build(deps): bump mcp lock to 1.28.1 to clear osv-scan High findings

[yassin-berriai]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests (not applicable; lock-only dependency bump)
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

The osv-scan job currently fails on every open PR because the base branch pins mcp 1.26.0, which OSV flags with three High advisories (GHSA-hvrp-rf83-w775, GHSA-jpw9-pfvf-9f58, GHSA-vj7q-gjh5-988w), all fixed by 1.28.1. Example failing run on an unrelated PR: https://github.com/BerriAI/litellm/actions/runs/29533650188/job/87739655112

The osv-scan check on this PR itself is the proof: it runs the same scanner against the bumped lock and should go green here while staying red on sibling PRs until this merges

Type

🚄 Infrastructure

Changes

Lock-only bump of mcp from 1.26.0 to 1.28.1 via uv lock --upgrade-package mcp. pyproject.toml already allows mcp>=1.26.0,<2.0 so no constraint change is needed, and 1.28.1 predates the lockfile's exclude-newer cutoff. Same shape as the recent uvicorn lock bump (#33574)

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

No reviewable files after applying ignore patterns.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yassin-berriai]

Closing as duplicate of #33591 which ships the same mcp 1.28.1 bump

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_bump_mcp_lock_1_28_1 (c267475) with litellm_internal_staging (2162da5)}