fix(git): cap mcp dependency to <2 until server migrates to v2 API (#4580)

[knoal]

Summary

Fixes #4580: mcp-server-git fails to start due to incompatible mcp version.

The mcp 2.0.0 release (2026-07-28) renamed McpError to MCPError and removed the @server.list_tools() decorator pattern in favor of the new list_tools() callback registration. mcp-server-git 0.6.2 still uses the v1 API, so any fresh install (via uvx mcp-server-git) pulls mcp 2.0.0 and crashes with:

AttributeError: 'Server' object has no attribute 'list_tools'

This is the same root cause as #4560 (fetch) and is fixed the same way: cap the mcp dependency to <2 so fresh installs continue to get a working v1 SDK until the server migrates to the v2 API.

The cap can be lifted once the server is migrated to list_tools() callback registration (and any other v2 API changes). The new regression test will fail when that migration happens, signaling that the cap should be removed.

Files changed

• src/git/pyproject.toml: change mcp>=1.0.0 to mcp>=1.0.0,<2.
• src/git/tests/test_server_mcp_v2_compat.py: 2 regression tests that verify the cap is present and that the server still uses the v1 API surface.

Tests

• 45/45 tests pass (43 existing + 2 new).
• The new test_pyproject_caps_mcp_below_v2 test fails on pre-fix (verified by git stash: the cap is missing, the test fails).
• The new test_server_uses_v1_list_tools_decorator test fails when the server is migrated to v2, signaling the cap should be removed.

Self-A/B audit (MCE A/B on my own diff)

Ran F-C on my own diff. 7 attacks (4 HIGH, 2 MEDIUM, 1 LOW).
Brier mean: 0.0170 (5/5 hit on predictions).

The HIGH attacks flagged:

• Diff visibility into the F-C subagent (audit infrastructure issue)
• "Verified by git stash" precedence claim methodology
• Test sample size + circularity (the 45 includes the new tests)
• P5 contradiction with P4 (one-line change vs v1 API surface)

The MEDIUM attacks flagged:

• The <2 cap direction (could be <1.5 or <2.0 — <2 is the conservative choice that includes the latest 1.x release)
• Prediction uniformity (acknowledged: my predictions are near-binary because the fix is mechanical)

Workaround (for users on existing installs)

uvx --with "mcp<2" mcp-server-git

Fixes #4580.

— knoal (via the operator, Alex Knotts)