modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
543 commits 1 branch 33 tags 5.3 MiB
Commit graph go-sdk/go.mod
Author SHA1 Message Date
Sam Thanawalla
069aae16df
 		mcp: add client-side OAuth flow (#544) 
This is a preliminary implementation of OAuth 2.1 for the client.

When a StreamableClientTransport encounters a 401 Unauthorized response
from the server, it initiates the OAuth flow described in thec
authorization section of the MCP spec

(https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization).
On success, the transport obtains an access token which it passes
to all subsequent requests.

Much remains to be done here:

* Resource Indicators, as described in section 2.5.1 of the MCP spec.

* All of this is unexported, so it is available only to our own
StreamingClientTransport. We should add API so people can use it
with their own transports.

* And, of course, tests. We should test against fake implementations
but also, if we can find any, real reference implementations.

For #19
Co-authored-by: Jonathan Amsterdam <jba@google.com>

---------

Co-authored-by: Jonathan Amsterdam <jba@google.com>
 2025-09-30 16:16:30 -04:00
Jonathan Amsterdam
33ff851ef3
 		mcp: update to jsonschema that does not validate structs (#511) 
Update to the latest jsonschema commit, which removes the ability to
validate structs and changes the type of ForOptions.TypeSchemas.
 2025-09-22 15:28:04 -04:00
dependabot[bot]
d870f5e638
 		build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 in the go_modules group across 1 directory (#476) 
Bumps the go_modules group with 1 update in the / directory:
[github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt).

Updates `github.com/golang-jwt/jwt/v5` from 5.2.1 to 5.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/golang-jwt/jwt/releases">github.com/golang-jwt/jwt/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Fixed <a
href="https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp">https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp</a>
by <a
href="https://github.com/mfridman"><code>@​mfridman</code></a></li>
<li>Fixed some typos by <a
href="https://github.com/Ashikpaul"><code>@​Ashikpaul</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/382">golang-jwt/jwt#382</a></li>
<li>build: add go1.22 to ci workflows by <a
href="https://github.com/mfridman"><code>@​mfridman</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/383">golang-jwt/jwt#383</a></li>
<li>Bump golangci/golangci-lint-action from 4 to 5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/387">golang-jwt/jwt#387</a></li>
<li>Bump golangci/golangci-lint-action from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/389">golang-jwt/jwt#389</a></li>
<li>chore: bump ci tests to include go1.23 by <a
href="https://github.com/mfridman"><code>@​mfridman</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/405">golang-jwt/jwt#405</a></li>
<li>Fix jwt -show by <a
href="https://github.com/AlexanderYastrebov"><code>@​AlexanderYastrebov</code></a>
in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/406">golang-jwt/jwt#406</a></li>
<li>docs: typo by <a
href="https://github.com/kvii"><code>@​kvii</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/407">golang-jwt/jwt#407</a></li>
<li>Update SECURITY.md by <a
href="https://github.com/oxisto"><code>@​oxisto</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/416">golang-jwt/jwt#416</a></li>
<li>Update <code>jwt.Parse</code> example to use
<code>jwt.WithValidMethods</code> by <a
href="https://github.com/mattt"><code>@​mattt</code></a> in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/425">golang-jwt/jwt#425</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Ashikpaul"><code>@​Ashikpaul</code></a>
made their first contribution in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/382">golang-jwt/jwt#382</a></li>
<li><a href="https://github.com/kvii"><code>@​kvii</code></a> made their
first contribution in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/407">golang-jwt/jwt#407</a></li>
<li><a href="https://github.com/mattt"><code>@​mattt</code></a> made
their first contribution in <a
href="https://redirect.github.com/golang-jwt/jwt/pull/425">golang-jwt/jwt#425</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2">https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0951d18428"><code>0951d18</code></a>
Merge commit from fork</li>
<li><a
href="c035977d9e"><code>c035977</code></a>
Update Parse example to use WithValidMethods (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/425">#425</a>)</li>
<li><a
href="bc8bdca5cc"><code>bc8bdca</code></a>
Update SECURITY.md (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/416">#416</a>)</li>
<li><a
href="5ec246c074"><code>5ec246c</code></a>
docs: typo (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/407">#407</a>)</li>
<li><a
href="0123f1ad66"><code>0123f1a</code></a>
Fix jwt -show (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/406">#406</a>)</li>
<li><a
href="f961c72abd"><code>f961c72</code></a>
chore: bump ci tests to include go1.23 (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/405">#405</a>)</li>
<li><a
href="62e504c281"><code>62e504c</code></a>
Bump golangci/golangci-lint-action from 5 to 6 (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/389">#389</a>)</li>
<li><a
href="1a56dcf532"><code>1a56dcf</code></a>
Bump golangci/golangci-lint-action from 4 to 5 (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/387">#387</a>)</li>
<li><a
href="c8043eab61"><code>c8043ea</code></a>
build: add go1.22 to ci workflows (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/383">#383</a>)</li>
<li><a
href="7c3f6dc563"><code>7c3f6dc</code></a>
Update README.md (<a
href="https://redirect.github.com/golang-jwt/jwt/issues/382">#382</a>)</li>
<li>See full diff in <a
href="https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/golang-jwt/jwt/v5&package-manager=go_modules&previous-version=5.2.1&new-version=5.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/go-sdk/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-09-18 10:22:57 -04:00
Jonathan Amsterdam
b3fb83f272
 		internal/testing: fake auth server (#296) 
This is a fake OAuth authentication server, for use in testing.
 2025-09-16 21:12:14 -04:00
Rob Findley
c2c810bf40 mcp: update jsonschema-go to v0.2.3, prepare README 2025-09-12 12:00:54 -04:00
Rob Findley
9f1b8646bd mcp: propertly validate against JSON, independent of Go values 
Our validation logic was avoiding double-unmarshalling as much as
possible, by parsing before validation and validating the Go type.

This only works if the Go type has the same structure as its JSON
representation, which may not be the case in the presence of types with
custom MarshalJSON or UnmarshalJSON methods (such as time.Time).

But even if the Go type doesn't use any custom marshalling, validation
is broken, because we can't differentiate zero values from missing
values.

Bite the bullet and use double-unmarshalling for both input and output
schemas. Coincidentally, this fixes three bugs:
- We were accepting case-insensitive JSON keys, since we parsed first,
  even though they should have been rejected. A number of tests were
  wrong.
- Defaults were overriding present-yet-zero values, as noted in an
  incorrect test case.
- When "arguments" was missing, validation wasn't performed, no defaults
  were applied, and unmarshalling failed even if all properties were
  optional.

First unmarshalling to map[string]any allows us to fix all these bugs.
Unfortunately, it means a 3x increase in the number of reflection
operations (we need to unmarshal, apply defaults and validate,
re-marshal with the defaults, and then unmarshal into the Go type).
However, this is not likely to be a significant overhead, and we can
always optimize in the future.

Update github.com/google/jsonschema-go to pick up necessary improvements
supporting this change.

Additionally, fix the error codes for invalid tool parameters, to be
consistent with other SDKs (Invalid Params: -32602).

Fixes #447
Fixes #449
Updates #450
 2025-09-12 10:50:19 -04:00
Sam Thanawalla
3a66cf3997
 		go.mod: update jsonschema to v0.2.2 (#446) 
This version of jsonschema fixes embedded structs.

Fixes: #437
 2025-09-11 10:21:02 -04:00
Jonathan Amsterdam
a082e0764d
 		go.mod: update to jsonschema v0.2.1 2025-09-09 10:34:38 -04:00
Jonathan Amsterdam
73dd76b614
 		go.mod: update to fixed jsonschema (#370) 
Update to a version that doesn't copy descriptions of subschemas.

Fixes #366.
 2025-08-25 14:00:24 -04:00
Sam Thanawalla
e9e0da8dac
 		jsonschema: remove jsonschema code and depend on google/jsonschema-go (#262) 
This CL prunes the jsonschema directory and updates the go.mod.

For #28
 2025-08-07 15:30:06 -04:00
cryo
fbff31af14
 		mcp/Resource: Refactor URI Template Matching with uritemplate Library (#100) 
1. Replaced the `uriTemplateToRegexp` function with the use of
[yosida95/uritemplate](https://github.com/yosida95/uritemplate) to
handle URI template matching as per the request.
2. Updated the relevant test cases to verify the new implementation and
fixed an invalid URI template (`"file:///{}/{a}/{b}"`) that doesn't
conform to RFC 6570 due to an empty `{}` expression.
3. Updated `go.mod` and `go.sum` to reflect the new dependency.

Fixes #11.
 2025-07-08 15:52:54 -04:00
Rob Findley
658b513c44
 		all: add go.mod and go.sum file 2025-06-23 17:17:41 +00:00