diff --git a/.github/wheel-constraints/nemo-platform-services.txt b/.github/wheel-constraints/nemo-platform-services.txt
index c1a3ede5c5..f7a6ba7eff 100644
--- a/.github/wheel-constraints/nemo-platform-services.txt
+++ b/.github/wheel-constraints/nemo-platform-services.txt
@@ -39,7 +39,7 @@ langchain-community==0.3.31
 langchain-core==1.4.9
 langchain-nvidia-ai-endpoints==1.4.3
 langchain-openai==1.3.5
-langchain==1.3.13
+langchain==1.3.14
 lark==1.3.1
 litellm<1.92  # 1.92.0 native build has no py3.14 wheel
 nemo-anonymizer==0.3.0
diff --git a/docker-bake.hcl b/docker-bake.hcl
index de391eb987..08162977a5 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -412,8 +412,9 @@ target "nmp-rl-training" {
   context    = "."
   dockerfile = "docker/Dockerfile.nmp-rl-training"
   contexts = {
-    platform-workspace = "target:rl-platform-workspace"
-    nmp-rl-base        = "target:nmp-rl-base-builder"
+    platform-workspace     = "target:rl-platform-workspace"
+    nmp-rl-base            = "target:nmp-rl-base-builder"
+    ffmpeg-vlm-wheel-image = ffmpeg_vlm_wheel_context()
   }
   cache-to   = maybe_registry_cache_to("nmp-rl-training")
   cache-from = maybe_registry_cache_from("nmp-rl-training")
diff --git a/docker/Dockerfile.nmp-customizer-tasks b/docker/Dockerfile.nmp-customizer-tasks
index 6b5114c529..92c41c70ef 100644
--- a/docker/Dockerfile.nmp-customizer-tasks
+++ b/docker/Dockerfile.nmp-customizer-tasks
@@ -67,6 +67,56 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     -e /app/packages/nmp_customization_common \
     -e /app/services/core/models
 
+# Pin scanner-tracked runtime packages into /opt/venv before removing stale
+# NGC system-site copies inherited from nvcr.io/nvidia/pytorch:26.05-py3.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --python ${VIRTUAL_ENV}/bin/python --no-cache \
+    --overrides /app/docker/customizer/preserve_base_torch.txt \
+    "aiohttp>=3.14.1,<4" \
+    "grpcio>=1.81.1,<2" \
+    "jupyter-server>=2.20.0,<3" \
+    "mistune>=3.3.3,<4" \
+    "soupsieve>=2.8.4,<3" \
+    "tornado>=6.5.7,<7" \
+    "urllib3>=2.7.0,<3" \
+    "wandb>=0.28.1,<1"
+
+# CVE cleanup for unused/stale packages from the NGC base image. The task entry
+# points import from /opt/venv; scanners still report the shadowed system copies.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --only-upgrade openssl libssl3t64 && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf \
+    /usr/local/lib/python3.12/dist-packages/aiohttp \
+    /usr/local/lib/python3.12/dist-packages/aiohttp-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/black \
+    /usr/local/lib/python3.12/dist-packages/_black* \
+    /usr/local/lib/python3.12/dist-packages/black-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/blackd \
+    /usr/local/lib/python3.12/dist-packages/tornado \
+    /usr/local/lib/python3.12/dist-packages/tornado-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/onnx \
+    /usr/local/lib/python3.12/dist-packages/onnx-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/urllib3 \
+    /usr/local/lib/python3.12/dist-packages/urllib3-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/grpc \
+    /usr/local/lib/python3.12/dist-packages/grpcio \
+    /usr/local/lib/python3.12/dist-packages/grpcio-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/wandb \
+    /usr/local/lib/python3.12/dist-packages/wandb-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/mlflow \
+    /usr/local/lib/python3.12/dist-packages/mlflow-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/mlflow_skinny-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/mistune \
+    /usr/local/lib/python3.12/dist-packages/mistune-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/soupsieve \
+    /usr/local/lib/python3.12/dist-packages/soupsieve-*.dist-info \
+    /usr/local/lib/python3.12/dist-packages/jupyter_server \
+    /usr/local/lib/python3.12/dist-packages/jupyter_server-*.dist-info \
+    /usr/local/cuda/NsightSystems-cli-* \
+    /usr/local/bin/nsys \
+    /usr/local/cuda/bin/nsys
+
 ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
 ENTRYPOINT ["/opt/venv/bin/python"]
 CMD ["-m", "nmp.customization_common.tasks.file_io", "--help"]
diff --git a/docker/Dockerfile.nmp-rl-training b/docker/Dockerfile.nmp-rl-training
index a7dd4a0db0..5e57e1ec04 100644
--- a/docker/Dockerfile.nmp-rl-training
+++ b/docker/Dockerfile.nmp-rl-training
@@ -10,6 +10,8 @@
 
 ARG SMOKE_MARKER=smoke_nmp_rl_training
 
+FROM ffmpeg-vlm-wheel-image AS ffmpeg-vlm-wheel-src
+
 # Supplied by bake (target:nmp-rl-base-builder).
 FROM nmp-rl-base AS rl-base
 
@@ -40,6 +42,41 @@ RUN mkdir -p /home/${USERNAME}/.cache && \
 # image has a real /opt/venv).
 RUN ln -sfn /opt/nemo_rl_venv /opt/venv
 
+# Replace base-image av/opencv/decord2 wheels that bundle vulnerable FFmpeg.
+# decord2 stays installed because NeMo-RL imports the `decord` module for
+# multimodal video loading; rebuild it from source against FFmpeg 8.1.2.
+RUN --mount=from=ffmpeg-vlm-wheel-src,target=/tmp/ffmpeg-vlm-wheel-src,readonly \
+    set -e; \
+    for site in ${VIRTUAL_ENV}/lib/python*/site-packages; do \
+        [ -d "${site}" ] || continue; \
+        rm -rf \
+            "${site}/av" \
+            "${site}"/av-*.dist-info \
+            "${site}/av.libs" \
+            "${site}/cv2" \
+            "${site}/opencv_python_headless.libs" \
+            "${site}"/opencv_python_headless-*.dist-info \
+            "${site}/decord" \
+            "${site}"/decord-*.dist-info \
+            "${site}/decord.libs" \
+            "${site}/decord2" \
+            "${site}"/decord2-*.dist-info \
+            "${site}/decord2.libs"; \
+    done; \
+    for archive in /root/.cache/uv/archive-v0/*; do \
+        [ -d "${archive}" ] || continue; \
+        if [ -e "${archive}/av.libs" ] || \
+           [ -e "${archive}/opencv_python_headless.libs" ] || \
+           [ -e "${archive}/decord.libs" ] || \
+           [ -e "${archive}/decord2.libs" ]; then \
+            rm -rf "${archive}"; \
+        fi; \
+    done; \
+    UV_LINK_MODE=copy uv pip install --python ${VIRTUAL_ENV}/bin/python --no-cache --no-deps --reinstall \
+        /tmp/ffmpeg-vlm-wheel-src/wheels/av-*-abi3-manylinux_2_28_*.whl \
+        /tmp/ffmpeg-vlm-wheel-src/wheels/opencv_python_headless-*cp313*.whl \
+        /tmp/ffmpeg-vlm-wheel-src/wheels/decord2-*cp313*.whl
+
 # The NeMo-RL base venv ships some packages with missing dist-info METADATA (a
 # known property of the image — the package code is present, only uv's metadata
 # file is gone). Normal `uv pip install` reads ALL installed metadata during
diff --git a/docker/automodel/Dockerfile.nmp-automodel-base b/docker/automodel/Dockerfile.nmp-automodel-base
index fa395c403a..d27a304f7a 100644
--- a/docker/automodel/Dockerfile.nmp-automodel-base
+++ b/docker/automodel/Dockerfile.nmp-automodel-base
@@ -111,7 +111,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     "urllib3>=2.7.0,<3" \
     "mlflow-skinny>=3.11.1,<3.12.0" \
     "grpcio>=1.81.1,<2" \
-    "wandb>=0.28.0,<1"
+    "wandb>=0.28.1,<1"
 
 # Replace PyPI av/opencv (bundled FFmpeg < 8.1.2) with custom wheels from ffmpeg-vlm-wheel.
 # vlm sync pulls PyPI copies transitively; drop them before installing our manylinux wheels.
diff --git a/docker/base/Dockerfile.python-wheels b/docker/base/Dockerfile.python-wheels
index 6d16a08b80..a38d605c58 100644
--- a/docker/base/Dockerfile.python-wheels
+++ b/docker/base/Dockerfile.python-wheels
@@ -5,7 +5,7 @@
 # Builds Python wheels for:
 #   - causal-conv1d (CUDA extension required by mamba-ssm)
 #   - mamba-ssm     (selective state space model)
-#   - av + opencv-python-headless (FFmpeg 8.1.2 bundled wheels for nspect / VLM)
+#   - av + opencv-python-headless + decord2 (FFmpeg 8.1.2 bundled wheels for nspect / VLM)
 #
 # causal-conv1d / mamba-ssm only ship source on PyPI and require nvcc.
 # av / opencv wheels bundle FFmpeg; upstream PyPI wheels lag nspect 8.1.2.
@@ -19,6 +19,8 @@
 #   FFMPEG_VERSION         - FFmpeg for av/opencv wheels   (default: 8.1.2)
 #   PYAV_VERSION           - PyAV git tag                  (default: v17.1.0)
 #   OPENCV_PYTHON_GIT_TAG   - opencv-python git tag (92 = PyPI 4.13.0.92)
+#   DECORD2_REPO           - decord2 git repository
+#   DECORD2_COMMIT         - decord2 commit to build       (default: 1b4cfbd...)
 #######
 
 ARG CUDA_VERSION=12.8.1
@@ -276,7 +278,7 @@ COPY --from=mamba-ssm-23-wheel-builder-py312-cu13.1.1 /wheels /wheels/cu13.1.1
 COPY --from=mamba-ssm-23-wheel-builder-py312-cu13.2 /wheels /wheels/cu13.2
 
 # =============================================================================
-# FFmpeg / VLM wheels (manylinux_2_28, cp312) — av + opencv-python-headless
+# FFmpeg / VLM wheels (manylinux_2_28) — av + opencv-python-headless + decord2
 # =============================================================================
 FROM quay.io/pypa/manylinux_2_28_x86_64:latest AS ffmpeg-vendor-base-py312-amd64
 FROM quay.io/pypa/manylinux_2_28_aarch64:latest AS ffmpeg-vendor-base-py312-arm64
@@ -324,6 +326,7 @@ RUN mkdir -p /wheels /tmp/wheelhouse && \
 
 # =============================================================================
 # opencv-python-headless wheel — opencv-python 4.13 against shared FFmpeg 8.1.2
+# Python 3.12
 # =============================================================================
 FROM ffmpeg-vendor-base-py312 AS opencv-headless-wheel-builder-py312
 
@@ -350,9 +353,68 @@ RUN mkdir -p /wheels /tmp/wheelhouse && \
     auditwheel repair /tmp/wheelhouse/opencv_python_headless-*.whl -w /wheels && \
     rm -rf /src/opencv-python /tmp/wheelhouse
 
+# =============================================================================
+# opencv-python-headless wheel — opencv-python 4.13 against shared FFmpeg 8.1.2
+# Python 3.13
+# =============================================================================
+FROM ffmpeg-vendor-base-py312 AS opencv-headless-wheel-builder-py313
+
+ARG OPENCV_PYTHON_GIT_TAG=92
+
+ENV CI_BUILD=1 \
+    ENABLE_HEADLESS=1 \
+    PKG_CONFIG_PATH=/ffmpeg_build/lib/pkgconfig:/usr/local/lib/pkgconfig \
+    LD_LIBRARY_PATH=/ffmpeg_build/lib:${LD_LIBRARY_PATH:-} \
+    LDFLAGS=-L/ffmpeg_build/lib
+
+RUN yum install -y \
+    zlib-devel \
+    libjpeg-turbo-devel \
+    && yum clean all
+
+RUN mkdir -p /wheels /tmp/wheelhouse && \
+    /opt/python/cp313-cp313/bin/pip install -U "pip<26" "numpy>=2.0" auditwheel && \
+    git clone --depth 1 --branch ${OPENCV_PYTHON_GIT_TAG} https://github.com/opencv/opencv-python.git /src/opencv-python && \
+    cd /src/opencv-python && \
+    git submodule update --init --recursive opencv && \
+    OPENCV_PYTHON_SKIP_GIT_COMMANDS=1 \
+    /opt/python/cp313-cp313/bin/pip wheel . --no-deps -w /tmp/wheelhouse && \
+    auditwheel repair /tmp/wheelhouse/opencv_python_headless-*.whl -w /wheels && \
+    rm -rf /src/opencv-python /tmp/wheelhouse
+
+# =============================================================================
+# decord2 wheel — decord2 3.4 against shared FFmpeg 8.1.2
+# Python 3.13
+# =============================================================================
+FROM ffmpeg-vendor-base-py312 AS decord2-wheel-builder-py313
+
+ARG DECORD2_REPO=https://github.com/johnnynunez/decord2.git
+ARG DECORD2_COMMIT=1b4cfbd5d2964d411341ccf252051e516845430e
+
+ENV PKG_CONFIG_PATH=/ffmpeg_build/lib/pkgconfig \
+    LD_LIBRARY_PATH=/ffmpeg_build/lib:${LD_LIBRARY_PATH:-} \
+    PATH=/opt/python/cp313-cp313/bin:${PATH}
+
+RUN mkdir -p /wheels /tmp/wheelhouse && \
+    pip install -U "pip<26" "cmake>=3.21" ninja "numpy>=2.0" auditwheel wheel setuptools && \
+    git clone "${DECORD2_REPO}" /src/decord2 && \
+    cd /src/decord2 && \
+    git checkout "${DECORD2_COMMIT}" && \
+    git submodule update --init --recursive && \
+    cmake -S . -B build -G Ninja -DUSE_CUDA=OFF -DCMAKE_BUILD_TYPE=Release -DFFMPEG_DIR=/ffmpeg_build && \
+    cmake --build build --parallel "$(nproc)" && \
+    cd /src/decord2/python && \
+    pip wheel . --no-deps -w /tmp/wheelhouse && \
+    auditwheel repair /tmp/wheelhouse/decord2-*.whl -w /wheels && \
+    rm -rf /src/decord2 /tmp/wheelhouse
+
 # The final ffmpeg-vlm-wheel image contains (one arch per platform build):
-#   - av-*-cp311-abi3-manylinux_2_28_*.whl  (PyAV stable ABI; works on cp312)
+#   - av-*-cp311-abi3-manylinux_2_28_*.whl  (PyAV stable ABI; works on cp312/cp313)
 #   - opencv_python_headless-*-cp312-*.whl
+#   - opencv_python_headless-*-cp313-*.whl
+#   - decord2-*-cp313-*.whl
 FROM scratch AS ffmpeg-vlm-wheel
 COPY --from=av-wheel-builder-py312 /wheels /wheels
 COPY --from=opencv-headless-wheel-builder-py312 /wheels /wheels
+COPY --from=opencv-headless-wheel-builder-py313 /wheels /wheels
+COPY --from=decord2-wheel-builder-py313 /wheels /wheels
diff --git a/packages/nemo_platform/pyproject.toml b/packages/nemo_platform/pyproject.toml
index 34d0d595e3..8d0abfde5a 100644
--- a/packages/nemo_platform/pyproject.toml
+++ b/packages/nemo_platform/pyproject.toml
@@ -305,7 +305,7 @@ nemo-evaluator-sdk = [
 nemo-guardrails-plugin = [
   "nemo-platform-plugin",
   "nemoguardrails[tracing]==0.23.0",
-  "langchain>=1.3.13",
+  "langchain>=1.3.14",
   "langchain-community>=0.3.31,<0.4",
   "langchain-core>=1.4.9",
   "langchain-openai>=1.3.5",
diff --git a/packages/nmp_common/src/nmp/common/sdk_factory.py b/packages/nmp_common/src/nmp/common/sdk_factory.py
index 0a6545397c..37076d3f82 100644
--- a/packages/nmp_common/src/nmp/common/sdk_factory.py
+++ b/packages/nmp_common/src/nmp/common/sdk_factory.py
@@ -186,6 +186,7 @@ def get_platform_sdk(
     internal: bool = False,
     http_client: httpx.Client | None = None,
     on_behalf_of: str | Principal | None = None,
+    base_url: str | None = None,
 ) -> NeMoPlatform:
     """
     Returns an instance of the NeMoPlatform SDK configured with the platform's base URL.
@@ -199,13 +200,14 @@ def get_platform_sdk(
                  Use this for controllers and background tasks that make internal API calls.
         http_client: Optional sync HTTP client to use for requests.
         on_behalf_of: Optional principal ID to use for on-behalf-of authorization.
+        base_url: Optional platform base URL. Defaults to configured platform base URL.
 
     Returns:
         Configured NeMoPlatform SDK instance.
     """
     headers = _get_default_headers(as_service, internal, on_behalf_of)
     sdk = NeMoPlatform(
-        base_url=_base_url_from_config(),
+        base_url=base_url or _base_url_from_config(),
         http_client=http_client or shared_sync_http_client(),
         default_headers=headers if headers else None,
     )
@@ -273,6 +275,7 @@ def get_async_platform_sdk(
     internal: bool = False,
     http_client: Optional[httpx.AsyncClient] = None,
     on_behalf_of: Optional[str | Principal] = None,
+    base_url: str | None = None,
 ) -> AsyncNeMoPlatform:
     """
     Returns an instance of the AsyncNeMoPlatform SDK configured with the platform's base URL.
@@ -287,6 +290,7 @@ def get_async_platform_sdk(
         http_client: Optional HTTP client to use for requests. Used for test injection
                     via DependencyProvider. See architecture/docs/http-client-injection.md.
         on_behalf_of: Optional principal ID to use for on-behalf-of authorization.
+        base_url: Optional platform base URL. Defaults to configured platform base URL.
     Returns:
         Configured AsyncNeMoPlatform SDK instance.
     """
@@ -297,7 +301,7 @@ def get_async_platform_sdk(
     effective_client = http_client or _test_http_client or shared_async_http_client()
 
     sdk = AsyncNeMoPlatform(
-        base_url=_base_url_from_config(),
+        base_url=base_url or _base_url_from_config(),
         http_client=effective_client,
         default_headers=headers if headers else None,
     )
@@ -430,12 +434,14 @@ def get_platform_sdk(
         internal: bool = False,
         http_client: httpx.Client | None = None,
         on_behalf_of: str | Principal | None = None,
+        base_url: str | None = None,
     ) -> NeMoPlatform:
         return get_platform_sdk(
             as_service=as_service,
             internal=internal,
             http_client=http_client,
             on_behalf_of=on_behalf_of,
+            base_url=base_url,
         )
 
     def get_async_platform_sdk(
@@ -444,5 +450,11 @@ def get_async_platform_sdk(
         as_service: str | None = None,
         internal: bool = False,
         on_behalf_of: str | Principal | None = None,
+        base_url: str | None = None,
     ) -> AsyncNeMoPlatform:
-        return get_async_platform_sdk(as_service=as_service, internal=internal, on_behalf_of=on_behalf_of)
+        return get_async_platform_sdk(
+            as_service=as_service,
+            internal=internal,
+            on_behalf_of=on_behalf_of,
+            base_url=base_url,
+        )
diff --git a/plugins/nemo-guardrails/pyproject.toml b/plugins/nemo-guardrails/pyproject.toml
index f6a5bb1d84..101f08a4a5 100644
--- a/plugins/nemo-guardrails/pyproject.toml
+++ b/plugins/nemo-guardrails/pyproject.toml
@@ -6,7 +6,7 @@ dependencies = [
     "nemo-platform-plugin",
     "nemo-platform",
     "nemoguardrails[tracing]==0.23.0",
-    "langchain>=1.3.13",
+    "langchain>=1.3.14",
     "langchain-community>=0.3.31,<0.4",
     "langchain-core>=1.4.9",
     "langchain-openai>=1.3.5",
diff --git a/pyproject.toml b/pyproject.toml
index 566a9d564e..35376616a7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -280,6 +280,7 @@ constraint-dependencies = [
   "litellm>=1.83.10",
   "lxml>=6.1.0",
   "mistune>=3.3.2",
+  "mcp>=1.28.1",
   "msgpack>=1.2.1",
   "nbconvert>=7.17.1",
   "nltk>=3.10.0",
@@ -322,7 +323,7 @@ override-dependencies = [
   "ujson>=5.12.0",           # High – nmp-api/cpu-tasks/gpu-tasks
   "xgrammar>=0.1.32",        # High – customizer + nmp-gpu-tasks
   "fastmcp>=3.2.0",          # GHSA-vv7q-7jx5-f767 (Critical) + GHSA-rww4-4w9c-7733 (High); overrides vendored sdk/python/nemo-platform <3 constraint
-  "wandb>=0.28.0",           # wandb-core Go CVEs (nspect); unsloth + training images
+  "wandb>=0.28.1",           # wandb-core Go CVEs (nspect); unsloth + training images
   "cryptography>=48.0.1,<49", # Pulse Critical; overrides data-designer-engine 0.7.0's <47 cap after changelog review
   "click>=8.2.0",            # Below CVEs are based on constraints that garak has
   "litellm>=1.83.10",        # CVE-2026-42208 (Critical SQL injection), CVE-2026-40217, and 5 other High CVEs
diff --git a/services/core/entities/src/nmp/core/entities/mcp/server.py b/services/core/entities/src/nmp/core/entities/mcp/server.py
index 8fb69367d4..0e31077204 100644
--- a/services/core/entities/src/nmp/core/entities/mcp/server.py
+++ b/services/core/entities/src/nmp/core/entities/mcp/server.py
@@ -36,7 +36,7 @@ def create_server(base_url: str | None = None) -> FastMCP:
     server = FastMCP("NeMo Entities Service")
 
     # Create NeMo SDK client using shared factory
-    nemo_client = get_platform_sdk(base_url)
+    nemo_client = get_platform_sdk(base_url=base_url)
 
     # === WORKSPACE TOOLS ===
 
diff --git a/services/core/mcp/tests/integration/smoke_test.py b/services/core/mcp/tests/integration/smoke_test.py
index e694fc35cb..01ce5299fd 100644
--- a/services/core/mcp/tests/integration/smoke_test.py
+++ b/services/core/mcp/tests/integration/smoke_test.py
@@ -30,7 +30,7 @@ def nmp_base_url() -> str:
 @pytest.fixture(scope="module")
 def nemo_sdk(nmp_base_url: str) -> Generator[NeMoPlatform, None, None]:
     """Create NeMo SDK client for direct API validation."""
-    client = get_platform_sdk(nmp_base_url)
+    client = get_platform_sdk(base_url=nmp_base_url)
     yield client
 
 
diff --git a/third_party/requirements-main.txt b/third_party/requirements-main.txt
index 00d26ee61b..7f3900dff7 100644
--- a/third_party/requirements-main.txt
+++ b/third_party/requirements-main.txt
@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv export --no-dev --output-file third_party/requirements-main.txt
+#    uv export --frozen --no-dev --output-file third_party/requirements-main.txt
 -e .
 -e ./packages/data_designer_nemo ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')
     # via
@@ -947,9 +947,7 @@ gitdb==4.0.12 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p
 gitpython==3.1.50 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
     --hash=sha256:80da2d12504d52e1f998772dc5baf6e553f8d2fcfe1fcc226c9d9a2ee3372dcc \
     --hash=sha256:d352abe2908d07355014abdd21ddf798c2a961469239afec4962e9da884858f9
-    # via
-    #   mlflow-skinny
-    #   wandb
+    # via mlflow-skinny
 google-auth==2.49.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
     --hash=sha256:16d40da1c3c5a0533f57d268fe72e0ebb0ae1cc3b567024122651c045d879b64 \
     --hash=sha256:195ebe3dca18eddd1b3db5edc5189b76c13e96f29e73043b923ebcf3f1a860f7
@@ -1326,9 +1324,9 @@ kubernetes==35.0.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin')
     #   nmp-common
     #   nmp-jobs
     #   nmp-models
-langchain==1.3.13 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
-    --hash=sha256:20a8fe4b1dea7db74356f7d2b5455c4970099b9f7f53c2122ea97f115c907fbd \
-    --hash=sha256:bcf874680f31e9970f0db2264509df5bc2115d9680e9d651d537eb49bf1a7d8a
+langchain==1.3.14 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
+    --hash=sha256:1b6696c72ba3bbbce54d745e0180742c9f6ece8bbc59ed5a46c3e20b9a435929 \
+    --hash=sha256:4d10dbe91005952cddd56d0dc77aa108964da6bae90ab20063653957e901f782
     # via
     #   langchain-community
     #   langchain-oci
@@ -1580,9 +1578,9 @@ marshmallow==3.26.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin')
     --hash=sha256:013fa8a3c4c276c24d26d84ce934dc964e2aa794345a0f8c7e5a7191482c8a73 \
     --hash=sha256:bbe2adb5a03e6e3571b573f42527c6fe926e17467833660bebd11593ab8dfd57
     # via dataclasses-json
-mcp==1.26.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
-    --hash=sha256:904a21c33c25aa98ddbeb47273033c435e595bbacfdb177f4bd87f6dceebe1ca \
-    --hash=sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66
+mcp==1.28.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
+    --hash=sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df \
+    --hash=sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683
     # via
     #   data-designer-engine
     #   fastmcp
@@ -3440,13 +3438,13 @@ validators==0.35.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin')
     --hash=sha256:992d6c48a4e77c81f1b4daba10d16c3a9bb0dbb79b3a19ea847ff0928e70497a \
     --hash=sha256:e8c947097eae7892cb3d26868d637f79f47b4a0554bc6b80065dfe5aac3705dd
     # via ngcsdk
-wandb==0.28.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
-    --hash=sha256:325b2d0bd88be6eda5db10542499bad3710927f2569c81a84dc5eeaffc76825c \
-    --hash=sha256:6dbcba12ab168aa37561f2f32dcdef8713495fc25fa7d30fdc9bfb37989694dd \
-    --hash=sha256:8954bc1c62ae43914dce2bebfd1d9957f72350f8fbb78e5cdfe2ca9b6be8a7b8 \
-    --hash=sha256:9fec6c908554c2dad33110c1312bc3028cc2e430f0679f16b84f82c8ea801e3b \
-    --hash=sha256:b20e5af0fe80e2e2a466b0466a1d60cedcc578dce0f036eca04f4a0adcad95b6 \
-    --hash=sha256:c3dab1205a5aca4abbad1eca08902cdba86add0edfa83d8d61b4429d0e79fa87
+wandb==0.28.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
+    --hash=sha256:7233061080507a4b4098bed1ccb381ce6f890c60397cd4153d060285bcb267bd \
+    --hash=sha256:870ccb1a01238b0ac07c6fd96a0810a1f79090aba04ea29f4ee012ac8327705d \
+    --hash=sha256:8cfb898b6a6c884d9c9294b02764e88bce65049f027a124d6bee53fe722469b6 \
+    --hash=sha256:ae9ae6fb29e2e2b1d097ed8b75c0c0240c778c2a8cad1d996dee870a1e401c2c \
+    --hash=sha256:cf2b1533945395e4fdbe6182b272bb0ca8a02c10b3086a395e2d57686ae3ed0d \
+    --hash=sha256:da909a76e65c64c0d93acc485d2a19f66e336f1e3f725f1c98a070883e084943
     # via nmp-unsloth
 wasmtime==43.0.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \
     --hash=sha256:30b042fd4a05d0f8a320baed53fcb971aff8a3789ed6967f4521f87931ace717 \
diff --git a/uv.lock b/uv.lock
index d5573d5719..52305122e1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -94,6 +94,7 @@ constraints = [
     { name = "litellm", specifier = ">=1.83.10" },
     { name = "lxml", specifier = ">=6.1.0" },
     { name = "mako", specifier = ">=1.3.12" },
+    { name = "mcp", specifier = ">=1.28.1" },
     { name = "mistune", specifier = ">=3.3.2" },
     { name = "msgpack", specifier = ">=1.2.1" },
     { name = "nbconvert", specifier = ">=7.17.1" },
@@ -138,7 +139,7 @@ overrides = [
     { name = "simpleeval", specifier = ">=1.0.5" },
     { name = "ujson", specifier = ">=5.12.0" },
     { name = "urllib3", specifier = ">=2.7.0" },
-    { name = "wandb", specifier = ">=0.28.0" },
+    { name = "wandb", specifier = ">=0.28.1" },
     { name = "wheel", specifier = ">=0.46.2" },
     { name = "xgrammar", specifier = ">=0.1.32" },
 ]
@@ -2781,16 +2782,16 @@ wheels = [
 
 [[package]]
 name = "langchain"
-version = "1.3.13"
+version = "1.3.14"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "langchain-core", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "langgraph", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "pydantic", extra = ["email"], marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/29/33/fd716d0273c8495482953bd63461bf02f71f3a8f4a2fe6c0a70a0e6ff799/langchain-1.3.13.tar.gz", hash = "sha256:bcf874680f31e9970f0db2264509df5bc2115d9680e9d651d537eb49bf1a7d8a", size = 642868, upload-time = "2026-07-10T23:06:08.555Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/29/68/a6dbad9c22df4087a0f9e79ddd46226c442b30128bfeee538d5889492a73/langchain-1.3.14.tar.gz", hash = "sha256:1b6696c72ba3bbbce54d745e0180742c9f6ece8bbc59ed5a46c3e20b9a435929", size = 645181, upload-time = "2026-07-16T13:28:18.29Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/95/c6/dc676c632f3d20c88789b0726c43ad5e039c25338cc3bb7090fc247d1522/langchain-1.3.13-py3-none-any.whl", hash = "sha256:20a8fe4b1dea7db74356f7d2b5455c4970099b9f7f53c2122ea97f115c907fbd", size = 136911, upload-time = "2026-07-10T23:06:07.012Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/ec/0f942e78a621f8e3162ff1ed24284f469aaf51fb4607ee5831c626f2b2bc/langchain-1.3.14-py3-none-any.whl", hash = "sha256:4d10dbe91005952cddd56d0dc77aa108964da6bae90ab20063653957e901f782", size = 139560, upload-time = "2026-07-16T13:28:16.498Z" },
 ]
 
 [[package]]
@@ -3344,7 +3345,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.26.0"
+version = "1.28.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
@@ -3361,9 +3362,9 @@ dependencies = [
     { name = "typing-inspection", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "uvicorn", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fd/d9/eaa1f80170d2b7c5ba23f3b59f766f3a0bb41155fbc32a69adfa1adaaef9/mcp-1.26.0-py3-none-any.whl", hash = "sha256:904a21c33c25aa98ddbeb47273033c435e595bbacfdb177f4bd87f6dceebe1ca", size = 233615, upload-time = "2026-01-24T19:40:30.652Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218Z" },
 ]
 
 [[package]]
@@ -4318,7 +4319,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "httpx", marker = "extra == 'bench'", specifier = ">=0.27" },
-    { name = "langchain", specifier = ">=1.3.13" },
+    { name = "langchain", specifier = ">=1.3.14" },
     { name = "langchain-community", specifier = ">=0.3.31,<0.4" },
     { name = "langchain-core", specifier = ">=1.4.9" },
     { name = "langchain-openai", specifier = ">=1.3.5" },
@@ -5143,10 +5144,10 @@ requires-dist = [
     { name = "kubernetes", marker = "extra == 'nmp-common'", specifier = ">=30.1.0" },
     { name = "kubernetes", marker = "extra == 'services'", specifier = ">=30.1.0" },
     { name = "kubernetes", marker = "extra == 'services'", specifier = ">=31.0.0" },
-    { name = "langchain", marker = "extra == 'all'", specifier = ">=1.3.13" },
-    { name = "langchain", marker = "extra == 'nemo-guardrails-plugin'", specifier = ">=1.3.13" },
-    { name = "langchain", marker = "extra == 'plugins'", specifier = ">=1.3.13" },
-    { name = "langchain", marker = "extra == 'services'", specifier = ">=1.3.13" },
+    { name = "langchain", marker = "extra == 'all'", specifier = ">=1.3.14" },
+    { name = "langchain", marker = "extra == 'nemo-guardrails-plugin'", specifier = ">=1.3.14" },
+    { name = "langchain", marker = "extra == 'plugins'", specifier = ">=1.3.14" },
+    { name = "langchain", marker = "extra == 'services'", specifier = ">=1.3.14" },
     { name = "langchain-aws", marker = "extra == 'all'", specifier = "==1.1.0" },
     { name = "langchain-aws", marker = "extra == 'nemo-agents-plugin'", specifier = "==1.1.0" },
     { name = "langchain-aws", marker = "extra == 'plugins'", specifier = "==1.1.0" },
@@ -11305,11 +11306,10 @@ wheels = [
 
 [[package]]
 name = "wandb"
-version = "0.28.0"
+version = "0.28.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
-    { name = "gitpython", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "packaging", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "platformdirs", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "protobuf", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
@@ -11319,13 +11319,13 @@ dependencies = [
     { name = "sentry-sdk", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
     { name = "typing-extensions", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5f/a7/683bfbd6cbade3012bc90d3e9c4cfc72dd62566195bf4c30321946d64b77/wandb-0.28.0.tar.gz", hash = "sha256:b20e5af0fe80e2e2a466b0466a1d60cedcc578dce0f036eca04f4a0adcad95b6", size = 40558332, upload-time = "2026-06-23T00:38:50.115Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/92/fb/8d3f96a8b143060d6fa145462d0785981373e04694e4152555ccb5d23939/wandb-0.28.1.tar.gz", hash = "sha256:870ccb1a01238b0ac07c6fd96a0810a1f79090aba04ea29f4ee012ac8327705d", size = 40578119, upload-time = "2026-07-16T18:47:05.413Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c0/47/1723605f76c5d6446b6d0db65b83eda1599721bc8c1e65bd76cc1682b1a7/wandb-0.28.0-py3-none-macosx_12_0_arm64.whl", hash = "sha256:c3dab1205a5aca4abbad1eca08902cdba86add0edfa83d8d61b4429d0e79fa87", size = 24335272, upload-time = "2026-06-23T00:38:26.002Z" },
-    { url = "https://files.pythonhosted.org/packages/15/55/c3db03d04aeab3726066a418b2ef6a1f8119774ee510f4fbe992f52b7472/wandb-0.28.0-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:6dbcba12ab168aa37561f2f32dcdef8713495fc25fa7d30fdc9bfb37989694dd", size = 24878557, upload-time = "2026-06-23T00:38:31.417Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/5d/1385ce3c219cb5bd30d4027687e3f8d25969c7dfd09adad1cbd5080e1a72/wandb-0.28.0-py3-none-manylinux_2_28_x86_64.whl", hash = "sha256:325b2d0bd88be6eda5db10542499bad3710927f2569c81a84dc5eeaffc76825c", size = 26764727, upload-time = "2026-06-23T00:38:33.775Z" },
-    { url = "https://files.pythonhosted.org/packages/00/58/23b6c17a6d3d5422b007707961c4496b2f6f892624d2910c9f7742fcc202/wandb-0.28.0-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:8954bc1c62ae43914dce2bebfd1d9957f72350f8fbb78e5cdfe2ca9b6be8a7b8", size = 25051656, upload-time = "2026-06-23T00:38:36.281Z" },
-    { url = "https://files.pythonhosted.org/packages/89/67/9be00fb2db2281063af24a148636d2dd363d337317642ab5d8e93572c794/wandb-0.28.0-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:9fec6c908554c2dad33110c1312bc3028cc2e430f0679f16b84f82c8ea801e3b", size = 27074113, upload-time = "2026-06-23T00:38:38.737Z" },
+    { url = "https://files.pythonhosted.org/packages/06/21/8df50164d07623cfcefec19bbf9327d9be84b637a827cea1f0c06db005fd/wandb-0.28.1-py3-none-macosx_12_0_arm64.whl", hash = "sha256:da909a76e65c64c0d93acc485d2a19f66e336f1e3f725f1c98a070883e084943", size = 24277925, upload-time = "2026-07-16T18:46:42.383Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/1a/d15bcfb4417fa69edcaa33db8ea012db733da1057e193b047e3f69fdd671/wandb-0.28.1-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:ae9ae6fb29e2e2b1d097ed8b75c0c0240c778c2a8cad1d996dee870a1e401c2c", size = 24832138, upload-time = "2026-07-16T18:46:47.433Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/da/49924c7df2952dfd82c86c3779c339c0c3d6f6439387c03d97d0470c3658/wandb-0.28.1-py3-none-manylinux_2_28_x86_64.whl", hash = "sha256:8cfb898b6a6c884d9c9294b02764e88bce65049f027a124d6bee53fe722469b6", size = 26486533, upload-time = "2026-07-16T18:46:49.839Z" },
+    { url = "https://files.pythonhosted.org/packages/11/c0/06b23518e29690784f1b3081e39c7679ca076cb0af094cb9b4bb309150f5/wandb-0.28.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:cf2b1533945395e4fdbe6182b272bb0ca8a02c10b3086a395e2d57686ae3ed0d", size = 25022635, upload-time = "2026-07-16T18:46:52.376Z" },
+    { url = "https://files.pythonhosted.org/packages/23/30/6de2f7995a8a6eecbd03d24c79a139a734c0168f5520cf4c7ccb43c1dbbc/wandb-0.28.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:7233061080507a4b4098bed1ccb381ce6f890c60397cd4153d060285bcb267bd", size = 27008895, upload-time = "2026-07-16T18:46:55.025Z" },
 ]
 
 [[package]]