modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

MCPGODEBUG update for 1.6.0 (#893)

Browse source
This commit is contained in:
Maciej Kisiel 2026-04-30 09:54:32 +02:00 • committed by GitHub
commit f5f2015413
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 57 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/mcpgodebug.md
View file

@ -18,13 +18,39 @@
## `MCPGODEBUG` history
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite
`Content` with the error text, restoring the previous behavior. The default
behavior was changed to preserve existing `Content` if it has already been
populated.
- `enableoriginverification` added. If set to `1`, default (zero-value)
cross-origin protection will be applied when
`StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the
behavior from v1.4.1-v1.5.0. The default behavior was changed to not
enable cross-origin protection.
- `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now
also used in the SSE transport.
Options below were removed:
- `jsonescaping`, according to plan,
- `disablecrossoriginprotection`, it was replaced by
`enableoriginverification` after the default was changed to not enable
cross-origin protection.
### 1.4.1
Options listed below will be removed in the 1.6.0 version of the SDK.
- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
protection will be disabled. The default behavior was changed to enable
cross-origin protection. **Removal of this option was postponed until 1.7.0.**
cross-origin protection.
### 1.4.0
@ -39,4 +65,4 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
protection. The protection can also be disabled by setting the
`DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
`SSEOptions` struct to `true`, which is the recommended way to disable
the protection long term. **Removal of this option was postponed until 1.7.0.**
the protection long term. **Removal of this option was postponed until 1.8.0.**

30
internal/docs/mcpgodebug.src.md
View file

@ -17,13 +17,39 @@
## `MCPGODEBUG` history
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite
`Content` with the error text, restoring the previous behavior. The default
behavior was changed to preserve existing `Content` if it has already been
populated.
- `enableoriginverification` added. If set to `1`, default (zero-value)
cross-origin protection will be applied when
`StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the
behavior from v1.4.1-v1.5.0. The default behavior was changed to not
enable cross-origin protection.
- `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now
also used in the SSE transport.
Options below were removed:
- `jsonescaping`, according to plan,
- `disablecrossoriginprotection`, it was replaced by
`enableoriginverification` after the default was changed to not enable
cross-origin protection.
### 1.4.1
Options listed below will be removed in the 1.6.0 version of the SDK.
- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
protection will be disabled. The default behavior was changed to enable
cross-origin protection. **Removal of this option was postponed until 1.7.0.**
cross-origin protection.
### 1.4.0
@ -38,4 +64,4 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
protection. The protection can also be disabled by setting the
`DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
`SSEOptions` struct to `true`, which is the recommended way to disable
the protection long term. **Removal of this option was postponed until 1.7.0.**
the protection long term. **Removal of this option was postponed until 1.8.0.**

12
internal/jsonrpc2/messages.go
View file

@ -11,8 +11,6 @@ import (
"fmt"
internaljson "github.com/modelcontextprotocol/go-sdk/internal/json"
"github.com/modelcontextprotocol/go-sdk/internal/mcpgodebug"
)
// ID is a Request identifier, which is defined by the spec to be a string, integer, or null.
@ -219,18 +217,8 @@ func marshalToRaw(obj any) (json.RawMessage, error) {
return json.RawMessage(data), nil
}
// jsonescaping is a compatibility parameter that allows to restore
// JSON escaping in the JSON marshaling, which stopped being the default
// in the 1.4.0 version of the SDK. See the documentation for the
// mcpgodebug package for instructions how to enable it.
// The option will be removed in the 1.6.0 version of the SDK.
var jsonescaping = mcpgodebug.Value("jsonescaping")
// jsonMarshal marshals obj to JSON like json.Marshal but without HTML escaping.
func jsonMarshal(obj any) ([]byte, error) {
if jsonescaping == "1" {
return json.Marshal(obj)
}
var buf bytes.Buffer
enc := json.NewEncoder(&buf)
enc.SetEscapeHTML(false)

2
mcp/streamable.go
View file

@ -235,7 +235,7 @@ func (h *StreamableHTTPHandler) closeAll() {
// disablelocalhostprotection is a compatibility parameter that allows to disable
// DNS rebinding protection, which was added in the 1.4.0 version of the SDK.
// See the documentation for the mcpgodebug package for instructions how to enable it.
// The option will be removed in the 1.6.0 version of the SDK.
// The option will be removed in the 1.8.0 version of the SDK.
var disablelocalhostprotection = mcpgodebug.Value("disablelocalhostprotection")
// enableoriginverification is a compatibility parameter that restores the