[CHORE]: llmguardplugin — bump mcp to >=2,<3 and document mcp-contextforge-gateway runtime dependency

Start with plugins/external/llmguard/pyproject.toml and the MCP SDK v2 migration guide. Review the llmguard plugin’s MCP usage and run its available test suite against MCP SDK v2, then verify the cryptography compatibility question. Done means the version constraint, runtime-dependency rationale, test results, and CI outcome are documented.

Summary

After the plugin has been moved to this repository (tracked in #22), update plugins/external/llmguard/pyproject.toml to target MCP SDK v2 and formally document the intentional omission of mcp-contextforge-gateway as a declared dependency.

Dependency changes

1. MCP SDK version bump

# Before
mcp>=1.28.1,<2

# After
mcp>=2,<3

This aligns with the MCP SDK v2 migration tracked in IBM/mcp-context-forge#6218 (Step 10: IBM/mcp-context-forge#6228).

2. API changes required by MCP SDK v2

Per the MCP SDK v2 migration guide:

• Protocol type aliases using camelCase have been removed; use snake_case equivalents.
• Review any transport constructor parameters — these may need to move to run()/app call sites.
• Validate that sync handler functions do not call asyncio.get_running_loop().

3. mcp-contextforge-gateway runtime dependency — document clearly

mcp-contextforge-gateway is deliberately absent from [project.dependencies]. The existing comment in pyproject.toml explains the rationale:

mcp-contextforge-gateway is provided at runtime by the gateway process. It is not listed as a direct dependency to avoid cryptography version conflicts with llm-guard's transitive dependency on presidio-anonymizer.

As part of this bump, verify whether the cryptography conflict still exists with the versions of llm-guard and mcp-contextforge-gateway compatible with MCP SDK v2. If the conflict has been resolved upstream, consider whether to add mcp-contextforge-gateway as a declared optional dependency (e.g., [project.optional-dependencies] gateway = ["mcp-contextforge-gateway>=..."])). Either way, ensure the decision is clearly documented.

Acceptance criteria

• mcp constraint updated to >=2,<3 in pyproject.toml
• All tests pass against MCP SDK v2
• mcp-contextforge-gateway omission is clearly documented (comment or README section)
• Cryptography conflict investigated; outcome noted in this issue or a follow-up
• CI green

References

• Depends on: #22 (move issue)
• MCP SDK v2 migration epic: IBM/mcp-context-forge#6218
• Step 10 (mcp-servers update): IBM/mcp-context-forge#6228