Pin standalone MCP clients to v1

[xeophon]

Overview

Keep independently resolved MCP clients on the 1.x API until their MCP 2 migration.

Details

The bash, null, and compact uv scripts now use the same MCP 1.x range as the framework package. These PEP 723 environments resolve independently of the repository lock, so the constraint travels with each script.

The RLM harness passes a compatible MCP 1.x requirement through RLM's existing installer hook while preserving caller-supplied install extras. This keeps RLM's current streamable HTTP import contract available in its isolated tool environment.

---

Note

Low Risk
Dependency version constraints only; no runtime or auth logic changes.

Overview
Pins MCP to the 1.x line everywhere harness code resolves its own Python environment, so installs cannot silently pick up MCP 2 before those paths are migrated.

The compact, bash, and null uv script headers now declare mcp>=1.24.0,<2 instead of an unpinned mcp. Those PEP 723 blocks resolve independently of the repo lock, so the constraint has to live on each script.

The RLM harness appends --with mcp~=1.28 to RLM_EXTRA_UV_ARGS during rlm install, preserving any caller-supplied extras so RLM’s isolated tool env still gets a compatible 1.x client for streamable HTTP.

^{Reviewed by Cursor Bugbot for commit 1a48304. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Pin standalone MCP clients to mcp>=1.24.0,<2

• Constrains the mcp dependency from unpinned to >=1.24.0,<2 in the script headers for compact/program.py, bash/program.py, and null/program.py.
• Appends --with mcp~=1.28 to RLM_EXTRA_UV_ARGS in RLMHarness.setup so the RLM install step also picks up a compatible version.

^{Macroscope summarized 1a48304.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR makes mechanical dependency version pinning changes to constrain mcp to v1.x across multiple files. The changes are self-contained, low risk, and don't alter runtime behavior beyond preventing potential breaking changes from MCP v2.

^{You can customize Macroscope's approvability policy. Learn more.}