diff --git a/pyproject.toml b/pyproject.toml
index dc7dab5a..2abaaaba 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -85,7 +85,7 @@ vector = [
 mcp = [
     # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly
     # recommends the <2 cap because stable v2 is a breaking line.
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "starlette>=1.3.1,<2; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
@@ -140,7 +140,7 @@ all = [
     "python-dotenv>=1.0",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "sentence-transformers>=2.7; python_version >= '3.10'",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=50.0.0; python_version >= '3.10'",
     "tree-sitter>=0.23; python_version >= '3.10'",
@@ -183,7 +183,7 @@ test = [
     # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI.
     # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys.
     "sqlite-vec>=0.1.9,<0.2",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.28.1,<3; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=50.0.0; python_version >= '3.10'",
     "tree-sitter>=0.23; python_version >= '3.10'",
diff --git a/requirements.txt b/requirements.txt
index 87a500e5..a7abc14e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,7 +15,7 @@ numpy>=1.24
 pydantic>=2.0
 python-dotenv>=1.0
 sentence-transformers>=2.7; python_version >= '3.10'
-mcp>=1.28.1,<2; python_version >= '3.10'
+mcp>=1.28.1,<3; python_version >= '3.10'
 pydantic-settings>=2.14.2; python_version >= '3.10'
 cryptography>=50.0.0; python_version >= '3.10'
 pypdf>=6.15.0