chore(deps): update dependency mcp-proxy to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp-proxy (source)	^5.0.0 → ^6.0.0

---

Release Notes

punkpeye/mcp-proxy (mcp-proxy)

v6.5.4

Compare Source

Bug Fixes

• return 401 for authenticated session failures (e6bf7e7)
• return 401 for authenticated session failures (cd90079)

v6.5.3

Compare Source

Bug Fixes

• keep stateful HTTP stream sessions alive past Node.js default 5s keep-alive socket timeout (95e9bad)

v6.5.2

Compare Source

Bug Fixes

• do not crash on a malformed request target (e33d63e), closes #​66

v6.5.1

Compare Source

Bug Fixes

• return 405 for stateless clients without sessionId (bf7d464)

v6.5.0

Compare Source

Features

• add --corsAddAllowedHeader CLI flag (10c3a08)

v6.4.6

Compare Source

Bug Fixes

• force build (79386de)
• skip onUnhandledRequest for MCP protocol endpoints (a2243b0)
• skip onUnhandledRequest for MCP protocol endpoints (5a7a152), closes #​59 #​59

v6.4.5

Compare Source

Bug Fixes

• move onUnhandledRequest before auth middleware (4c532c3), closes #​58

v6.4.4

Compare Source

Bug Fixes

• update mcp sdk (b72cf36)
• update mcp sdk (753f512)

v6.4.3

Compare Source

Bug Fixes

• extracts JSON from lines with non-JSON prefixes (#​55) (d4bdd40)
• extracts JSON from lines with non-JSON prefixes (#​55) (7cd526e)

v6.4.2

Compare Source

Bug Fixes

• prevent double cleanup on DELETE request causing ECONNRESET (f1497e0)

v6.4.1

Compare Source

Bug Fixes

• add Mcp-Protocol-Version to default CORS allowed headers (ae66528), closes punkpeye/fastmcp#240
• ignore session ID header in stateless mode (f5cb2ad)

v6.4.0

Compare Source

Bug Fixes

• validate authentication on every request in stateful mode (1ddf5d2)

Features

• update session auth context on every request (cd9b7fd)

v6.3.0

Compare Source

Features

• add tunnel (5dbded5)

v6.2.0

Compare Source

Features

• add connectionTimeout (2368d7c)

v6.1.10

Compare Source

Bug Fixes

• correct --version behavior (c168a0e)

v6.1.9

Compare Source

Bug Fixes

• simplify the api (20e1a5e)

v6.1.8

Compare Source

Bug Fixes

• add permissions (cef243d)
• update @​tsconfig/node24 (d024d0c)

v5.12.5

Compare Source

Bug Fixes

• correct types path (e6d5058)

v5.12.4

Compare Source

Bug Fixes

• correct entry path (ec13456)

v5.12.3

Compare Source

Bug Fixes

• update semantic-release (000ac05)

v5.12.2

Compare Source

Bug Fixes

• update dev dependencies (233818c)

v5.12.1

Compare Source

Bug Fixes

• update dev dependencies (924dfde)

v5.12.0

Compare Source

Features

• Add MCP scope challenge (step-up authentication) support (dc5f1ab)
• MCP 2025-11-25 (397f6d0)

v5.11.2

Compare Source

Bug Fixes

• send SSE connection notice as notifications/message (0bb50c0)
• send SSE connection notice as notifications/message (91c5c03), closes #​33

v5.11.1

Compare Source

Bug Fixes

• only register completions handler when server supports completions (1d51885)
• only register completions handler when server supports completions (2427516)

v5.11.0

Compare Source

Features

• implement full RFC6750 support for www-authenticate headers (7b68c11)
• implement full RFC6750 support www-authenticate (cba77d7)

v5.10.0

Compare Source

Features

• support cors config (3f3fe47)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.