diff --git a/authplane-mcp/pyproject.toml b/authplane-mcp/pyproject.toml
index 51b0e35..c955dd4 100644
--- a/authplane-mcp/pyproject.toml
+++ b/authplane-mcp/pyproject.toml
@@ -36,7 +36,7 @@ dependencies = [
     # resolver in url_elicitation.py makes the spelling moot either way.) The upper
     # bound excludes mcp 2.0, which removes `mcp.server.fastmcp` and renames the
     # field to snake_case `elicitation_id`; supporting it is a separate port.
-    "mcp>=1.28.1,<2",
+    "mcp>=1.28.1,<3",
     "pydantic>=2.0",
 ]
 
@@ -54,7 +54,7 @@ dev = [
     "respx>=0.21",
     "cryptography>=42",
     "coverage>=7",
-    "ruff>=0.16,<0.17",
+    "ruff>=0.16,<0.18",
 ]
 
 [tool.pytest.ini_options]