v4.2.0

`latest` moves from 4.1.0 to 4.2.0. No breaking changes: everything new is behind a new flag or a config file, and a 4.1.0 command line runs as it did.

## New

* **Several servers from one config file.** `--config servers.json` reads the `mcpServers` file Claude Desktop and other clients use and serves each server at `/<name>` on one port, with any option set per server or as a default. `--checkConfig` validates a file; `--printConfig` prints the resolved one with secrets hidden (#13, #107)
* **Servers combined on one URL**: one MCP server made of several, with sampling, roots and elicitation passed through (#106)
* **Remote servers over any transport**: `--sse` and `--streamableHttp` servers served over SSE, WebSocket or Streamable HTTP, not only bridged to stdio
* **`--apiKey`, `--apiKeyFile`, `SUPERGATEWAY_API_KEY`**: require clients to present a key (#64, #92, #99)
* **`--healthCheck server`**: health endpoints that start, initialize and ping the server, and answer 503 with the reason (#83)
* **`--toolPrefix` and `--tools`**: prefix a server's tool names, and expose only those listed
* **`--host`** (#125), **`--logFormat json`** (#96, #101) and **`--exitWithProcess <pid>`** (#155)
* **Standalone executables and a Homebrew formula**: Supergateway with Node built in, for macOS, Linux and Windows (#50)
* **MCP 2026-07-28** also for remote Streamable HTTP servers and combined servers, when they speak it

## Fixes

* Two 4.1.0 regressions: a client that reconnects without initializing again no longer has its calls refused, and a client retrying after a slow server's start gets the server already starting instead of a new one each time (#45)
* The `--sse` and `--streamableHttp` bridges stop reading the remote server while their client is not reading, and pass an upstream application error through with its own code
* A call's progress on a stateful session rides that call's own stream when several calls are in flight
* `--stdio=cmd` and `--streamable-http url` start the gateway; a one-word `--header` is no longer logged; no `kill EPERM` stack traces on macOS

## Validation

The release candidate passed a 25-hour soak across Node 20, 22, 24 and 26 on Linux, macOS and Windows, with real MCP servers, the MCP Inspector, Python, Go and Ruby clients, and sustained load, crash and restart scenarios. Side by side with 4.1.0, and under 4.1.0's own end-to-end tests, it differs only where intended. Coverage is 100% for lines, branches and MC/DC.

Thanks to:
- [@akirilyuk](https://github.com/akirilyuk)
- [@akularefiner](https://github.com/akularefiner)
- [@alibek-sumup](https://github.com/alibek-sumup)
- [@alvaroalon2](https://github.com/alvaroalon2)
- [@anyuan95](https://github.com/anyuan95)
- [@ArnaudBger](https://github.com/ArnaudBger)
- [@brrock](https://github.com/brrock)
- [@Cipppp](https://github.com/Cipppp)
- [@davibaldin](https://github.com/davibaldin)
- [@gamedevsam](https://github.com/gamedevsam)
- [@GhimBoon](https://github.com/GhimBoon)
- [@hxy91819](https://github.com/hxy91819)
- [@iandol](https://github.com/iandol)
- [@jakajancar](https://github.com/jakajancar)
- [@jwalitptl](https://github.com/jwalitptl)
- [@logan-crosby](https://github.com/logan-crosby)
- [@mantrakp04](https://github.com/mantrakp04)
- [@nullStack65](https://github.com/nullStack65)
- [@pcnfernando](https://github.com/pcnfernando)
- [@qdrddr](https://github.com/qdrddr)
- [@rajivml](https://github.com/rajivml)
- [@sbatista-uc](https://github.com/sbatista-uc)
- [@Shellishack](https://github.com/Shellishack)
- [@Sodawyx](https://github.com/Sodawyx)
- [@thedadams](https://github.com/thedadams)