[td-oai]

Summary

Raise the MCP minimum from 1.19.0 to 1.21.2 while retaining pydantic>=2.12.2,<3. MCP 1.21.1 removed the private Pydantic helper import that breaks with Pydantic 2.14; 1.21.2 also fixes its OAuth 401 scope-handling regression (upstream fix).

The existing packaged compatibility tests now run against exactly MCP 1.21.2 alongside 1.29.0. A comment beside the minimum explains the version choice. No new tests are needed; the existing stdio, SSE, and Streamable HTTP checks remain unchanged. The lockfile updates only the declared minimum, preserving all locked versions and artifacts.

Users pinning MCP below 1.21.2 must upgrade. Update the dependency-range guidance in docs/mcp.md when a release ships this minimum.

Test plan

• Reviewed the final diff: three files, four additions and three deletions; no runtime changes.
• The modified runner passes Python syntax validation. Dependency metadata is unchanged from the previously reviewed 1.21.2 head.
• Final-head hosted CI is pending.
• The previous checkout is no longer mounted, so the full local verification stack and formal review packet/ledger workflow could not be rerun. Codex code/security reviews were clean on the preceding ecbf68c head; those results are not credited to the new head.

Checks

• I've added new tests, if relevant (existing compatibility tests cover the bumped minimum)
• I've run .agents/skills/code-change-verification/scripts/run.sh on the final head
• I've confirmed all verification steps pass
• If using Codex, I've run /review before submitting this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T16:47:14.000781Z	f22eb55	New commits
🔒 Security Review	✅ Completed 2026-10-19T16:48:19.533757Z	f22eb55	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 12a92b0900

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jbeckwith-oai]

Reviewed f22eb55. No actionable findings. The package and lock metadata consistently raise the MCP floor to 1.21.2, and packaged compatibility coverage pins that exact minimum without a test-only Pydantic cap. This addresses the earlier dependency-contract finding while including the upstream OAuth 401 hotfix. Independent static review agreed.

Hosted MCP compatibility, packaging, lint, type checking, docs, and CodeQL checks passed. Python 3.14 and Windows test jobs are still running. Source review only; I did not execute candidate code or local tests. The documented release-time docs/mcp.md range update remains a release follow-up.

[markstuart-oai]

Reviewed f22eb55. No blocking findings.

The package metadata, lock metadata, and exact-minimum compatibility test consistently require MCP 1.21.2. This includes the upstream Pydantic import correction and OAuth 401 scope fix. The change preserves the Pydantic range and all resolved lockfile packages and artifacts.

Source review with an independent review. All 25 observed hosted checks are successful or skipped, including MCP compatibility and Windows tests. I did not execute candidate code or tests locally. The existing HTTP transport tests use mocks; they do not demonstrate a live OAuth flow.