v1.4.0

GoMCP v1.4.0

Bug Fixes

• _tool_name invisible to middleware — OpenTelemetry spans were mcp.tool.unknown, Prometheus metrics had empty tool labels. Fixed by setting _tool_name before the middleware chain fires.
• Session leak in stdio mode — every tool call created a new session object. 30s sustained load: 2MB → 227MB. Fixed: reuse a single default session when no Mcp-Session-Id header is present.
• Redundant JSON unmarshal — handleToolsCall parsed params twice per call. Eliminated.
• Path traversal, empty content, marshal errors (round-4 review)
• API key scrub bypass, group tool race, inspector XSS (round-3 review)
• Adapter: URL-escape path params, gRPC discovery, rate-limit clock
• Schema: nested/array validation + concurrent race + map type

Performance

• Tool call: 12µs → 9µs, 66 → 53 allocs (-20%), 46k calls/s
• Memory: stable at 1.06x growth over 30s sustained load

New

• examples/grpc-adapter/ — official gRPC adapter example (no protoc needed)
• benchmark_test.go — 4 hot-path benchmarks
• soak_test.go — memory stability assertion
• transport/sse_endurance_test.go — 10s sustained SSE test
• docs/cookbook/ — 3 step-by-step guides
• CI: Windows matrix + release-please (manual trigger)

Docs

• Auth middleware error shape clarified (isError result, not JSON-RPC error)
• Provider version field renames tool to name@version
• Cookbook links added to README

Full Changelog: v1.3.0...v1.4.0