modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
go-sdk/docs/README.md
Maciej Kisiel a433a831d6
 mcp: verify 'Origin' and 'Content-Type' headers (#842) 
This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).

Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.
2026-03-13 11:36:41 +01:00

1.6 KiB
Raw Blame History

Features

These docs mirror the official MCP spec. Use the index below to learn how the SDK implements a particular aspect of the protocol.

Base Protocol

  1. Lifecycle (Clients, Servers, and Sessions).
  2. Transports
    1. Stdio transport
    2. Streamable transport
    3. Custom transports
  3. Authorization
  4. Security
  5. Utilities
    1. Cancellation
    2. Ping
    3. Progress

Client Features

  1. Roots
  2. Sampling
  3. Elicitation

Server Features

  1. Prompts
  2. Resources
  3. Tools
  4. Utilities
    1. Completion
    2. Logging
    3. Pagination

TroubleShooting

See troubleshooting.md for a troubleshooting guide.

Backwards compatibility

See mcpgodebug.md for a list of backwards incompatible behavior changes and description how they can be temporarily undone.

Rough edges

See rough_edges.md for a list of rough edges or API oversights that can't be addressed due to our compatibility promise. We'll revisit these if/when we move to a v2 of the SDK.