Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[go-fan] Go Module Review: modelcontextprotocol/go-sdk

Aperta Adatta ai principianti
  • Qualcosa non va?
#73,148 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli

Direzione di ricerca

Inizia da pkg/cli/mcp_inspect_mcp.go e controlla come vengono configurati CommandTransport e StreamableClientTransport. Imposta i limiti di input usando le opzioni MaxLineLength e MaxEventSize dell’SDK, quindi controlla i test di trasporto pertinenti oppure esegui i test dell’inspector. Il lavoro è completato quando entrambi i percorsi hanno dei limiti, così che un input del server troppo grande non possa far crescere senza limiti la memoria dell’inspector.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

automation cookie
🐹 Go Fan Report: modelcontextprotocol/go-sdk

Module overview: go-sdk is the official Go SDK for the Model Context Protocol — server primitives (mcp.NewServer, mcp.AddTool), client primitives (mcp.NewClient), and transports (stdio, command, in-memory, streamable HTTP). It is the backbone of gh-aws gh aw mcp server and the mcp inspect subcommand.

Selection: picked via round-robin with priority for recent activity — pushed_at 2026-10-29 was the most recent among eligible direct dependencies, and this module last reviewed 2026-10-22 (8 days ago, outside the 7-day cooldown).

Current usage in gh-aw
  • Files: 17 non-test .go files (plus matching _test.go files), all under pkg/cli/ and pkg/parser/mcp.go
  • Subpackages imported: mcp, jsonrpc only — no auth/oauthex (the server has no OAuth surface)
  • Key APIs used: mcp.NewServer/mcp.NewClient, mcp.AddTool, ServerOptions.SupportedProtocolVersions, ServerOptions.SetCacheable, mcp.StdioTransport, mcp.NewStreamableHTTPHandler, mcp.CommandTransport, mcp.StreamableClientTransport, AddReceivingMiddleware, mcp.ToolAnnotations

go.mod is pinned to v1.8.0, the current latest release (was v1.7.0 at the last review on 2026-08-18).

Research findings
Recent updates (v1.8.0, 2026-09-14)

No new protocol revision — it is a hardening/fix release on top of v1.7.0:

  • JSON decoding now rejects >1000 levels of nesting before parsing
  • New MaxEventSize on SSEClientTransport/StreamableClientTransport, and MaxLineLength on StdioTransport, to bound buffered input
  • OAuth dynamic-client-registration responses capped at 1 MB
  • ServerOptions.SupportedProtocolVersions — lets a server narrow (never widen) its advertised protocol set
  • ServerOptions.SetCacheable — per-request hook for ttlMs/cacheScope on list and discover results
  • Session-leak, deadlock, and teardown-hang fixes for ServerSession/Client.Connect
  • Two new MCPGODEBUG escape hatches (plaintextstatefulrejection, blockingcancelnotify), both slated for removal in v1.9.0 — not needed by gh-aw
Best practices (from maintainers / release notes)
  • Bare bool for ReadOnlyHint/IdempotentHint is now always serialized by default (the old omitempty behavior needs an explicit hintomitempty=1 opt-out) — gh-aw already does this correctly everywhere annotations are set.
  • Stay stateful if session affinity across calls is required; Stateless = true opts into the 2026-07-28 revision but drops that affinity.
Best practices already observed in gh-aw (click to expand)
  • mcp_server.go documents that schema caching is automatic since go-sdk v1.3.0.
  • mcp_server_http.go has an explicit comment on why Stateless is left false: the long-running logs/audit tools rely on session affinity for progress notifications, and staying stateful still lets the SDK negotiate down to 2025-11-25.
  • mcp_server_http.go binds to loopback only as defense in depth alongside the SDKs own Host-header check, noting the SDK dropped default cross-origin protection in v1.6.0.
  • mcp_inspect_mcp.go sets DisableStandaloneSSE: true on the inspectors StreamableClientTransport since it only queries capabilities once.
  • gh-aw already adopts v1.8.0s SetCacheable (60s private TTL on ListToolsRequest/discover responses) and v1.7.0s SupportedProtocolVersions — ahead of the curve rather than lagging.
Improvement opportunities
🏃 Quick wins
  1. Bound the mcp inspect client transports against hostile/misbehaving servers. mcp inspect (pkg/cli/mcp_inspect_mcp.go) connects to arbitrary user-configured MCP servers over both CommandTransport (stdio) and StreamableClientTransport (HTTP) — exactly the scenario v1.8.0s new MaxLineLength/MaxEventSize caps were built for. Neither is set today, so an inspected server that emits one giant unterminated line or a huge SSE event can grow the inspector processs memory unbounded. Setting conservative caps (e.g. a few MB) on both transport structs is a small, targeted change.
✨ Feature opportunities
  1. Stateless HTTP mode (StreamableHTTPOptions.Stateless = true) would opt into the 2026-07-28 revision, but the 2-hour SessionTimeout exists specifically for session affinity on long-running logs/audit calls — staying stateful remains the right call for now; just worth re-checking as more MCP clients default to the new revision.
  2. Extending SetCacheable beyond tool lists — resources/read and the other list methods also carry ttlMs/cacheScope hooks as of v1.8.0, but gh-aw does not register any resources today, so this is a non-issue until it does.
  3. x-mcp-header passthrough (SEP-2243) for logs/audit tool params — only relevant if the HTTP server is ever placed behind a reverse proxy; it is loopback-only today.
📏 Best practice alignment
  • Tool annotations already use the v1.8.0-aligned bare-bool convention.
  • Deliberate avoidance of premature schema defaults (documented in-code for the timeout param).
  • In-code comments tracking SDK version-specific behavior — a pattern worth continuing as the SDK keeps shipping MCPGODEBUG-guarded behavior changes.
🔧 General improvements
  • No redundant or legacy-pattern usage found; no MCPGODEBUG opt-outs are needed anywhere in the codebase.
Recommendations
  1. Add MaxLineLength to the mcp inspect stdio path and MaxEventSize to its StreamableClientTransport — the one place gh-aw talks to untrusted/arbitrary MCP servers.
  2. No other action needed this cycle — the module is pinned to the latest release and usage already adopts opt-in hardening/caching features rather than lagging behind.
  3. Keep the Stateless HTTP mode decision on the radar as stateless-client adoption grows in the MCP ecosystem.
Next steps
  • Consider a small follow-up PR adding MaxLineLength/MaxEventSize bounds to mcp inspects client transports
  • Re-review after v1.9.0 ships (removes the two new MCPGODEBUG escape hatches)

Generated by Go Fan — run §41023228742
Module summary saved to: scratchpad/mods/go-sdk.md

Generated by 🐹 Go Fan · claude · agent · ~125 AIC · ⌖ ~1 AIC · ⊞ 4.4K · ◷

  • expires on Oct 31, 2026, 12:08 AM UTC-08:00
Lingua principale
Go
Stelle
5.5k
Fork
606
Merge medio
4h 35m
PR unite (30g)
807

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-aw

Tutte le issue di github/gh-aw

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.