mcp integration breaks on mcp 2.x: _supported_versions has no upper bound

[maxrogers-to]

ddtrace 4.8.2 through 4.13.0rc3, mcp 2.0.0, py3.14.

_supported_versions() in ddtrace/contrib/internal/mcp/patch.py returns
{"mcp": ">=1.10.0"} with no upper bound. mcp 2.0.0 dropped mcp.shared.session, so
the version check passes and patch() then dies on the import.

repro:

pip install ddtrace==4.12.2 mcp==2.0.0
DD_TRACE_ENABLED=true python -c "import ddtrace.auto; import mcp"

File ".../ddtrace/contrib/internal/mcp/patch.py", line 288, in patch
    from mcp.shared.session import BaseSession
ModuleNotFoundError: No module named 'mcp.shared.session'

mcp.types and mcp.client.session are still there, it's only mcp.shared.session
that went away.

not fatal, the patch failure gets swallowed, but it's a traceback on every boot and no
mcp spans either way.

DD_TRACE_SAFE_INSTRUMENTATION_ENABLED=true doesn't catch it, 2.0.0 satisfies the
declared spec.

pip install mcp pulls 2.x now, so anything unpinned lands here:
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.0.0

those release notes also tell people to pin <2 if they haven't migrated, which is what
the spec should be doing.

working around it with DD_PATCH_MODULES=mcp:false. still on main and 4.13.0rc3.

[Natim]

Another workaround, for anyone hitting this with Sentry in the stack: we left the integration enabled and filtered the log line instead of disabling the patch.

Under ddtrace-run, patch_all() passes raise_errors=False, so _on_import_factory swallows the ModuleNotFoundError and reports it through log.error("failed to enable ddtrace support for %s") on the ddtrace._monkey logger. Sentry's logging integration captures ERROR records by default, so this became a fresh issue on every process boot rather than just a boot-time traceback.

from sentry_sdk.integrations.logging import ignore_logger

ignore_logger("ddtrace._monkey")

We preferred that over DD_PATCH_MODULES=mcp:false because we wanted the line to stay in stdout and Datadog logs as the standing signal that MCP tracing is off, instead of dropping the integration silently and forgetting about it.

One observation relevant to the review feedback on #19440: capping _supported_versions() at <2 would not stop the log on our path. On ddtrace 4.12.2, check_module_compatibility() only runs when config._trace_safe_instrumentation_enabled is true, and that defaults to false, so the import hook still reaches from mcp.shared.session import BaseSession. With the flag turned on, the resulting IncompatibleModuleException is reported by the same log.error call on ddtrace._monkey. So the cap removes the traceback but not the ERROR record, and log-based alerting still needs a filter either way.

Versions: ddtrace 4.12.2, mcp 2.0.0, Python 3.14, ddtrace-run on Cloud Run with the agent as a sidecar.