[go-fan] Go Module Review: github.com/modelcontextprotocol/go-sdk #15940

🐹 Go Fan Report: modelcontextprotocol/go-sdk

Module Overview

Official Go SDK for the Model Context Protocol (client, server, transports, auth).

Current Usage in gh-aw

• Files: 66 Go files (~33 in internal/server, 11 in internal/mcp, 10 in internal/middleware, 8 in testutil/mcptest, 4 integration, 1 launcher)
• Key APIs: StreamableClientTransport, CommandTransport, StreamableHTTPHandler/StreamableHTTPOptions, ServerOptions.SupportedProtocolVersions, MaxEventSize, Server.AddTool (validation bypass).

Research Findings

Pinned v1.8.0 is the latest release (published 2026-09-14). go list -m -u could not be run in this sandbox (permission denied), so the "no tagged update" conclusion comes from the GitHub releases API.

Recent Updates (v1.8.0)

• Resource-exhaustion hardening: JSON nesting limit, MaxEventSize on SSE/streamable clients, StdioTransport.MaxLineLength.
• ServerOptions.SupportedProtocolVersions and ServerOptions.SetCacheable (per-result ttlMs/cacheScope).
• Stateful handler returns a JSON-RPC -32022 error for 2026-07-28 requests. MCPGODEBUG flags plaintextstatefulrejection and blockingcancelnotify will be removed in v1.9.0.
• Leak, deadlock and teardown fixes (Client.Connect, ServerSession, streamable Close DELETE).

Improvement Opportunities

🏃 Quick Wins

• The project already adopts MaxEventSize (16 MiB) and SupportedProtocolVersions. Nothing urgent.
• Confirm no MCPGODEBUG flags are set anywhere (they disappear in v1.9.0).

✨ Feature Opportunities

• Evaluate ServerOptions.SetCacheable so the gateway sets explicit cacheScope (e.g. non-public for DIFC-filtered list/read results) rather than the default public. This is potentially security-relevant for a filtering proxy.
• Check whether CommandTransport in internal/mcp/connection.go can bound frame size (MaxLineLength equivalent) for stdio backends.

📐 Best Practice Alignment

• Keep tracking upstream for a supported argument-validation bypass (tool_registry_helpers.go).

🔧 General Improvements

• Before v1.9.x, review the removed MCPGODEBUG flags and the async cancel-notification behavior against launcher shutdown tests.

Module Summary

References

• https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0

Recommendations

1. Stay on v1.8.0. Before any upgrade, run go test ./internal/mcp/ -run TestMaxRetriesSentinelCanary -v and go test ./internal/server/ -run TestArgumentValidationBypassCanary -v.
2. Evaluate SetCacheable for secrecy-aware cache scopes.

Next Steps

Open a follow-up to investigate SetCacheable and stdio frame limits.

Generated by Go Fan. Cache-memory was not readable in this run, so round-robin state was not used. The SDK was picked per the mandated check.

References: §41790439688

Generated by Go Fan · copilot · auto · ~24 AIC · ⊞ 6.2K · ◷

• expires on Nov 11, 2026, 7:14 AM UTC