From 7ba4fb881d85406f44a5af8169fb7200fa7c8e49 Mon Sep 17 00:00:00 2001
From: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Date: Tue, 24 Mar 2026 20:36:36 +0000
Subject: [PATCH 1/4] ci: skip claude.yml when comment is '@claude review'
 (#2337)

---
 .github/workflows/claude.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 8421cf954..59dac99dc 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   claude:
     if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && !startsWith(github.event.comment.body, '@claude review')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

From 98f8ef295a6a4178ebeb75fd2e9f346be5c9eb0e Mon Sep 17 00:00:00 2001
From: Marcelo Trylesinski <marcelotryle@gmail.com>
Date: Wed, 25 Mar 2026 23:29:13 +0100
Subject: [PATCH 2/4] Restrict httpx version to <1.0.0 (#2345)

Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
---
 pyproject.toml | 2 +-
 uv.lock        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 624ade170..e1b19e3c9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,7 +26,7 @@ classifiers = [
 ]
 dependencies = [
     "anyio>=4.9",
-    "httpx>=0.27.1",
+    "httpx>=0.27.1,<1.0.0",
     "httpx-sse>=0.4",
     "pydantic>=2.12.0",
     "starlette>=0.48.0; python_version >= '3.14'",
diff --git a/uv.lock b/uv.lock
index 4af3532ea..8f9a5396a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -850,7 +850,7 @@ docs = [
 [package.metadata]
 requires-dist = [
     { name = "anyio", specifier = ">=4.9" },
-    { name = "httpx", specifier = ">=0.27.1" },
+    { name = "httpx", specifier = ">=0.27.1,<1.0.0" },
     { name = "httpx-sse", specifier = ">=0.4" },
     { name = "jsonschema", specifier = ">=4.20.0" },
     { name = "pydantic", specifier = ">=2.12.0" },

From 3517a29c828d596f0e3fb5f82fcfc86fd7a14dd0 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 27 Mar 2026 13:42:15 +0000
Subject: [PATCH 3/4] feat(server): restore `dependencies` parameter on
 MCPServer (#2358)

---
 src/mcp/server/mcpserver/server.py    | 6 ++++++
 tests/server/mcpserver/test_server.py | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/mcp/server/mcpserver/server.py b/src/mcp/server/mcpserver/server.py
index 2a7a58117..6f9bb0e28 100644
--- a/src/mcp/server/mcpserver/server.py
+++ b/src/mcp/server/mcpserver/server.py
@@ -105,6 +105,9 @@ class Settings(BaseSettings, Generic[LifespanResultT]):
     # prompt settings
     warn_on_duplicate_prompts: bool
 
+    dependencies: list[str]
+    """List of dependencies to install in the server environment. Used by the `mcp install` and `mcp dev` CLI."""
+
     lifespan: Callable[[MCPServer[LifespanResultT]], AbstractAsyncContextManager[LifespanResultT]] | None
     """An async context manager that will be called when the server is started."""
 
@@ -142,6 +145,7 @@ def __init__(
         warn_on_duplicate_resources: bool = True,
         warn_on_duplicate_tools: bool = True,
         warn_on_duplicate_prompts: bool = True,
+        dependencies: list[str] | None = None,
         lifespan: Callable[[MCPServer[LifespanResultT]], AbstractAsyncContextManager[LifespanResultT]] | None = None,
         auth: AuthSettings | None = None,
     ):
@@ -151,9 +155,11 @@ def __init__(
             warn_on_duplicate_resources=warn_on_duplicate_resources,
             warn_on_duplicate_tools=warn_on_duplicate_tools,
             warn_on_duplicate_prompts=warn_on_duplicate_prompts,
+            dependencies=dependencies or [],
             lifespan=lifespan,
             auth=auth,
         )
+        self.dependencies = self.settings.dependencies
 
         self._tool_manager = ToolManager(tools=tools, warn_on_duplicate_tools=self.settings.warn_on_duplicate_tools)
         self._resource_manager = ResourceManager(warn_on_duplicate_resources=self.settings.warn_on_duplicate_resources)
diff --git a/tests/server/mcpserver/test_server.py b/tests/server/mcpserver/test_server.py
index 3ef06d038..49b6deb4b 100644
--- a/tests/server/mcpserver/test_server.py
+++ b/tests/server/mcpserver/test_server.py
@@ -65,6 +65,15 @@ async def test_create_server(self):
         assert len(mcp.icons) == 1
         assert mcp.icons[0].src == "https://example.com/icon.png"
 
+    def test_dependencies(self):
+        """Dependencies list is read by `mcp install` / `mcp dev` CLI commands."""
+        mcp = MCPServer("test", dependencies=["pandas", "numpy"])
+        assert mcp.dependencies == ["pandas", "numpy"]
+        assert mcp.settings.dependencies == ["pandas", "numpy"]
+
+        mcp_no_deps = MCPServer("test")
+        assert mcp_no_deps.dependencies == []
+
     async def test_sse_app_returns_starlette_app(self):
         """Test that sse_app returns a Starlette application with correct routes."""
         mcp = MCPServer("test")

From fb2276b95fb5ac6631f9c160c9b1bd7a6d7312a9 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 27 Mar 2026 14:02:41 +0000
Subject: [PATCH 4/4] ci: remove claude-code-review workflow (#2359)

---
 .github/workflows/claude-code-review.yml | 33 ------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 .github/workflows/claude-code-review.yml

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
deleted file mode 100644
index 514f979d7..000000000
--- a/.github/workflows/claude-code-review.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# Source: https://github.com/anthropics/claude-code-action/blob/main/docs/code-review.md
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-
-jobs:
-  claude-review:
-    # Fork PRs don't have access to secrets or OIDC tokens, so the action
-    # cannot authenticate. See https://github.com/anthropics/claude-code-action/issues/339
-    if: github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@2f8ba26a219c06cfb0f468eef8d97055fa814f97 # v1.0.53
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
-          plugins: "code-review@claude-code-plugins"
-          prompt: "/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"