[go-fan] Go Module Review: modelcontextprotocol/go-sdk

Geschlossen Anfängerfreundlich
  • Stimmt etwas nicht?
#73,148 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
68/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
go
Bereich
cli

Rechercherichtung

Beginne in pkg/cli/mcp_inspect_mcp.go und prüfe, wie CommandTransport und StreamableClientTransport konfiguriert werden. Lege Eingabegrenzen mit den Optionen MaxLineLength und MaxEventSize des SDK fest und prüfe anschließend die relevanten Transporttests oder führe die Inspector-Tests aus. Als abgeschlossen gilt die Aufgabe, wenn beide Pfade begrenzt sind, sodass übergroße Servereingaben den Speicher des Inspectors nicht unbegrenzt anwachsen lassen können.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

automation cookie
🐹 Go Fan Report: modelcontextprotocol/go-sdk

Module overview: go-sdk is the official Go SDK for the Model Context Protocol — server primitives (mcp.NewServer, mcp.AddTool), client primitives (mcp.NewClient), and transports (stdio, command, in-memory, streamable HTTP). It is the backbone of gh-aws gh aw mcp server and the mcp inspect subcommand.

Selection: picked via round-robin with priority for recent activity — pushed_at 2026-10-29 was the most recent among eligible direct dependencies, and this module last reviewed 2026-10-22 (8 days ago, outside the 7-day cooldown).

Current usage in gh-aw
  • Files: 17 non-test .go files (plus matching _test.go files), all under pkg/cli/ and pkg/parser/mcp.go
  • Subpackages imported: mcp, jsonrpc only — no auth/oauthex (the server has no OAuth surface)
  • Key APIs used: mcp.NewServer/mcp.NewClient, mcp.AddTool, ServerOptions.SupportedProtocolVersions, ServerOptions.SetCacheable, mcp.StdioTransport, mcp.NewStreamableHTTPHandler, mcp.CommandTransport, mcp.StreamableClientTransport, AddReceivingMiddleware, mcp.ToolAnnotations

go.mod is pinned to v1.8.0, the current latest release (was v1.7.0 at the last review on 2026-08-18).

Research findings
Recent updates (v1.8.0, 2026-09-14)

No new protocol revision — it is a hardening/fix release on top of v1.7.0:

  • JSON decoding now rejects >1000 levels of nesting before parsing
  • New MaxEventSize on SSEClientTransport/StreamableClientTransport, and MaxLineLength on StdioTransport, to bound buffered input
  • OAuth dynamic-client-registration responses capped at 1 MB
  • ServerOptions.SupportedProtocolVersions — lets a server narrow (never widen) its advertised protocol set
  • ServerOptions.SetCacheable — per-request hook for ttlMs/cacheScope on list and discover results
  • Session-leak, deadlock, and teardown-hang fixes for ServerSession/Client.Connect
  • Two new MCPGODEBUG escape hatches (plaintextstatefulrejection, blockingcancelnotify), both slated for removal in v1.9.0 — not needed by gh-aw
Best practices (from maintainers / release notes)
  • Bare bool for ReadOnlyHint/IdempotentHint is now always serialized by default (the old omitempty behavior needs an explicit hintomitempty=1 opt-out) — gh-aw already does this correctly everywhere annotations are set.
  • Stay stateful if session affinity across calls is required; Stateless = true opts into the 2026-07-28 revision but drops that affinity.
Best practices already observed in gh-aw (click to expand)
  • mcp_server.go documents that schema caching is automatic since go-sdk v1.3.0.
  • mcp_server_http.go has an explicit comment on why Stateless is left false: the long-running logs/audit tools rely on session affinity for progress notifications, and staying stateful still lets the SDK negotiate down to 2025-11-25.
  • mcp_server_http.go binds to loopback only as defense in depth alongside the SDKs own Host-header check, noting the SDK dropped default cross-origin protection in v1.6.0.
  • mcp_inspect_mcp.go sets DisableStandaloneSSE: true on the inspectors StreamableClientTransport since it only queries capabilities once.
  • gh-aw already adopts v1.8.0s SetCacheable (60s private TTL on ListToolsRequest/discover responses) and v1.7.0s SupportedProtocolVersions — ahead of the curve rather than lagging.
Improvement opportunities
🏃 Quick wins
  1. Bound the mcp inspect client transports against hostile/misbehaving servers. mcp inspect (pkg/cli/mcp_inspect_mcp.go) connects to arbitrary user-configured MCP servers over both CommandTransport (stdio) and StreamableClientTransport (HTTP) — exactly the scenario v1.8.0s new MaxLineLength/MaxEventSize caps were built for. Neither is set today, so an inspected server that emits one giant unterminated line or a huge SSE event can grow the inspector processs memory unbounded. Setting conservative caps (e.g. a few MB) on both transport structs is a small, targeted change.
✨ Feature opportunities
  1. Stateless HTTP mode (StreamableHTTPOptions.Stateless = true) would opt into the 2026-07-28 revision, but the 2-hour SessionTimeout exists specifically for session affinity on long-running logs/audit calls — staying stateful remains the right call for now; just worth re-checking as more MCP clients default to the new revision.
  2. Extending SetCacheable beyond tool lists — resources/read and the other list methods also carry ttlMs/cacheScope hooks as of v1.8.0, but gh-aw does not register any resources today, so this is a non-issue until it does.
  3. x-mcp-header passthrough (SEP-2243) for logs/audit tool params — only relevant if the HTTP server is ever placed behind a reverse proxy; it is loopback-only today.
📏 Best practice alignment
  • Tool annotations already use the v1.8.0-aligned bare-bool convention.
  • Deliberate avoidance of premature schema defaults (documented in-code for the timeout param).
  • In-code comments tracking SDK version-specific behavior — a pattern worth continuing as the SDK keeps shipping MCPGODEBUG-guarded behavior changes.
🔧 General improvements
  • No redundant or legacy-pattern usage found; no MCPGODEBUG opt-outs are needed anywhere in the codebase.
Recommendations
  1. Add MaxLineLength to the mcp inspect stdio path and MaxEventSize to its StreamableClientTransport — the one place gh-aw talks to untrusted/arbitrary MCP servers.
  2. No other action needed this cycle — the module is pinned to the latest release and usage already adopts opt-in hardening/caching features rather than lagging behind.
  3. Keep the Stateless HTTP mode decision on the radar as stateless-client adoption grows in the MCP ecosystem.
Next steps
  • Consider a small follow-up PR adding MaxLineLength/MaxEventSize bounds to mcp inspects client transports
  • Re-review after v1.9.0 ships (removes the two new MCPGODEBUG escape hatches)

Generated by Go Fan — run §41023228742
Module summary saved to: scratchpad/mods/go-sdk.md

Generated by 🐹 Go Fan · claude · agent · ~125 AIC · ⌖ ~1 AIC · ⊞ 4.4K · ◷

  • expires on Oct 31, 2026, 12:08 AM UTC-08:00
Vorherrschende Sprache
Go
Sterne
5.5k
Forks
606
Ø Merge
4 Std. 36 Min.
Gemergte PRs (30 T.)
799

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus github/gh-aw

Alle Issues in github/gh-aw

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.