diff --git a/package-lock.json b/package-lock.json
index d619fcf01..08f291e5b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2499,6 +2499,38 @@
       "dev": true,
       "license": "BSD-2-Clause"
     },
+    "node_modules/@modelcontextprotocol/client": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.3.0.tgz",
+      "integrity": "sha512-pbHtGj6EeFCHngFE8gtNPaKrsj8Mb1IMw45BLcaPML/m2WTxI7pyYmeNQvaux88Lw8BSO5r7nyRbUyIkICmGrg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@modelcontextprotocol/core": "2.3.0",
+        "cross-spawn": "^7.0.5",
+        "eventsource": "^3.0.2",
+        "eventsource-parser": "^3.0.8",
+        "jose": "^6.1.3",
+        "pkce-challenge": "^5.0.0",
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.3.0.tgz",
+      "integrity": "sha512-09BHFaNVBe5pB2AhzCfLj0cqmsKLERvZQ4FblzP90UMGLaXVqdZPByFjURwsUYCmxonUW2yAwgTTvle+8O2/8w==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/@modelcontextprotocol/core": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.0.0.tgz",
@@ -7209,7 +7241,9 @@
       }
     },
     "node_modules/eventsource-parser": {
-      "version": "3.0.6",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
+      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18.0.0"
@@ -14651,7 +14685,7 @@
       },
       "devDependencies": {
         "@eslint/js": "^9.30.1",
-        "@modelcontextprotocol/client": "^2.2.0",
+        "@modelcontextprotocol/client": "^2.3.0",
         "@types/cors": "^2.8.17",
         "@types/express": "^5.0.6",
         "@types/express-session": "^1.18.0",
@@ -15166,38 +15200,6 @@
         "url": "https://opencollective.com/libvips"
       }
     },
-    "packages/api/node_modules/@modelcontextprotocol/client": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.2.0.tgz",
-      "integrity": "sha512-LxCou/CSYQ6dwEnjhLZY0KnEuc8V4UJ3IEQCl/uR2yHobSQIEdJKUlKLRYRF5i5FqRGHy1eK7une3aAWDHLtig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@modelcontextprotocol/core": "2.2.0",
-        "cross-spawn": "^7.0.5",
-        "eventsource": "^3.0.2",
-        "eventsource-parser": "^3.0.0",
-        "jose": "^6.1.3",
-        "pkce-challenge": "^5.0.0",
-        "zod": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "packages/api/node_modules/@modelcontextprotocol/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-iLhmprRmWI8EcosOA3wVvww22z02NkgqhV4fBH6f/odQBsi7xnJc0HGmi21yWO+/iKw2yzqVE127Zhna5/+JXw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "zod": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
     "packages/api/node_modules/has-flag": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
diff --git a/packages/api/package.json b/packages/api/package.json
index 64191c787..608968446 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.30.1",
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
     "@types/express-session": "^1.18.0",