Skip to content

Releases: modelcontextprotocol/go-sdk

Release list

v1.7.0

v1.7.0 Latest
Latest

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 28 Jul 13:09
v1.7.0
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
bc72835
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release brings full support for protocol version 2026-07-28.
The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

Deprecation of roots, sampling, and logging (SEP-2577)

Roots, sampling, and logging are formally deprecated on the 2026-07-28 revision. The SDK continues to expose the corresponding Go types for backward compatibility with older peers, but new servers should not rely on them.

Behavior changes guarded by MCPGODEBUG

Seven escape-hatch flags are added in this release to restore behavior that changed as part of spec-compliance fixes. All will be removed in v1.9.0.

  • customresnotfounderrcode=1 — restore the old -32002 code for ResourceNotFoundError.
  • hintomitempty=1 — restore omitempty on ToolAnnotations.ReadOnlyHint and IdempotentHint. The default now always serializes these fields because the Go types are bare bool (not *bool), so omitting false made it indistinguishable from "unset".
  • allowsessionsinstateless=1 — restore session-id handling on stateless streamable HTTP servers (read/write Mcp-Session-Id, accept DELETE). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return 405 Method Not Allowed for DELETE.
  • nomethodnotfoundcodeinerror=1 — restore the previous STDIO behavior where the JSON-RPC MethodNotFound (-32601) code is omitted from the error response for unhandled methods. The default now includes the code.
  • noprotocolerrorbody=1 — restore the previous streamable HTTP client behavior of not decoding the JSON-RPC error body of a non-2xx HTTP response. The default now surfaces the underlying JSON-RPC error.
  • nowrapinvalidparams=1 — restore the previous behavior of returning raw unmarshalParams errors from receiving handlers instead of wrapping them as a JSON-RPC -32602 Invalid params error. Introduced by #1087.
  • disablecompleteparamsvalidation=1 — restore the previous behavior of accepting completion/complete responses without validating the presence of the completion params object. Introduced by #1080.

Other Changes to the SDK

Streamable HTTP transport:

  • mcp: allow opt-in to cancel handler ctx on aborted POST by @guglielmo-san (#1099)
  • mcp: enforce body size limit in Streamable ...
Read more

Contributors

toabctl, rafaeljusto, and 21 other contributors
Assets 2
Loading

v1.7.0-pre.3

v1.7.0-pre.3 Pre-release
Pre-release

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 17 Jul 12:04
v1.7.0-pre.3
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
827f90b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a follow-up pre-release on top of v1.7.0-pre.2, still targeting protocol version 2026-07-28. It rounds out the previous pre-release with additional spec-compliance fixes, small ergonomic improvements to the streamable HTTP transport, and OAuth session persistence support.

Streamable HTTP request cancellation

The streamable HTTP transport now exposes an opt-in StreamableHTTPOptions.PropagateRequestCancellation flag. When enabled, aborting an in-flight POST cancels the handler context on stateless servers using the 2026-07-28 protocol, so long-running tool handlers can stop paying for orphaned work when the client goes away. Existing behavior is unchanged by default.

OAuth session persistence

Adds NewTokenSource and InitialTokenSource fields to AuthorizationCodeHandlerConfig. Together they let applications persist OAuth2 sessions across restarts by intercepting token refreshes and seeding the handler with a previously saved token source. A package example demonstrates the persistence pattern.

  • auth: support OAuth2 session persistence by @smlx (#1058)

Spec compliance fixes

Continued alignment with the spec adjustments for the 2026-07-28 protocol.

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags are added in this pre-release to restore the previous behavior of two spec-compliance fixes above.

  • nowrapinvalidparams=1 — restore the previous behavior of returning raw unmarshalParams errors from receiving handlers instead of wrapping them as a JSON-RPC -32602 Invalid params error. Introduced by #1087.
  • disablecompleteparamsvalidation=1 — restore the previous behavior of accepting completion/complete responses without validating the presence of the completion params object. Introduced by #1080.

Other Changes to the SDK

New Contributors

Full Changelog: v1.7.0-pre.2...v1.7.0-pre.3

Contributors

ychampion
Loading

v1.7.0-pre.2

v1.7.0-pre.2 Pre-release
Pre-release

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 09 Jul 09:29
v1.7.0-pre.2
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
b426fbf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.7.0-pre.2

This is a follow-up pre-release on top of v1.7.0-pre.1, still targeting protocol version 2026-07-28. It rounds out the previous release with conformance-test coverage on both client and server, tightens spec compliance and introduces first-class support for custom JSON-RPC methods.

Custom JSON-RPC methods

The SDK now supports registering non-standard JSON-RPC methods end-to-end. Servers can register handlers with AddReceivingCustomMethod and clients can invoke them via AddSendingCustomMethod.

Conformance tests

Both the client and server implementations are now exercised by the official MCP conformance test suite as part of CI.

Protection agains OOM attacks

The streamable HTTP transport now enforces a configurable request body size limit to protect servers against OOM-style attacks from oversized payloads.

Spec compliance fixes

Several smaller fixes bring the implementation closer to the spec.

Full Changelog: v1.7.0-pre.1...v1.7.0-pre.2

Loading

v1.7.0-pre.1

v1.7.0-pre.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 24 Jun 14:07
v1.7.0-pre.1
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
22d4988
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.7.0 — MCP 2026-07-28

This release brings full support for protocol version 2026-07-28 as of https://github.com/modelcontextprotocol/modelcontextprotocol/tree/f817239f4d6b1efff2c4dfc2f7af85c985d73076.
Any change introduced after this commit, may not be implemented in this release.

The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

Subscriptions listen (SEP-2575)

The legacy free-floating notifications/tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

Authorization improvements

Behavior Changes guarded by MCPGODEBUG

Five new escape-hatch flags were added to restore previous behavior. All will be removed in v1.9.0.

  • customresnotfounderrcode=1 — restore the old -32002 code for ResourceNotFoundError.
  • hintomitempty=1 — restore omitempty on ToolAnnotations.ReadOnlyHint and IdempotentHint. The default now always serializes these fields because the Go types are bare bool (not *bool), so omitting false made it indistinguishable from "unset".
  • allowsessionsinstateless=1 — restore session-id handling on stateless streamable HTTP servers (read/write Mcp-Session-Id, accept DELETE). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return 405 Method Not Allowed for DELETE.
  • nomethodnotfoundcodeinerror=1 — restore the previous STDIO behavior where the JSON-RPC MethodNotFound (-32601) code is omitted from the error response for unhandled methods. The default now includes the code.
  • noprotocolerrorbody=1 — restore the previous streamable HTTP client behavior of not decoding the JSON-RPC error body of a non-2xx HTTP response. The default now surfaces the underlying JSON-RPC error.

Other Changes to the SDK

  • mcp: close HTTP response body...
Read more

Contributors

toabctl, smlx, and 14 other contributors
Loading

v1.6.1

v1.6.1

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 22 May 11:52
v1.6.1
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
d454bba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release adds an MCPGODEBUG flag to opt out of the Content-Type check on POST requests.

Behavior Changes

Prior to v1.6.0 (v1.4.0...v1.5.0), the Content-Type check on POST requests was gated by the same disablecrossoriginprotection MCPGODEBUG flag as the cross-origin protection. In v1.6.0, the cross-origin protection was disabled by default (replaced by the opt-in enableoriginverification flag), but the Content-Type check was kept on unconditionally, leaving no way to disable it.
This release restores an escape hatch for both the Streamable HTTP and SSE transports: setting MCPGODEBUG=disablecontenttypecheck=1 skips the Content-Type: application/json validation on POST requests.
See #957.

What's Changed

Full Changelog: v1.6.0...v1.6.1

Contributors

guglielmo-san
Loading

v1.6.0

v1.6.0

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 08 May 12:05
v1.6.0
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
f5f2015
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release is equivalent to v1.6.0-pre.1. Thank you to those who tested the pre-release.

In this release we introduce several smaller fixes and improvements, and we started working for release 2026-06-30. The main new feature is the introduction of ClientCredentialsHandler for OAuth client credentials grant.

Add ClientCredentialsHandler for OAuth client credentials grant

Added ClientCredentialsHandler implementing auth.OAuthHandler using the OAuth 2.0 Client Credentials grant (RFC 6749 Section 4.4) for service-to-service authentication with pre-registered credentials.

  • extauth: add ClientCredentialsHandler for OAuth client credentials grant by @ravyg in #895

2026-06-30 Release related PRs

  • feat: add automatic application_type inference by @guglielmo-san in #904

    New application_type field is added to the ClientRegistrationMetadata for DynamicClientRegistration. If not specified, the application_type will be inferred from the RedirectURIs. This implements SEP-837.

  • feat: HTTP Header Standardization for method and name by @guglielmo-san in #907

    By mirroring key fields from the JSON-RPC payload into HTTP headers, network intermediaries such as load balancers, proxies, and observability tools can route and process MCP traffic without deep packet inspection, reducing latency and computational overhead. This partially implements SEP-2243.

Behavior Changes

SetError Behavior Change

Previously the SetError method on CallToolResult always overwrote the Content field with the error text. Now SetError preserves the existing value if it has already been populated. You can restore the previous behavior by setting the environment variable seterroroverwrite=1.

  • mcp: preserve existing Content in SetError by @ravyg in #864

Cross-Origin Protection Default Change

Previously (v1.4.1-v1.5.0) default (zero-value) cross-origin protection was applied when CrossOriginProtection in StreamableHTTPOptions was nil. Now cross-origin protection is not enabled by default when CrossOriginProtection is nil.
You can restore the previous behavior (enable by default) by setting enableoriginverification=1.

disablecrossoriginprotection was replaced by enableoriginverification after the default was changed to not enable cross-origin protection.

jsonescaping option was removed, according to plan.

Other Changes to the SDK

New Contributors

Full Changelog: v1.5.0...v1.6.0-pre.1

Contributors

rafaeljusto, begelundmuller, and 10 other contributors
Loading

v1.6.0-pre.1

v1.6.0-pre.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@guglielmo-san guglielmo-san released this 30 Apr 11:55
v1.6.0-pre.1
This tag was signed with the committer’s verified signature.
guglielmo-san Guglielmo Colombo
SSH Key Fingerprint: juQrWxEdNup1spq9pmY1HGk9S10i4IvRMvnIXj3fwH4
Verified
Learn about vigilant mode.
f5f2015
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

In this release we introduce several smaller fixes and improvements, and we started working for release 2026-06-30. The main new feature is the introduction of ClientCredentialsHandler for OAuth client credentials grant.

Add ClientCredentialsHandler for OAuth client credentials grant

Added ClientCredentialsHandler implementing auth.OAuthHandler using the OAuth 2.0 Client Credentials grant (RFC 6749 Section 4.4) for service-to-service authentication with pre-registered credentials.

  • extauth: add ClientCredentialsHandler for OAuth client credentials grant by @ravyg in #895

2026-06-30 Release related PRs

  • feat: add automatic application_type inference by @guglielmo-san in #904

    New application_type field is added to the ClientRegistrationMetadata for DynamicClientRegistration. If not specified, the application_type will be inferred from the RedirectURIs. This implements SEP-837.

  • feat: HTTP Header Standardization for method and name by @guglielmo-san in #907

    By mirroring key fields from the JSON-RPC payload into HTTP headers, network intermediaries such as load balancers, proxies, and observability tools can route and process MCP traffic without deep packet inspection, reducing latency and computational overhead. This partially implements SEP-2243.

Behavior Changes

SetError Behavior Change

Previously the SetError method on CallToolResult always overwrote the Content field with the error text. Now SetError preserves the existing value if it has already been populated. You can restore the previous behavior by setting the environment variable seterroroverwrite=1.

  • mcp: preserve existing Content in SetError by @ravyg in #864

Cross-Origin Protection Default Change

Previously (v1.4.1-v1.5.0) default (zero-value) cross-origin protection was applied when CrossOriginProtection in StreamableHTTPOptions was nil. Now cross-origin protection is not enabled by default when CrossOriginProtection is nil.
You can restore the previous behavior (enable by default) by setting enableoriginverification=1.

disablecrossoriginprotection was replaced by enableoriginverification after the default was changed to not enable cross-origin protection.

jsonescaping option was removed, according to plan.

Other Changes to the SDK

New Contributors

Full Changelog: v1.5.0...v1.6.0-pre.1

Contributors

rafaeljusto, begelundmuller, and 10 other contributors
Loading

v1.5.0

v1.5.0

Choose a tag to compare

View all tags
@maciej-kisiel maciej-kisiel released this 07 Apr 13:15
v1.5.0
This tag was signed with the committer’s verified signature.
maciej-kisiel Maciej Kisiel
SSH Key Fingerprint: KqPZd4n3AN05jyvoqCVz5TeysdqkO8uI2QcsGsy9Nvk
Verified
Learn about vigilant mode.
d3fd25b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release is equivalent to v1.5.0-pre.1. Thank you to those who tested the pre-release.

In this release we introduce important enhancements to the client-side OAuth flows. We also introduce several smaller fixes and improvements.

Stabilization of client-side OAuth APIs

As previously communicated, we're stabilizing the client-side OAuth APIs in v1.5.0. This means that the mcp_go_client_oauth build tag will no longer be required to compile the functionality and standard backward compatibility guarantees apply from now on.

Compared to the experimental support published in v1.4.0, we made some backwards incompatible changes:

  • auth.AuthorizationCodeHandlerConfig.AuthorizationCodeFetcher's type was changed from func(context.Context, *auth.AuthorizationArgs) (*auth.AuthorizationResult, error) to auth.AuthorizationCodeFetcher which is a reusable definition carrying the same underlying function type.
  • auth.AuthorizationCodeHandlerConfig.PreregisteredClientConfig was removed and replaced with auth.AuthorizationCodeHandlerConfig.PreregisteredClient which uses a newly introduced oauthex.ClientCredentials type. The type used previously (auth.PreregisteredClientConfig) has been removed.
  • Deprecated functionality has been removed from both auth and oauthex packages.

Enterprise Managed Authorization support added

Support for Enterprise Managed Authorization has been added to auth/extauth package. Huge thanks to @radar07 for the implementation!

Note: this support is part of an official MCP extension and is not part of the core protocol. The support of this functionality is not covered by the principles defined in SDK tiers.

Other changes to the SDK

New Contributors

Full Changelog: v1.4.1...v1.5.0

Contributors

toofishes, ravyg, and 8 other contributors
Loading

v1.5.0-pre.1

v1.5.0-pre.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@maciej-kisiel maciej-kisiel released this 31 Mar 11:45
v1.5.0-pre.1
This tag was signed with the committer’s verified signature.
maciej-kisiel Maciej Kisiel
SSH Key Fingerprint: KqPZd4n3AN05jyvoqCVz5TeysdqkO8uI2QcsGsy9Nvk
Verified
Learn about vigilant mode.
d3fd25b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

In this release we introduce important enhancements to the client-side OAuth flows. We also introduce several smaller fixes and improvements.

Stabilization of client-side OAuth APIs

As previously communicated, we're stabilizing the client-side OAuth APIs in v1.5.0. This means that the mcp_go_client_oauth build tag will no longer be required to compile the functionality and standard backward compatibility guarantees apply from now on.

Compared to the experimental support published in v1.4.0, we made some backwards incompatible changes:

  • auth.AuthorizationCodeHandlerConfig.AuthorizationCodeFetcher's type was changed from func(context.Context, *auth.AuthorizationArgs) (*auth.AuthorizationResult, error) to auth.AuthorizationCodeFetcher which is a reusable definition carrying the same underlying function type.
  • auth.AuthorizationCodeHandlerConfig.PreregisteredClientConfig was removed and replaced with auth.AuthorizationCodeHandlerConfig.PreregisteredClient which uses a newly introduced oauthex.ClientCredentials type. The type used previously (auth.PreregisteredClientConfig) has been removed.
  • Deprecated functionality has been removed from both auth and oauthex packages.

Enterprise Managed Authorization support added

Support for Enterprise Managed Authorization has been added to auth/extauth package. Huge thanks to @radar07 for the implementation!

Note: this support is part of an official MCP extension and is not part of the core protocol. The support of this functionality is not covered by the principles defined in SDK tiers.

Other changes to the SDK

New Contributors

Full Changelog: v1.4.1...v1.5.0-pre.1

Contributors

toofishes, ravyg, and 8 other contributors
Loading

v1.4.1

v1.4.1

Choose a tag to compare

View all tags
@maciej-kisiel maciej-kisiel released this 13 Mar 11:04
v1.4.1
This tag was signed with the committer’s verified signature.
maciej-kisiel Maciej Kisiel
SSH Key Fingerprint: KqPZd4n3AN05jyvoqCVz5TeysdqkO8uI2QcsGsy9Nvk
Verified
Learn about vigilant mode.
580f2a0
This commit was signed with the committer’s verified signature.
maciej-kisiel Maciej Kisiel
SSH Key Fingerprint: KqPZd4n3AN05jyvoqCVz5TeysdqkO8uI2QcsGsy9Nvk
Verified
Learn about vigilant mode.

This release is a patch release for v1.4.0.

It contains cherry-picks for several security improvements. Security advisories will follow.

Fixes

Update of the segmentio/encoding module version

The JSON parsing library that was adopted to avoid attacks taking advantage of the Go's standard parser being case insensitive turned out to contain an issue itself. We have submitted the fix upstream and this release updates the dependency to the patched version.

Cross-origin requests protection

We have added additional protection against cross origin requests. From now on, we verify that Content-Type for JSON-RPC POST requests is set to application/json and use the new http.CrossOriginProtection functionality to verify the origin of the request. Usage of this functionality required increasing the required Go version to 1.25, which is in line with our Go version policy of supporting two newest Go versions. The behavior can be customized by passing a configured http.CrossOriginProtection object to StreamableHTTPOptions.

Since this is a behavior change, we introduced a compatibility parameter disablecrossoriginprotection that will allow to temporarily disable it. It will be removed in v1.6.0 version of the SDK. See here for more details about behavior changes and a history of compatibility parameters across SDK versions.

Allowing customization of http.Client for client-side OAuth

We have introduced an optional http.Client parameter to AuthorizationCodeHandlerConfig. This allows customization of the transport, for example implementing environment specific protection against Server-Side Request Forgery.

Pull requests

Full Changelog: v1.4.0...v1.4.1

Contributors

maciej-kisiel
Loading