chore(deps): bump mcp from 1.26.0 to 1.28.1 in /envs/qed_math_env

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only minor version bump with no code changes; low impact unless upstream MCP SDK breaks compatibility with fastmcp.

Overview
Bumps the mcp Python package in envs/qed_math_env/uv.lock from 1.26.0 to 1.28.1 (sdist and wheel URLs/hashes updated). No application or config source changes—only the lockfile.

mcp is pulled in transitively (e.g. via fastmcp) for the QED math env MCP tooling; this is a routine dependency refresh.

^{Reviewed by Cursor Bugbot for commit e77e6ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Automated two-tier review of this Dependabot bump of mcp 1.26.0 → 1.28.1 in envs/qed_math_env.

Automated Checks

• Lint: PASS (for this PR). bash .claude/hooks/lint.sh exits 1, but every flagged file is a pre-existing envs/ reformat candidate (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env×8, repl_env, terminus_env, textarena_env) — none is qed_math_env. The only changed file here is a lockfile, and ruff/usort only touch .py.
• Debug code: CLEAN. check-debug.sh reports only pre-existing src/ prints/TODOs; 0 hits in qed_math_env and nothing in this diff.

Open RFCs Context

RFCs 000/001/002/003/005 are In Review, 010 is Draft, 004 has no status header. None governs Python packaging, dependency pins, or the PyPI index. RFC 003 "MCP Support" (In Review; @Darktex, @pankit-eng) governs the MCP protocol/interface design, not the mcp library version — topically adjacent, no conflict.

Tier 1: Fixes Required

None. This is a born-clean, single-package transitive bump. The lockfile is internally consistent (uv lock --check --project envs/qed_math_env passes, 143 resolved), sdist/wheel hashes match PyPI, and no type/import/syntax/security issues are introduced.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. Unlike the full-flip sibling mcp PRs (snake_env #974, carla_env #975), this lock is born-clean: source is already https://pypi.org/simple at both base and head (0 HF-mirror refs), and revision = 3 is unchanged. So there is no index-source flip and no revision bump here → the usual reproducibility flag does not apply.

ALIGNMENT FLAG (process, non-blocking): native dependabot/uv/envs/... PR bypasses the configured exclude-paths

• Principle/RFC at stake: Not a PRINCIPLES/INVARIANTS item — a .github/dependabot.yml config expectation.
• The concern: the uv updater is scoped directory: "/" with exclude-paths: ["envs/**"] (added by @burtenshaw in #566), yet this native PR modifies envs/qed_math_env/uv.lock. The uv ecosystem doesn't appear to honor exclude-paths; the intended path for env-lock bumps is the aggregate codex/dependabot-envs-* roll-ups. Recurring tooling mismatch, not a problem with this bump.
• Suggested reviewer: @burtenshaw

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 1 alignment point for human review (non-blocking Dependabot config/process note)
• 0 RFC conflicts

Positive notes: security-motivated bump — base mcp 1.26.0 carries two advisories (GHSA-hvrp-rf83-w775 / CVE-2026-52870 and GHSA-jpw9-pfvf-9f58 / CVE-2026-52869, both fixed in 1.27.2); 1.28.1 clears both and reports 0 known vulnerabilities. mcp is transitive (via openenv-core[core] → fastmcp), so the lock-only change with no pyproject.toml edit is correct. Verified: package set 142→142 (only mcp changed, 0 add/remove), hashes match PyPI, not yanked, requires-python >=3.10 satisfied, uv lock --check passes.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

mcp 1.26.0 → 1.28.1. Transitive dep (via openenv-core[core] → fastmcp); envs/qed_math_env/pyproject.toml has no mcp pin, so a lock-only change with no pyproject.toml edit is correct.

Security-positive: base 1.26.0 has two advisories — GHSA-hvrp-rf83-w775 (CVE-2026-52870, experimental-tasks cross-client access) and GHSA-jpw9-pfvf-9f58 (CVE-2026-52869, SSE/Streamable-HTTP session-id-only auth) — both fixed_in 1.27.2; 1.28.1 clears both (0 known vulns). The mcp dependency block below (lines 1693–1708) is unchanged, and uv lock --check passes.

[cursor]

sdist/wheel hashes verified against PyPI: sdist sha256:d51e36a5… (638501 B) and wheel sha256:2726bca5… (222620 B) match mcp 1.28.1; not yanked; requires-python >=3.10 satisfied by the env.

This lock is born-clean — source is already pypi.org/simple and revision = 3 at both base and head, so there's no index-source flip or revision bump here (unlike the full-flip sibling PRs #974/#975). Package set stays 142→142 with only mcp changed.

[burtenshaw]

Aggregated into #921.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.