diff --git a/pyproject.toml b/pyproject.toml
index 0f5a7fc3..f643ef23 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ description = "Governed MCP authorization, metering, signed receipts, and audit
 requires-python = ">=3.11"
 
 [project.optional-dependencies]
-mcp = ["mcp>=1.29.0,<2", "httpx>=0.28.1,<0.29", "httpcore==1.0.9", "pydantic-settings>=2.14.2"]
+mcp = ["mcp>=1.29.0,<3", "httpx>=0.28.1,<0.29", "httpcore==1.0.9", "pydantic-settings>=2.14.2"]
 playwright = ["playwright>=1.40.0"]
 browser = ["playwright>=1.40.0"]
 webauthn = ["webauthn>=1.0.0", "cryptography>=50.0.0", "pyasn1>=0.6.4"]
diff --git a/requirements.txt b/requirements.txt
index 6012d9a0..320640e0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -27,7 +27,7 @@ redis>=8.1.0            # Redis-backed rate limiting and runtime persistence
 asyncpg>=0.31.0         # PostgreSQL-backed runtime persistence
 greenlet>=3.5.5         # SQLAlchemy async engine support
 stripe>=15.5.0           # Stripe payment processing
-mcp>=1.29.0,<2         # MCP SDK; >=1.29.0 provides the pre-parse request-body guard used by public/partner transports; <2 guards v1 internals
+mcp>=1.29.0,<3         # MCP SDK; >=1.29.0 provides the pre-parse request-body guard used by public/partner transports; <2 guards v1 internals
 
 # --- Database ---
 sqlmodel>=0.0.39        # SQLAlchemy + Pydantic hybrid ORM