diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 0449114..95a22c1 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -1,4 +1,4 @@
-const API_BASE = 'http://localhost:8051';
+const API_BASE = import.meta.env.VITE_API_URL || 'http://localhost:8051';
 
 export interface ChatResponse {
   response: string;
diff --git a/frontend/src/lib/auth.tsx b/frontend/src/lib/auth.tsx
index 876a93a..7693120 100644
--- a/frontend/src/lib/auth.tsx
+++ b/frontend/src/lib/auth.tsx
@@ -1,6 +1,6 @@
 import { createContext, useContext, useState, useEffect, ReactNode } from 'react';
 
-const API_BASE = 'http://localhost:8051';
+const API_BASE = import.meta.env.VITE_API_URL || 'http://localhost:8051';
 
 interface AuthContextType {
   isAuthenticated: boolean;
diff --git a/requirements.txt b/requirements.txt
index 0e9412d..6d4489e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,7 +26,9 @@ sentence-transformers>=2.2.0
 rank-bm25>=0.2.2
 
 # MCP Server
-mcp>=1.0.0
+# Pinned <2.0.0: claude_code_mcp.py uses the low-level Server API
+# (@server.list_tools() etc.) which mcp 2.0.0 removed/renamed.
+mcp>=1.0.0,<2.0.0
 fastapi>=0.104.0
 uvicorn>=0.24.0
 pydantic>=2.0.0