v1.3.0
go-mcp now speaks the current MCP specification (2026-07-28) without breaking initialize-era clients.
Protocol
- Default protocol version is 2026-07-28.
- New
server/discoverRPC: supported versions, capabilities, identity, cache hints (ttlMs,cacheScope). - Per-request
_metaversion negotiation. Unknown versions return-32022(UnsupportedProtocolVersionError) withsupported/requested. resultType,ttlMs,cacheScope, and result_metaare emitted only when the client declares2026-07-28. Legacy responses keep the pre-2026 JSON shape.initializestill works and echoes2024-11-05,2025-03-26, or2025-11-25when asked.pingandresources/templates/list(empty catalog) remain so older and probing clients do not get-32601.
Security
- Registry maps are mutex-protected;
AddTool/AddResource/AddPromptare safe duringRun. - Handler panics are recovered. The panic value is logged to stderr, not sent to the client.
- Optional cooperative
Server.HandlerTimeout. - JSON-RPC requests without
jsonrpc: "2.0"or a method are rejected as-32600. - New
gomcp.SafeJoinhelper rejects..traversal, adjacent-prefix escapes, absolute paths outside root, and symlink escapes.
Extensions
- Optional
title,annotations,outputSchemaon tools;titleon resources and prompts. SetInstructionsfor initialize / discover guidance.- Deterministic list order. Optional cursor pagination via
Server.ListPageSize. RunContext/RunWithIOContextso callers can cancel in-flight handlers.
Compatibility
Existing Tool.Handler signatures, in-band isError for unknown/failed tools, and the initialize handshake are unchanged.
go get github.com/BackendStack21/go-mcp@v1.3.0Full changelog: v1.2.1...v1.3.0