modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
go-sdk/docs
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Max Gerber 2d47cc9664
 auth: issuer mix-up mitigation (#859) 
This PR functions as a Reference implementation of
[SEP-2468](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2468)
/ [RFC9207](https://datatracker.ietf.org/doc/rfc9207/).

This PR hardens the MCP OAuth Client functionality against Mix-Up
attacks:
>   Mix-up attacks aim to steal an authorization code or access token by
>   tricking the client into sending the authorization code or access
> token to the attacker instead of the honest authorization or resource
>   server

This PR hardens the client by adding support for a new `iss` parameter
in authorization responses:
- Authorization Servers broadcast support for the `iss` parameter via
the `authorization_response_iss_parameter_supported` metadata parameter
- If the parameter is supported, clients expect to receive the `iss`
parameter in the authorization response
- Clients compare the `iss` parameter in the authorization response to
the `Issuer` parameter in the authorization metadata. The two must match
exactly for the response to be processed.

Fixes #941
2026-05-27 11:39:08 +02:00
..
images Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
client.md mcp: add Capabilities fields to ServerOptions and ClientOptions (#713) 2025-12-11 20:17:46 -05:00
CNAME Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
contributing.md Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
mcpgodebug.md fix: do not omitempty ReadOnlyHint in ToolAnnotations (#908) 2026-05-25 15:52:15 +02:00
protocol.md auth: issuer mix-up mitigation (#859) 2026-05-27 11:39:08 +02:00
quick_start.md Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
README.md Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
rough_edges.md fix: do not omitempty ReadOnlyHint in ToolAnnotations (#908) 2026-05-25 15:52:15 +02:00
server.md Add documentation backed by mkdocs (#883) 2026-04-09 14:25:43 +02:00
troubleshooting.md mcp: update latestProtocolVersion to 2025-11-25 (#724) 2026-03-03 10:30:11 +01:00

README.md

Overview

The SDK consists of several importable packages:

These docs mirror the official MCP spec. Use the index below to learn how the SDK implements a particular aspect of the protocol.

Base Protocol

  1. Lifecycle (Clients, Servers, and Sessions).
  2. Transports
    1. Stdio transport
    2. Streamable transport
    3. Custom transports
  3. Authorization
  4. Security
  5. Utilities
    1. Cancellation
    2. Ping
    3. Progress

Client Features

  1. Roots
  2. Sampling
  3. Elicitation

Server Features

  1. Prompts
  2. Resources
  3. Tools
  4. Utilities
    1. Completion
    2. Logging
    3. Pagination

TroubleShooting

See troubleshooting.md for a troubleshooting guide.

Backwards compatibility

See mcpgodebug.md for a list of backwards incompatible behavior changes and description how they can be temporarily undone.

Rough edges

See rough_edges.md for a list of rough edges or API oversights that can't be addressed due to our compatibility promise. We'll revisit these if/when we move to a v2 of the SDK.