My requirements.txt Had a Landmine in It. It Just Hadn't Gone Off Yet.

I built a small MCP server a few weeks ago — server.py, seven tools wrapping the GitHub REST API and the DEV.to API for managing my own dev presence. It's been running fine. Today I read a post about someone whose production deployment went down because their fastmcp dependency had no version ceiling — a transport-level default changed in a minor release, and suddenly every request came back 421 Misdirected Request. I had the smug "glad that's not me" reaction for about four seconds, then went and actually opened my own requirements.txt.

mcp[cli]

Enter fullscreen mode

Exit fullscreen mode

One line. No version at all. Not even a floor, let alone a ceiling. I wrote it that way on purpose — the ADR I logged for this decision literally says "zero-dependency script; slight verbosity in HTTP call setup" was the tradeoff I was optimizing for, and I picked FastMCP specifically because it kept the dependency count at one. What I didn't think through is that "one dependency" and "one unconstrained dependency" are very different risk profiles, and I'd conflated them.