# Backwards compatibility and MCPGODEBUG According to our compatibility promise, we can't break backward compatibility of the SDK API. However, sometimes we need to change the behavior of the SDK in a backward-incompatible way in order to fix bugs or security issues. In those cases we introduce temporary compatibility parameters, that can be used to opt-out of the new behavior. They are usually maintained for two minor release cycles and then removed. The compatibility parameters are provided via the `MCPGODEBUG` environment variable. The value of the variable is a comma-separated list of parameter value assignments, e.g.: ``` MCPGODEBUG=parameter1=value1,parameter2=value2 ``` ## `MCPGODEBUG` history ### 1.6.1 Options listed below were added and will be removed in the 1.8.0 version of the SDK. - `disablecontenttypecheck` added. If set to `1`, Content-Type validation on HTTP POST requests will be disabled, allowing requests with non-JSON or missing Content-Type headers. The default behavior is to validate that HTTP POST requests have Content-Type: application/json. ### 1.6.0 Options listed below were added and will be removed in the 1.8.0 version of the SDK. - `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite `Content` with the error text, restoring the previous behavior. The default behavior was changed to preserve existing `Content` if it has already been populated. - `enableoriginverification` added. If set to `1`, default (zero-value) cross-origin protection will be applied when `StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the behavior from v1.4.1-v1.5.0. The default behavior was changed to not enable cross-origin protection. - `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now also used in the SSE transport. Options below were removed: - `jsonescaping`, according to plan, - `disablecrossoriginprotection`, it was replaced by `enableoriginverification` after the default was changed to not enable cross-origin protection. ### 1.4.1 Options listed below will be removed in the 1.6.0 version of the SDK. - `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin protection will be disabled. The default behavior was changed to enable cross-origin protection. ### 1.4.0 Options listed below will be removed in the 1.6.0 version of the SDK. - `jsonescaping` added. If set to `1`, JSON marshaling will preserve the previous behavior of escaping HTML characters in JSON strings. The default behavior was changed to not escape HTML characters, to be consistent with other SDKs. - `disablelocalhostprotection` added. If set to `1`, newly added DNS rebinding protection will be disabled. The default behavior was changed to enable DNS rebinding protection. The protection can also be disabled by setting the `DisableLocalhostProtection` field in the `StreamableHTTPOptions` or `SSEOptions` struct to `true`, which is the recommended way to disable the protection long term. **Removal of this option was postponed until 1.8.0.**