Update mcp requirement from >=1.28.0 to >=1.28.1

[dependabot]

Updates the requirements on mcp to permit the latest version.

Commits

• 777b8d0 [v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...
• 4720467 [v1.x] Set Development Status classifier to Production/Stable (#2976)
• 6df3d73 [v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

PR Review

What this does: Bumps the mcp lower-bound constraint from >=1.28.0 to >=1.28.1 in requirements/base.txt. The 1.28.1 patch release includes buffering improvements for per-request StreamableHTTP streams and WebSocket transport security settings support — both relevant to this project's heavy use of StreamableHTTPSessionManager.

Verdict: No issues found. Safe to merge.

---

Findings

None. This is a one-line patch-level lower-bound bump with no API changes. The project uses StreamableHTTPSessionManager extensively, and the StreamableHTTP buffering fix in 1.28.1 is a direct improvement for that usage. The constraint remains open-ended (>=) so no lock-in concerns.

---

One pre-existing nit (not introduced by this PR): the comment on the mcp line reads # https://github.com/anthropics/python-sdk — that points to the Anthropic Python SDK, not the MCP SDK. The correct URL is https://github.com/modelcontextprotocol/python-sdk. Worth fixing in a follow-up.