feat(server): restore dependencies parameter on MCPServer - #2358
Conversation
Sorry, something went wrong.
Restores the `dependencies` parameter that was removed in #1877. The parameter is read by the `mcp dev` and `mcp install` CLI commands to auto-populate `uv run --with <pkg>` flags. Removal without a working replacement breaks high-profile consumers (awslabs/mcp uses it in 47 servers, mindsdb, redis/mcp-redis). While PEP 723 inline script metadata is the intended replacement, the CLI doesn't currently parse it — `uv` only reads PEP 723 when the script is the direct target, not when wrapped in `mcp run <file>`. Long-term design (deprecate vs. keep vs. config file) is tracked in the linked issue. Github-Issue:#2354
There was a problem hiding this comment.
This reverses the deliberate removal from #1877 and is a design decision that a maintainer should confirm, even though the code change itself is small and correct. The nit about Collection[str] accepting bare strings is worth addressing too.
Extended reasoning...Overview
This PR restores the dependencies parameter on MCPServer that was removed in #1877. It adds a dependencies: list[str] field to Settings, a dependencies: Collection[str] = () constructor parameter, and a simple test. The CLI consumer code in cli.py already reads server.dependencies via hasattr/getattr, so this restoration makes those checks functional again.
Security risks
No direct security risks. The dependencies values are passed as --with flags to uv run, which installs packages from PyPI. This is existing behavior in the CLI and not introduced by this PR.
Level of scrutiny
This deserves maintainer-level scrutiny despite being small. The parameter was deliberately removed in #1877, and restoring it is a design decision about the SDK's API surface. The PR description acknowledges this is a stopgap pending a design discussion in #2354. A maintainer should confirm they want to take this approach rather than one of the alternatives outlined in that issue.
Other factors
The bug report about Collection[str] accepting bare strings is a valid nit — MCPServer("test", dependencies="pandas") would silently produce ["p", "a", "n", "d", "a", "s"]. Changing to list[str] (consistent with other parameters in the same constructor) or adding a runtime guard would prevent this footgun. The test coverage is adequate for the happy path but does not cover this edge case.
Sorry, something went wrong.
Matches the convention used by other sequence parameters in the same constructor (icons, tools) and avoids the Collection[str] footgun where a bare string like dependencies="pandas" would be iterated as chars.
There was a problem hiding this comment.
LGTM — previous Collection[str] concern addressed, now correctly using list[str] | None.
Extended reasoning...Overview
This PR restores the dependencies parameter on MCPServer that was removed in #1877. The change touches two files: server.py (adds a dependencies: list[str] field to Settings and a corresponding constructor parameter) and test_server.py (adds a test verifying round-trip and default behavior). Total diff is ~15 lines of functional code.
Security risks
None. The dependencies parameter stores a list of package name strings used by the CLI (mcp dev/mcp install) to populate uv run --with flags. It does not affect authentication, authorization, or data handling at runtime.
Level of scrutiny
Low scrutiny appropriate. This is a small, mechanical restoration of a previously-existing API parameter with correct typing. The design decision about whether to keep, deprecate, or replace this parameter is tracked separately in #2354 — this PR is simply the implementation.
Other factors
- My previous review flagged a Collection[str] footgun (bare strings silently splitting into characters). The author addressed this in commit ddb631f by changing to list[str] | None, which is type-safe and consistent with other list parameters in the constructor.
- Test coverage is adequate: verifies both the round-trip through settings.dependencies and the default empty-list behavior.
- No outstanding reviewer comments remain unaddressed.
Sorry, something went wrong.
Restores the dependencies parameter that was removed in #1877, pending a proper design decision on its future (tracked in #2354).
Motivation and Context
The dependencies parameter is consumed by mcp dev and mcp install to auto-populate uv run --with <pkg> flags when launching servers or writing Claude Desktop config. Removing it without a working replacement creates two problems:
Breaks high-profile users — awslabs/mcp (8.5k★, 47 server files), mindsdb (38.8k★), redis/mcp-redis all use this parameter. When jlowin's fastmcp package removed the same parameter, it triggered 8+ breakage issues across the ecosystem.
No working replacement — the examples were migrated to PEP 723 inline script metadata, but mcp install/mcp dev can't read it. uv only parses PEP 723 when the script is the direct target; the CLI wraps it in mcp run <file>, so the metadata is ignored.
The CLI consumer code at cli.py#L261 and cli.py#L451 still checks for server.dependencies via hasattr/getattr — it was never removed, so this restoration makes those checks functional again.
Long-term options (deprecate → PEP 723, adopt a config file like FastMCP 2.0, or keep as-is) are laid out in #2354.
How Has This Been Tested?
Added test_dependencies verifying the parameter round-trips through both mcp.dependencies and mcp.settings.dependencies, and defaults to [] when omitted. All 88 tests in tests/server/mcpserver/test_server.py pass.
Breaking Changes
None — this restores previously-removed API.
Types of changes
Checklist
Additional context
Closes the gap left by #1877. See #2354 for the design discussion.
AI Disclaimer