fix(VULN-103416): bump mcp to >=1.27.2 for task isolation CVE

[shuningc]

Summary

• Fixes VULN-103416: MCP Python SDK versions 1.23.0–1.27.1 have broken cross-client task isolation when server.experimental.enable_tasks() is used on MCP servers.
• Adds a direct mcp >= 1.27.2, < 2 floor in pyproject.toml and refreshes poetry.lock so transitive usage (via crewai, openai-agents, litellm extras) resolves to mcp 1.29.0.
• Pins the log-mcp-calls example requirements to the same minimum.

Risk assessment

• Runtime exploitability: low — this repo does not call enable_tasks(); MCP usage is client-side only in the logging example.
• FOSSA/compliance: required — lock previously had mcp==1.27.0 (affected range).

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: needs_discussion — The version floor correctly remediates the CVE, but it is added as a mandatory core dependency, which contradicts the PR's stated scope and expands the base install footprint — worth confirming intent.

[fercor-cisco]

this should not be a mandatory dependency of the SDK

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: needs_discussion — Lock is floored to a safe mcp (FOSSA goal met), but mcp is an orphaned optional dependency (in no extra), so the floor won't propagate to published extras and Poetry will warn — confirm intended scope.

[fercor-cisco]

🟠 major (design): mcp is declared optional = true but is not referenced by any entry in [project.optional-dependencies] (openai, crewai, all, middleware, langchain — none list mcp). This makes it an orphaned optional dependency, which has two consequences:

1. The floor does not reach SDK consumers. Poetry excludes optional deps that aren't part of any extra from the built distribution's Requires-Dist metadata. So pip install splunk-ao[openai] (or [crewai]/[all]) from a published wheel will resolve mcp purely under the transitive constraints of openai-agents/crewai/litellm, which permit the vulnerable 1.23.0–1.27.1 range. Only this repo's pinned poetry.lock is protected — which does satisfy FOSSA for the ticket, but the fix does not protect downstream installs.
2. Poetry warns on an optional dependency that belongs to no extra (poetry check flags "declared as optional but not in any extra").

This is exactly what the earlier review comment asked for: keep it optional and add mcp>=1.27.2,<2 to the openai, crewai, and all extras so the floor is exported to the package metadata. If protecting only this repo's lock is the intended scope, please confirm in the PR description; otherwise add it to the extras.

Suggested change

	mcp = { version = ">=1.27.2,<2", optional = true }
	mcp = { version = ">=1.27.2,<2", optional = true }
	# and add "mcp>=1.27.2,<2" to the openai, crewai, and all entries in
	# [project.optional-dependencies] so the floor is exported to package metadata

🤖 Generated by the Astra agent

[shuningc]

updated

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-5). It may contain mistakes.

Verdict: approve — The CVE floor is correctly declared as an optional dep and wired into the openai/crewai/all extras so it reaches published metadata; lock resolves mcp to 1.29.0 (> fixed 1.27.2). Only a minor packaging wart remains.

Follow-ups

Suggested follow-up work that could be tracked as Jira tickets:

• pyproject.toml:63-63: This PR is the second CVE-driven floor added directly to [tool.poetry.dependencies] purely to constrain a transitive dep (alongside filelock, idna, requests on lines 60-62). None of these carry a comment explaining why they exist, so a future cleanup could plausibly remove them as "unused direct deps" and silently reopen the vulnerability. Consider adding a short # VULN-xxxxx: floor for CVE-yyyy comment convention to each such pin, or grouping them under a clearly-labelled section.
• poetry.lock:6564-6567: CI (.github/workflows/ci-tests.yaml) runs poetry install --all-extras --no-root but never poetry check --lock. Since security floors like this one are only enforced end-to-end when pyproject.toml and poetry.lock agree, a drifted lock (stale content-hash) would not fail the build. Adding a poetry check --lock step would catch that class of regression cheaply.

[fercor-cisco]

🟡 minor (design): The mcp entry in the crewai extra is unconditional, while its two siblings in the same list (crewai, litellm) are both gated ; python_version < '3.14'.

Consequence: on Python 3.14, pip install splunk-ao[crewai] installs neither crewai nor litellm — so nothing in the resulting environment consumes MCP — yet it now pulls in mcp plus its full subtree (cryptography, uvicorn, starlette, sse-starlette, python-multipart, pyjwt[crypto], jsonschema, referencing, rpds-py). That includes a compiled crypto package and an ASGI server stack for an extra that is otherwise empty on 3.14. poetry.lock confirms this is the resolved behavior — the mcp marker contains a bare extra == "crewai" disjunct with no python_version guard (poetry.lock:2402).

Since MCP only reaches this extra transitively via crewai/litellm, the floor should carry the same Python gate so it applies exactly where the consuming package is installed.

Note this only applies to the crewai extra — leave openai and all unconditional, since openai-agents requires mcp>=1.19.0,<2 on all supported Pythons (poetry.lock:2980) and so genuinely needs the floor raised on 3.14 too. Likewise, do not add a python marker to the [tool.poetry.dependencies] entry on line 63, for the same reason.

Requires a poetry lock regen after the change.

Suggested change

	crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2)"]
	crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "mcp (>=1.27.2,<2); python_version < '3.14'"]

🤖 Generated by the Astra agent

[fercor-cisco]

Technically true but minor, ok to ship as is.