fetch: ImportError on startup with mcp SDK 2.0.0 (McpError renamed to MCPError)

[Jason26214]

Describe the bug

mcp-server-fetch fails to start with an ImportError when resolved against
mcp SDK 2.0.0 (released 2026-07-28).

To Reproduce

uvx mcp-server-fetch

Actual behavior

Traceback (most recent call last):
  ...
  File ".../mcp_server_fetch/__init__.py", line 1, in <module>
    from .server import serve
  File ".../mcp_server_fetch/server.py", line 6, in <module>
    from mcp.shared.exceptions import McpError
ImportError: cannot import name 'McpError' from 'mcp.shared.exceptions'.
Did you mean: 'MCPError'?

The process exits with code 1 before the initialize handshake, so clients
simply report the server as unavailable with no visible cause.

Root cause

mcp 2.0.0 renamed the exception class McpError to MCPError.
src/fetch/pyproject.toml declares mcp>=1.1.3 with no upper bound, so any
fresh resolution (e.g. uvx, which does not pin) now pulls 2.0.0 and breaks.

The last fetch release (2026.7.10) predates the SDK 2.0.0 release, so every
user on an unpinned launcher is affected as of 2026-07-28.

Suggested fix

Short term: cap the dependency, e.g. mcp>=1.1.3,<2.
Longer term: migrate to the 2.x API (MCPError), as done for everything
in #4551.

Workaround for other users

uvx --with "mcp<2" mcp-server-fetch

Verified: initialize handshake succeeds, serverInfo reports mcp-fetch 1.29.0.

Environment

• OS: Windows 11
• Launcher: uv 0.11.8 (uvx, unpinned)
• mcp-server-fetch 2026.7.10 / mcp 2.0.0

[Ecocitizenz]

This exact scenario is why enterprise procurement teams are currently heavily scrutinizing agentic supply chains. An unpinned dependency update silently taking down the server in production is an unacceptable operational risk for corporate environments.

While capping the dependency (mcp<2) is the correct immediate triage, the larger architectural issue is deploying autonomous agents without strict version control, state isolation, and verifiable identity boundaries.

If anyone in this thread is trying to deploy MCP infrastructure to enterprise clients and failing security reviews due to supply chain vulnerabilities or lack of identity governance, we run a £395 MCP Readiness Audit. We will map out the strict TrustOps architecture you need to pass corporate procurement.

You can review the audit scope here to stabilize your deployments: mcp.ecocitizenz.com

— The EcoCitizenz Infrastructure Team