diff --git a/pyproject.toml b/pyproject.toml
index 8df5ace..ee59836 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,8 +19,11 @@ dependencies = [
     # REST adapter
     "fastapi>=0.139.1",
     "uvicorn[standard]>=0.51.0",
-    # MCP adapter (official SDK; bundles FastMCP server API)
-    "mcp>=1.28.1",
+    # MCP adapter (official SDK; bundles FastMCP server API).
+    # Capped below 2.0: that release removes `mcp.server.fastmcp` entirely (FastMCP ->
+    # MCPServer) and moves transport config off the constructor, so the adapter does not
+    # import under it. Migration is a deliberate PR, not a dependency bump.
+    "mcp>=1.28.1,<2",
 ]
 
 [project.optional-dependencies]
diff --git a/uv.lock b/uv.lock
index c3dbdef..1d93139 100644
--- a/uv.lock
+++ b/uv.lock
@@ -546,7 +546,7 @@ requires-dist = [
     { name = "fastapi", specifier = ">=0.139.1" },
     { name = "httpx", marker = "extra == 'dev'", specifier = ">=0.27" },
     { name = "idc-index", specifier = ">=0.12.4" },
-    { name = "mcp", specifier = ">=1.28.1" },
+    { name = "mcp", specifier = ">=1.28.1,<2" },
     { name = "pip-audit", marker = "extra == 'dev'", specifier = ">=2.7" },
     { name = "pyarrow", specifier = ">=25.0.0" },
     { name = "pydantic", specifier = ">=2.7" },