modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
go-sdk/docs/mcpgodebug.md
Maciej Kisiel a433a831d6
 mcp: verify 'Origin' and 'Content-Type' headers (#842) 
This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).

Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.
2026-03-13 11:36:41 +01:00

1.7 KiB
Raw Blame History

Backwards compatibility and MCPGODEBUG

According to our compatibility promise, we can't break backward compatibility of the SDK API. However, sometimes we need to change the behavior of the SDK in a backward-incompatible way in order to fix bugs or security issues. In those cases we introduce temporary compatibility parameters, that can be used to opt-out of the new behavior. They are usually maintained for two minor release cycles and then removed.

The compatibility parameters are provided via the MCPGODEBUG environment variable. The value of the variable is a comma-separated list of parameter value assignments, e.g.:

MCPGODEBUG=parameter1=value1,parameter2=value2

MCPGODEBUG history

1.4.1

Options listed below will be removed in the 1.6.0 version of the SDK.

  • disablecrossoriginprotection added. If set to 1, newly added cross-origin protection will be disabled. The default behavior was changed to enable cross-origin protection.

1.4.0

Options listed below will be removed in the 1.6.0 version of the SDK.

  • jsonescaping added. If set to 1, JSON marshaling will preserve the previous behavior of escaping HTML characters in JSON strings. The default behavior was changed to not escape HTML characters, to be consistent with other SDKs.

  • disablelocalhostprotection added. If set to 1, newly added DNS rebinding protection will be disabled. The default behavior was changed to enable DNS rebinding protection. The protection can also be disabled by setting the DisableLocalhostProtection field in the StreamableHTTPOptions struct to true, which is the recommended way to disable the protection long term.