Skip to content

v1.3.0 — MCP 2026-07-28 with backward-compatible initialize

Latest

Choose a tag to compare

@cursor cursor released this 05 Sep 10:31
ecc5e36

v1.3.0

go-mcp now speaks the current MCP specification (2026-07-28) without breaking initialize-era clients.

Protocol

  • Default protocol version is 2026-07-28.
  • New server/discover RPC: supported versions, capabilities, identity, cache hints (ttlMs, cacheScope).
  • Per-request _meta version negotiation. Unknown versions return -32022 (UnsupportedProtocolVersionError) with supported / requested.
  • resultType, ttlMs, cacheScope, and result _meta are emitted only when the client declares 2026-07-28. Legacy responses keep the pre-2026 JSON shape.
  • initialize still works and echoes 2024-11-05, 2025-03-26, or 2025-11-25 when asked.
  • ping and resources/templates/list (empty catalog) remain so older and probing clients do not get -32601.

Security

  • Registry maps are mutex-protected; AddTool / AddResource / AddPrompt are safe during Run.
  • Handler panics are recovered. The panic value is logged to stderr, not sent to the client.
  • Optional cooperative Server.HandlerTimeout.
  • JSON-RPC requests without jsonrpc: "2.0" or a method are rejected as -32600.
  • New gomcp.SafeJoin helper rejects .. traversal, adjacent-prefix escapes, absolute paths outside root, and symlink escapes.

Extensions

  • Optional title, annotations, outputSchema on tools; title on resources and prompts.
  • SetInstructions for initialize / discover guidance.
  • Deterministic list order. Optional cursor pagination via Server.ListPageSize.
  • RunContext / RunWithIOContext so callers can cancel in-flight handlers.

Compatibility

Existing Tool.Handler signatures, in-band isError for unknown/failed tools, and the initialize handshake are unchanged.

go get github.com/BackendStack21/go-mcp@v1.3.0

Full changelog: v1.2.1...v1.3.0