Update github.com/modelcontextprotocol/go-sdk from v0.4.0 to v1.1.0

[Copilot]

Updates MCP SDK to v1.1.0 for improved parameter validation and OAuth support. The repository doesn't use StreamableServerTransport or EventStore, so the breaking change regarding stream resumption defaults doesn't apply.

Changes

• Dependencies: Updated github.com/modelcontextprotocol/go-sdk v0.4.0 → v1.1.0
• Test Fix: Updated TestMCPServer_AddToolInvocation/MissingWorkflows to expect validation errors from CallTool() directly, reflecting v1.1.0's stricter parameter validation before tool invocation

// Before: Expected error in tool response content
callResult, err := session.CallTool(ctx, params)
if err != nil {
    t.Fatalf("Failed to call add tool: %v", err)
}
// Check callResult.Content for error message

// After: Expect validation error from CallTool
_, err := session.CallTool(ctx, params)
if err == nil {
    t.Fatal("Expected error when calling add tool with missing workflows parameter")
}
// SDK validates params before invocation

API Compatibility

All MCP SDK APIs used in this codebase (NewServer, NewClient, StdioTransport, CommandTransport, Implementation) remain unchanged.

Available Features (Not Used)

v1.1.0 adds IOTransport, ServerOptions.Logger, StreamableHTTPOptions extensions, and experimental OAuth support.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Dependabot] Update github.com/modelcontextprotocol/go-sdk from v0.4.0 to v1.1.0 (requires review)</issue_title>
<issue_description>## Summary
Update github.com/modelcontextprotocol/go-sdk from v0.4.0 to v1.1.0

Current State

• Package: github.com/modelcontextprotocol/go-sdk
• Current Version: v0.4.0
• Proposed Version: v1.1.0
• Update Type: Major

Safety Assessment

⚠️ Requires Review - Major Version Update

• Major version update (0.4.0 -> 1.1.0)
• Includes behavior changes and API additions
• Default stream resumption behavior changed
• New features and experimental OAuth support

Important Behavior Changes

Stream Resumption Disabled by Default (Breaking)

In StreamableServerTransport, the default value of nil for the EventStore field now disables stream resumption, rather than defaulting to use an in-memory event store.

Impact: If your code relies on the default stream resumption behavior, you must explicitly set StreamableHTTPOptions.EventStore to enable it.

Migration:

// Before (implicit in-memory store)
transport := &StreamableServerTransport{}

// After (explicit in-memory store if needed)
transport := &StreamableServerTransport{
    EventStore: NewInMemoryEventStore(),
}

New Features

API Additions

• IOTransport: New general-purpose transport from io.ReadCloser and io.WriteCloser
• ServerOptions.Logger: Enable server-side logging
• StreamableHTTPOptions.Logger: Enable server-side logging for streamable transport
• StreamableHTTPOptions.EventStore: Explicitly enable stream resumption
• StreamableHTTPOptions.SessionTimeout: Auto-close idle sessions

Experimental OAuth Support

• Client-side OAuth APIs available with mcp_go_client_oauth build tag
• APIs may change before official release

Changes Since v0.4.0

• Multiple bug fixes in streamable transport
• Improved documentation for resumability and redelivery
• Enhanced error handling
• Performance improvements

Links

• Release v1.1.0
• Package Repository
• Go Package
• Full Changelog

Recommended Action

Step 1: Review Code for Stream Resumption Usage

# Search for StreamableServerTransport usage
grep -r "StreamableServerTransport" .
grep -r "EventStore" .

Step 2: Update if stream resumption is NOT needed (most cases)

go get -u github.com/modelcontextprotocol/go-sdk@v1.1.0
go mod tidy

Step 3: Update code if stream resumption IS needed
Explicitly configure EventStore in any StreamableServerTransport initialization.

Testing Notes

• Critical: Test all MCP server functionality
• Verify stream handling works as expected
• Check if your code relies on default stream resumption
• Test with various MCP clients
• Verify logging integration if using new Logger options
• Check session timeout behavior
• Run comprehensive integration tests: make test
• Test all workflow executions that use MCP servers

AI generated by Dependabot Dependency Checker</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Dependabot] Update github.com/modelcontextprotocol/go-sdk from v0.4.0 to v1.1.0 (requires review) #4190

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull Request Overview

This PR updates the MCP SDK from v0.4.0 to v1.1.0, bringing improved parameter validation and OAuth support capabilities. The update includes a test fix to accommodate v1.1.0's stricter parameter validation that now occurs before tool invocation rather than during execution.

Key changes:

• Updates github.com/modelcontextprotocol/go-sdk from v0.4.0 to v1.1.0
• Updates github.com/google/jsonschema-go from pseudo-version to proper semantic version v0.3.0
• Fixes test to expect validation errors from CallTool() directly instead of in tool response content

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Updates MCP SDK to v1.1.0 and jsonschema-go to v0.3.0; adds oauth2 as indirect dependency
go.sum	Corresponding checksum updates for all dependency changes
pkg/cli/mcp_server_add_test.go	Updates test to reflect v1.1.0's earlier parameter validation behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The error message validation logic is incorrect. The condition uses && (AND) when it should use || (OR). The current logic only fails the test if the error message contains NEITHER "workflows" NOR "required", meaning the test would pass even if the error message only contains one of them. This makes the assertion too weak.

The condition should be:

if !strings.Contains(errMsg, "workflows") || !strings.Contains(errMsg, "required") {

Or better yet, use a single check that the error mentions the parameter name:

if !strings.Contains(errMsg, "workflows") {
    t.Errorf("Expected error message to mention missing 'workflows' parameter, got: %s", errMsg)
}

Suggested change

	if !strings.Contains(errMsg, "workflows") && !strings.Contains(errMsg, "required") {
	if !strings.Contains(errMsg, "workflows") {