build(deps): pin mcp SDK below 2.0 ahead of protocol RC (backport #5953)

[mergify]

What does this PR do?

Pins the mcp Python SDK dependency to >=1.23.0,<2.0 across all five declaration sites (pyproject.toml core, type_checking, test-common, and two provider registry specs). This prevents fresh installs from pulling an incompatible SDK version when the MCP 2026-07-28 Release Candidate ships, which introduces breaking changes to the session model, transport layer, and protocol handshake.

Partial #5952 (this addresses the immediate dependency pin; the full migration is tracked there)

Test Plan

1. Verify all mcp>= references are pinned with <2.0 upper bound:

rg '"mcp>=' pyproject.toml src/ogx/providers/registry/

2. Run pre-commit to confirm no regressions:

uv run pre-commit run --all-files

Output: all 40 checks passed.

---

---

This is an automatic backport of pull request #5953 done by [Mergify](https://mergify.com).

---

[mergify]

Cherry-pick of bb63ea6 has failed:

On branch mergify/bp/release-1.0.x/pr-5953
Your branch is up to date with 'origin/release-1.0.x'.

You are currently cherry-picking commit bb63ea69.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   src/ogx/providers/registry/responses.py
	modified:   src/ogx/providers/registry/tool_runtime.py

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   pyproject.toml
	both modified:   uv.lock

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[devin-ai-integration]

Devin Review found 4 potential issues.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 Incomplete mcp<2.0 pin: starter optional dependency group still allows mcp 2.x

The PR's intent is to pin mcp below 2.0 across all dependency specifications. The starter optional dependency group at pyproject.toml:100 still specifies "mcp>=1.23.0" without the <2.0 upper bound. Users installing with pip install ogx[starter] could get mcp 2.x, which the PR explicitly aims to prevent.

(Refers to line 100)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔴 Incomplete mcp<2.0 pin: unit dependency group still allows mcp 2.x

The unit dependency group at pyproject.toml:222 still specifies "mcp>=1.23.0" without the <2.0 upper bound, inconsistent with the PR's goal. Unit tests could install mcp 2.x, causing test failures or masking compatibility issues that the pin was supposed to prevent.

(Refers to line 222)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔴 Incomplete mcp<2.0 pin: test dependency group still allows mcp 2.x

The test dependency group at pyproject.toml:245 still specifies "mcp>=1.23.0" without the <2.0 upper bound, inconsistent with the PR's goal. Integration tests could install mcp 2.x, causing test failures or allowing incompatible code to pass CI.

(Refers to line 245)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔴 Unresolved git merge conflict markers in pyproject.toml break TOML parsing

Lines 194–209 of pyproject.toml contain literal <<<<<<< HEAD, =======, and >>>>>>> bb63ea69 merge conflict markers. These are invalid TOML syntax and will cause any TOML parser (pip, uv, setuptools, etc.) to fail when reading the file, completely breaking dependency resolution, installation, and builds.

Prompt for agents

The pyproject.toml file contains unresolved git merge conflict markers at lines 194-209 within the type_checking dependency group. The conflict is between HEAD (which has `ogx-client==1.0.2` and no test-common group) and the bb63ea69 commit (which has `ogx-client>=1.0.2` and introduces a new test-common dependency group). You need to resolve this merge conflict by deciding:

1. Which version spec to use for ogx-client (==1.0.2 vs >=1.0.2)
2. Whether to include the new test-common dependency group

Remove all three conflict marker lines (<<<<<<< HEAD, =======, >>>>>>> bb63ea69) and keep the intended content. Given the PR is about pinning mcp<2.0, you likely want to keep both the ogx-client entry (closing the type_checking group) and the new test-common group with its mcp pin.

---

Was this helpful? React with 👍 or 👎 to provide feedback.