs/utf8': 1.1.1
-      '@types/node': 20.19.39
+      '@types/node': 25.6.0
       long: 5.3.2
 
   proxy-addr@2.0.7:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8d145adc..813642d0 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,7 +11,7 @@ catalog:
   "@azure/identity": "^4.12.1"
 
   # Express framework
-  "express": "^5.2.0"
+  "express": "^5.2.1"
 
   # JSON Web Token
   "jsonwebtoken": "^9.0.3"
@@ -27,7 +27,7 @@ catalog:
   "@microsoft/agents-hosting": "^1.3.1"
   "@microsoft/agents-activity": "^1.3.1"
 
-  # Hono - required peer dependency for MCP SDK and OpenAI agents
+  # Hono - required peer dependency for @openai/agents (bundled as a dependency in @modelcontextprotocol/sdk since 1.26.0)
   "hono": "^4.11.7"
 
   # Model Context Protocol SDK
@@ -75,6 +75,9 @@ catalog:
   "uuid": "^9.0.1"
 
 overrides:
+  # MCP SDK - force single version across all dependents (e.g. @langchain/mcp-adapters)
+  "@modelcontextprotocol/sdk": "^1.26.0"
+
   # Brace expansion - update for bug fixes
   "@isaacs/brace-expansion": "^5.0.1"