fix(templates): avoid pulling in incompatible mcp versions

[Hweinstock]

Problem

The e2e tests are failing on mainline for the past few days with langgraph templates. Ex. https://github.com/aws/agentcore-cli/actions/runs/30370526485/job/90338758015

stdout | e2e-tests/langgraph-openai.test.ts > e2e: LangChain_LangGraph/OpenAI — create → deploy → invoke > invokes the deployed agent

──────── E2E failure: invoke (exit 1) ────────
▸ error: Runtime initialization time exceeded. Please make sure that initialization completes in 30s.
▸ stdout:
{"success":false,"error":"Runtime initialization time exceeded. Please make sure that initialization completes in 30s."}
▸ stderr:

Confirmed with a local test that agentcore create with a langGraph python bedrock agent, then agentcore deploy followed by agentcore invoke produces Error: Runtime initialization time exceeded. Please make sure that initialization completes in 30s. on the live released CLI and the unreleased version.

This confirms the issue happened without a code change on the CLI side since previous tests were passing 19 hours ago: https://github.com/aws/agentcore-cli/actions/runs/30306941476/job/90113364343.

Root Cause

We do not pin a dependency in the langgraph template that recently had a major version update.

• code: https://github.com/aws/agentcore-cli/blob/main/src/assets/python/http/langchain_langgraph/base/pyproject.toml#L15
• release: https://pypi.org/project/mcp/ release 2.0.0 3 hours ago.

Solution

• leverage https://peps.python.org/pep-0440/#compatible-release to avoid pulling in incompatible versions.
• we bump minimum to 1.24 since they renamed the streaming client in the mcp package: https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.24.0. langchain-mcp-adapters 0.3.x expects it to be under this name.
• we also bump langchain-mcp-adapters to ensure its compatible with bump to mcp package done above.

Notes

When making this change, I noticed that there are other unpinned dependencies in these templates. We should make an effort to move these towards pinning to avoid this happening moving forward. However, we need to be careful when pinning since it could cause us to use a different version than what is currently being resolved. Creating a follow-up GH issue for this work that we should tackle as part of the refactor.

Testing

• created a local langraph project, ran dev, and ran invoke after deploying. Both worked, whereas before it failed.
• ran langgraph-openai.test.ts locally.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.24.2.tgz

How to install

gh release download pr-1850-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.24.2.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)