diff --git a/package-lock.json b/package-lock.json
index 66222a0eb6d..36b454d2272 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3604,14 +3604,14 @@
       }
     },
     "node_modules/@modelcontextprotocol/server-legacy": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server-legacy/-/server-legacy-2.0.0.tgz",
-      "integrity": "sha512-LnffC1BSqFMHtMQxEz92lqDpHWma+ErV3ghdHDgdkCyYzVcCYKcUT5loq4kflty+Bf9C9qjJqbnphyBWyCqo8Q==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server-legacy/-/server-legacy-2.4.0.tgz",
+      "integrity": "sha512-xWq1YTZiLZltEXp/NJhsW7IvpuowrapEFuriAz3a86CIwMnt7+r8EaG/7xtWi7aqLzhtplOJJffUE5YIcUT+Aw==",
       "deprecated": "This package is a frozen copy of v1's SSE transport and OAuth Authorization Server helpers for migration purposes only. Use StreamableHTTP from @modelcontextprotocol/server and a dedicated OAuth server in production. Will not receive new features.",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@modelcontextprotocol/core": "2.0.0",
+        "@modelcontextprotocol/core": "2.4.0",
         "content-type": "^1.0.5",
         "cors": "^2.8.5",
         "express-rate-limit": "^8.2.1",
@@ -3631,6 +3631,19 @@
         }
       }
     },
+    "node_modules/@modelcontextprotocol/server-legacy/node_modules/@modelcontextprotocol/core": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.4.0.tgz",
+      "integrity": "sha512-z8QBKqdfXLPzkLQuG4xp8hrVEMm1PZ1IgxMN2sMbJiFiAKOWXnAzogXn2W4aqIBlP1ea6U5yiqVquvUNM1Cj6Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core": {
       "version": "2.4.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.4.0.tgz",
@@ -16411,7 +16424,7 @@
         "@modelcontextprotocol/node": "2.1.2",
         "@modelcontextprotocol/sdk": "1.32.1",
         "@modelcontextprotocol/server": "2.4.0",
-        "@modelcontextprotocol/server-legacy": "2.0.0"
+        "@modelcontextprotocol/server-legacy": "^2.4.0"
       }
     },
     "packages/runtime": {
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 67a07968100..06c7c7bf774 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -26,6 +26,6 @@
     "@modelcontextprotocol/node": "2.1.2",
     "@modelcontextprotocol/sdk": "1.32.1",
     "@modelcontextprotocol/server": "2.4.0",
-    "@modelcontextprotocol/server-legacy": "2.0.0"
+    "@modelcontextprotocol/server-legacy": "2.4.0"
   }
 }