diff --git a/pyproject.toml b/pyproject.toml
index 3e68734..90c0422 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,6 +10,8 @@ requires-python = ">=3.10"
 dependencies = [
     "bleak>=0.22",
     "pillow>=10",
+    # 纯 Python 离线库，不违反零网络不变量；templates.py qrcode 模板硬依赖
+    "qrcode>=7",
 ]
 
 [project.optional-dependencies]
diff --git a/requirements.txt b/requirements.txt
index 76ae38d..f57cb16 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,8 @@
 androguard==4.1.4
 bleak==3.0.2
 capstone==5.0.9
+# MCP 服务器依赖；钉版理由见 DECISIONS 2026-07-31；本文件为 GOVERNANCE 指定的依赖冻结
+mcp==1.29.0
 pillow==12.3.0
 pytest==9.1.1
 pytest-asyncio==1.4.0