chore: bump mcp package version (backport #4287) (#4288)

# What does this PR do?

Address

GHSA-9h52-p55h-vw2f

<hr>This is an automatic backport of pull request #4287 done by
[Mergify](https://mergify.com).

Signed-off-by: Sébastien Han <[email protected]>
Co-authored-by: Sébastien Han <[email protected]>

Author: mergify[bot]

llama_stack/providers/registry/agents.py

@@ -23,7 +23,7 @@ def available_providers() -> list[ProviderSpec]:
                 "pillow",
                 "pandas",
                 "scikit-learn",
-                "mcp>=1.8.1",
+                "mcp>=1.23.0",
             ]
             + kvstore_dependencies(),  # TODO make this dynamic based on the kvstore config
             module="llama_stack.providers.inline.agents.meta_reference",

llama_stack/providers/registry/tool_runtime.py

@@ -80,7 +80,7 @@ def available_providers() -> list[ProviderSpec]:
             provider_type="remote::model-context-protocol",
             module="llama_stack.providers.remote.tool_runtime.model_context_protocol",
             config_class="llama_stack.providers.remote.tool_runtime.model_context_protocol.config.MCPProviderConfig",
-            pip_packages=["mcp>=1.8.1"],
+            pip_packages=["mcp>=1.23.0"],
             provider_data_validator="llama_stack.providers.remote.tool_runtime.model_context_protocol.config.MCPProviderDataValidator",
             description="Model Context Protocol (MCP) tool for standardized tool calling and context management.",
         ),