modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

mcp: add MCPGPDEBUG for opt-in Content-Type check (#972)

Browse source 
Fixes #957
This commit is contained in:
Guglielmo Colombo 2026-05-22 13:30:38 +02:00 • committed by GitHub
commit d454bbaf06
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 26 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/mcpgodebug.md
View file

@ -18,6 +18,15 @@
## `MCPGODEBUG` history
### 1.6.1
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `disablecontenttypecheck` added. If set to `1`, Content-Type validation on
HTTP POST requests will be disabled, allowing requests with non-JSON or missing
Content-Type headers. The default behavior is to validate that HTTP POST
requests have Content-Type: application/json.
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.

9
internal/docs/mcpgodebug.src.md
View file

@ -17,6 +17,15 @@
## `MCPGODEBUG` history
### 1.6.1
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `disablecontenttypecheck` added. If set to `1`, Content-Type validation on
HTTP POST requests will be disabled, allowing requests with non-JSON or missing
Content-Type headers. The default behavior is to validate that HTTP POST
requests have Content-Type: application/json.
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.

2
mcp/sse.go
View file

@ -202,7 +202,7 @@ func (h *SSEHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
}
// Validate 'Content-Type' header.
if req.Method == http.MethodPost {
if disablecontenttypecheck != "1" && req.Method == http.MethodPost {
mediaType, _, err := mime.ParseMediaType(req.Header.Get("Content-Type"))
if err != nil || mediaType != "application/json" {
http.Error(w, "Content-Type must be 'application/json'", http.StatusUnsupportedMediaType)

8
mcp/streamable.go
View file

@ -246,6 +246,12 @@ var disablelocalhostprotection = mcpgodebug.Value("disablelocalhostprotection")
// The option will be removed in the 1.8.0 version of the SDK.
var enableoriginverification = mcpgodebug.Value("enableoriginverification")
// disablecontenttypecheck is a compatibility parameter that allows to disable
// Content-Type validation on POST requests.
// See the documentation for the mcpgodebug package for instructions how to enable it.
// The option will be removed in the 1.8.0 version of the SDK.
var disablecontenttypecheck = mcpgodebug.Value("disablecontenttypecheck")
func (h *StreamableHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
// DNS rebinding protection: auto-enabled for localhost servers.
// See: https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices#local-mcp-server-compromise
@ -267,7 +273,7 @@ func (h *StreamableHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Reque
}
// Validate 'Content-Type' header.
if req.Method == http.MethodPost && baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
if disablecontenttypecheck != "1" && req.Method == http.MethodPost && baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
http.Error(w, "Content-Type must be 'application/json'", http.StatusUnsupportedMediaType)
return
}