a433a831d6This PR introduces protection against cross-origin requests by installing `http.CrossOriginProtection`. By default, the zero value is used which does not contain any trusted origins or bypass patterns. The protection can be customized by providing a custom `http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently, the deny handler set on the protection is ignored. This default has an MCPGODEBUG option (`disableoriginverification`) to disable the default protection. It will be available until `v1.6.0` of the SDK. We also increase the Go version required by the SDK to 1.25, since this is the version that introduced `http.CrossOriginProtection`. This is in line with the SDK's policy of supporting two newest Go versions (1.26 was released in February 2026). Additionally, we start validating if the `Content-Type` header for `POST` requests is set to `application/json` to avoid accepting CORS-safelisted requests.
51 lines
1.6 KiB
Markdown
51 lines
1.6 KiB
Markdown
<!-- Autogenerated by weave; DO NOT EDIT -->
|
|
# Features
|
|
|
|
These docs mirror the [official MCP spec](https://modelcontextprotocol.io/specification/2025-06-18).
|
|
Use the index below to learn how the SDK implements a particular aspect of the
|
|
protocol.
|
|
|
|
## Base Protocol
|
|
|
|
1. [Lifecycle (Clients, Servers, and Sessions)](protocol.md#lifecycle).
|
|
1. [Transports](protocol.md#transports)
|
|
1. [Stdio transport](protocol.md#stdio-transport)
|
|
1. [Streamable transport](protocol.md#streamable-transport)
|
|
1. [Custom transports](protocol.md#stateless-mode)
|
|
1. [Authorization](protocol.md#authorization)
|
|
1. [Security](protocol.md#security)
|
|
1. [Utilities](protocol.md#utilities)
|
|
1. [Cancellation](protocol.md#cancellation)
|
|
1. [Ping](protocol.md#ping)
|
|
1. [Progress](protocol.md#progress)
|
|
|
|
## Client Features
|
|
|
|
1. [Roots](client.md#roots)
|
|
1. [Sampling](client.md#sampling)
|
|
1. [Elicitation](client.md#elicitation)
|
|
|
|
## Server Features
|
|
|
|
1. [Prompts](server.md#prompts)
|
|
1. [Resources](server.md#resources)
|
|
1. [Tools](server.md#tools)
|
|
1. [Utilities](server.md#utilities)
|
|
1. [Completion](server.md#completion)
|
|
1. [Logging](server.md#logging)
|
|
1. [Pagination](server.md#pagination)
|
|
|
|
# TroubleShooting
|
|
|
|
See [troubleshooting.md](troubleshooting.md) for a troubleshooting guide.
|
|
|
|
# Backwards compatibility
|
|
|
|
See [mcpgodebug.md](mcpgodebug.md) for a list of backwards incompatible behavior changes
|
|
and description how they can be temporarily undone.
|
|
|
|
# Rough edges
|
|
|
|
See [rough_edges.md](rough_edges.md) for a list of rough edges or API
|
|
oversights that can't be addressed due to our compatibility promise. We'll
|
|
revisit these if/when we move to a v2 of the SDK.
|