Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[go-fan] Go Module Review: modelcontextprotocol/go-sdk

Abierto Apto para principiantes
  • ¿Algo no está bien?
#73,148 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
cli

Línea de trabajo

Empieza en pkg/cli/mcp_inspect_mcp.go e inspecciona cómo se configuran CommandTransport y StreamableClientTransport. Establece límites de entrada mediante las opciones MaxLineLength y MaxEventSize del SDK y luego revisa las pruebas de transporte pertinentes o ejecuta las pruebas del inspector. Se considera terminado cuando ambos caminos tienen límites para que una entrada del servidor demasiado grande no pueda hacer crecer sin límite la memoria del inspector.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

automation cookie
🐹 Go Fan Report: modelcontextprotocol/go-sdk

Module overview: go-sdk is the official Go SDK for the Model Context Protocol — server primitives (mcp.NewServer, mcp.AddTool), client primitives (mcp.NewClient), and transports (stdio, command, in-memory, streamable HTTP). It is the backbone of gh-aws gh aw mcp server and the mcp inspect subcommand.

Selection: picked via round-robin with priority for recent activity — pushed_at 2026-10-29 was the most recent among eligible direct dependencies, and this module last reviewed 2026-10-22 (8 days ago, outside the 7-day cooldown).

Current usage in gh-aw
  • Files: 17 non-test .go files (plus matching _test.go files), all under pkg/cli/ and pkg/parser/mcp.go
  • Subpackages imported: mcp, jsonrpc only — no auth/oauthex (the server has no OAuth surface)
  • Key APIs used: mcp.NewServer/mcp.NewClient, mcp.AddTool, ServerOptions.SupportedProtocolVersions, ServerOptions.SetCacheable, mcp.StdioTransport, mcp.NewStreamableHTTPHandler, mcp.CommandTransport, mcp.StreamableClientTransport, AddReceivingMiddleware, mcp.ToolAnnotations

go.mod is pinned to v1.8.0, the current latest release (was v1.7.0 at the last review on 2026-08-18).

Research findings
Recent updates (v1.8.0, 2026-09-14)

No new protocol revision — it is a hardening/fix release on top of v1.7.0:

  • JSON decoding now rejects >1000 levels of nesting before parsing
  • New MaxEventSize on SSEClientTransport/StreamableClientTransport, and MaxLineLength on StdioTransport, to bound buffered input
  • OAuth dynamic-client-registration responses capped at 1 MB
  • ServerOptions.SupportedProtocolVersions — lets a server narrow (never widen) its advertised protocol set
  • ServerOptions.SetCacheable — per-request hook for ttlMs/cacheScope on list and discover results
  • Session-leak, deadlock, and teardown-hang fixes for ServerSession/Client.Connect
  • Two new MCPGODEBUG escape hatches (plaintextstatefulrejection, blockingcancelnotify), both slated for removal in v1.9.0 — not needed by gh-aw
Best practices (from maintainers / release notes)
  • Bare bool for ReadOnlyHint/IdempotentHint is now always serialized by default (the old omitempty behavior needs an explicit hintomitempty=1 opt-out) — gh-aw already does this correctly everywhere annotations are set.
  • Stay stateful if session affinity across calls is required; Stateless = true opts into the 2026-07-28 revision but drops that affinity.
Best practices already observed in gh-aw (click to expand)
  • mcp_server.go documents that schema caching is automatic since go-sdk v1.3.0.
  • mcp_server_http.go has an explicit comment on why Stateless is left false: the long-running logs/audit tools rely on session affinity for progress notifications, and staying stateful still lets the SDK negotiate down to 2025-11-25.
  • mcp_server_http.go binds to loopback only as defense in depth alongside the SDKs own Host-header check, noting the SDK dropped default cross-origin protection in v1.6.0.
  • mcp_inspect_mcp.go sets DisableStandaloneSSE: true on the inspectors StreamableClientTransport since it only queries capabilities once.
  • gh-aw already adopts v1.8.0s SetCacheable (60s private TTL on ListToolsRequest/discover responses) and v1.7.0s SupportedProtocolVersions — ahead of the curve rather than lagging.
Improvement opportunities
🏃 Quick wins
  1. Bound the mcp inspect client transports against hostile/misbehaving servers. mcp inspect (pkg/cli/mcp_inspect_mcp.go) connects to arbitrary user-configured MCP servers over both CommandTransport (stdio) and StreamableClientTransport (HTTP) — exactly the scenario v1.8.0s new MaxLineLength/MaxEventSize caps were built for. Neither is set today, so an inspected server that emits one giant unterminated line or a huge SSE event can grow the inspector processs memory unbounded. Setting conservative caps (e.g. a few MB) on both transport structs is a small, targeted change.
✨ Feature opportunities
  1. Stateless HTTP mode (StreamableHTTPOptions.Stateless = true) would opt into the 2026-07-28 revision, but the 2-hour SessionTimeout exists specifically for session affinity on long-running logs/audit calls — staying stateful remains the right call for now; just worth re-checking as more MCP clients default to the new revision.
  2. Extending SetCacheable beyond tool lists — resources/read and the other list methods also carry ttlMs/cacheScope hooks as of v1.8.0, but gh-aw does not register any resources today, so this is a non-issue until it does.
  3. x-mcp-header passthrough (SEP-2243) for logs/audit tool params — only relevant if the HTTP server is ever placed behind a reverse proxy; it is loopback-only today.
📏 Best practice alignment
  • Tool annotations already use the v1.8.0-aligned bare-bool convention.
  • Deliberate avoidance of premature schema defaults (documented in-code for the timeout param).
  • In-code comments tracking SDK version-specific behavior — a pattern worth continuing as the SDK keeps shipping MCPGODEBUG-guarded behavior changes.
🔧 General improvements
  • No redundant or legacy-pattern usage found; no MCPGODEBUG opt-outs are needed anywhere in the codebase.
Recommendations
  1. Add MaxLineLength to the mcp inspect stdio path and MaxEventSize to its StreamableClientTransport — the one place gh-aw talks to untrusted/arbitrary MCP servers.
  2. No other action needed this cycle — the module is pinned to the latest release and usage already adopts opt-in hardening/caching features rather than lagging behind.
  3. Keep the Stateless HTTP mode decision on the radar as stateless-client adoption grows in the MCP ecosystem.
Next steps
  • Consider a small follow-up PR adding MaxLineLength/MaxEventSize bounds to mcp inspects client transports
  • Re-review after v1.9.0 ships (removes the two new MCPGODEBUG escape hatches)

Generated by Go Fan — run §41023228742
Module summary saved to: scratchpad/mods/go-sdk.md

Generated by 🐹 Go Fan · claude · agent · ~125 AIC · ⌖ ~1 AIC · ⊞ 4.4K · ◷

  • expires on Oct 31, 2026, 12:08 AM UTC-08:00
Lenguaje dominante
Go
Estrellas
5.5k
Forks
606
Merge medio
4 h 35 min
PR fusionados (30 d)
807

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/gh-aw

Todos los issues de github/gh-aw

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.