diff --git a/eval/configs/benchmark-requirements-windows-py312-current.txt b/eval/configs/benchmark-requirements-windows-py312-current.txt
index cb312a3c3..e7639e7c8 100644
--- a/eval/configs/benchmark-requirements-windows-py312-current.txt
+++ b/eval/configs/benchmark-requirements-windows-py312-current.txt
@@ -105,7 +105,7 @@ torch==2.13.0
 tqdm==4.70.1
 transformers==5.17.0
 tree-sitter==0.26.0
-tree-sitter-language-pack==1.17.0
+tree-sitter-language-pack==1.21.0
 typer==0.27.2
 typing-inspection==0.4.4
 typing_extensions==4.16.0
diff --git a/pyproject.toml b/pyproject.toml
index f2147cf26..0ef7ded1a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -83,9 +83,9 @@ vector = [
 # The MCP server — plug Engraphis into Claude Code, Cursor, Cline, Zed, etc.
 # The upstream MCP SDK requires Python 3.10+; the numpy-only core remains Python 3.9.
 mcp = [
-    # 1.28.1 contains the current 1.x transport-security fixes; upstream explicitly
+    # 1.30.0 fixes CVE-2026-59951 in the compatible 1.x SDK; upstream explicitly
     # recommends the <2 cap because stable v2 is a breaking line.
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.30.0,<2; python_version >= '3.10'",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "starlette>=1.3.1,<2; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
@@ -98,7 +98,7 @@ mcp = [
 code = [
     "tree-sitter>=0.23; python_version >= '3.10'",
     "tree-sitter-language-pack==0.9.0; python_version < '3.10'",
-    "tree-sitter-language-pack==1.20.0; python_version >= '3.10'",
+    "tree-sitter-language-pack==1.21.0; python_version >= '3.10'",
 ]
 # Local resource extraction. Text/code/HTML/DOCX remain stdlib-only; this adds PDF
 # extraction and image OCR bindings (the Tesseract executable is installed separately).
@@ -140,12 +140,12 @@ all = [
     "python-dotenv>=1.0",
     "python-multipart>=0.0.31; python_version >= '3.10'",
     "sentence-transformers>=2.7; python_version >= '3.10'",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.30.0,<2; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=50.0.0; python_version >= '3.10'",
     "tree-sitter>=0.23; python_version >= '3.10'",
     "tree-sitter-language-pack==0.9.0; python_version < '3.10'",
-    "tree-sitter-language-pack==1.20.0; python_version >= '3.10'",
+    "tree-sitter-language-pack==1.21.0; python_version >= '3.10'",
     "pypdf>=6.15.0",
     "Pillow>=12.3.0; python_version >= '3.10'",
     "pytesseract>=0.3.10; python_version >= '3.10'",
@@ -183,12 +183,12 @@ test = [
     # exercises the real sqlite-vec native KNN backend (k=? + filtered widening) in CI.
     # 0.1.9 fixes DELETE behavior for vec0 rows with longer text primary keys.
     "sqlite-vec>=0.1.9,<0.2",
-    "mcp>=1.28.1,<2; python_version >= '3.10'",
+    "mcp>=1.30.0,<2; python_version >= '3.10'",
     "pydantic-settings>=2.14.2; python_version >= '3.10'",
     "cryptography>=50.0.0; python_version >= '3.10'",
     "tree-sitter>=0.23; python_version >= '3.10'",
     "tree-sitter-language-pack==0.9.0; python_version < '3.10'",
-    "tree-sitter-language-pack==1.20.0; python_version >= '3.10'",
+    "tree-sitter-language-pack==1.21.0; python_version >= '3.10'",
     "pypdf>=6.15.0",
     "Pillow>=12.3.0; python_version >= '3.10'",
     "pytesseract>=0.3.10; python_version >= '3.10'",
diff --git a/requirements.txt b/requirements.txt
index 87a500e57..d546275ec 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,7 +15,7 @@ numpy>=1.24
 pydantic>=2.0
 python-dotenv>=1.0
 sentence-transformers>=2.7; python_version >= '3.10'
-mcp>=1.28.1,<2; python_version >= '3.10'
+mcp>=1.30.0,<2; python_version >= '3.10'
 pydantic-settings>=2.14.2; python_version >= '3.10'
 cryptography>=50.0.0; python_version >= '3.10'
 pypdf>=6.15.0
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index ac7378ba1..0e25ce9c1 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -492,10 +492,11 @@ def test_extras_stay_resolvable_on_the_lowest_supported_python():
 def test_dependency_floors_exclude_known_vulnerable_and_breaking_releases():
     pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
     requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8")
-    expected = '"mcp>=1.28.1,<2; python_version >= \'3.10\'"'
+    expected = '"mcp>=1.30.0,<2; python_version >= \'3.10\'"'
     assert pyproject.count(expected) == 3
     combined = pyproject + requirements
-    assert "mcp>=1.28.1,<2" in requirements
+    assert "mcp>=1.30.0,<2" in requirements
+    assert "mcp>=1.28.1" not in combined
     assert "mcp>=1.14.0" not in combined
     assert "python-multipart>=0.0.31" in combined
     assert "starlette>=1.3.1,<2" in combined