go-sdk/mcp
Repository files (latest commit first)
Filename Latest commit message Latest commit date
akashjainn f99cdb649b
mcp: base64-encode a non-header-safe Mcp-Name (#1246)
Fixes: https://github.com/modelcontextprotocol/go-sdk/issues/1243

The 2026-07-28 transport spec only SHOULD-constrains names to
header-safe characters, and lets a client Base64-wrap one that is not,
using the `=?base64?...?=` sentinel. `setStandardHeaders` set `Mcp-Name`
raw, while the sibling `Mcp-Param-*` path already ran its values through
`encodeHeaderValue`, so a name outside the safe set went out unencoded.

This routes `Mcp-Name` through `encodeHeaderValue` as well.

#1242 landed the other direction — the server decoding the sentinel
before comparing — so the two together close the round trip. Worth
noting they interact: after #1242, a name that is literally shaped like
the sentinel (`=?base64?abc?=`) is now rejected as invalid Base64,
because the server tries to decode a value the client never encoded. The
new test covers that case, and it fails on `main` today.

`extractName` also covers `resources/read`, so this applies to resource
URIs, which is where non-ASCII is most likely to show up in practice.

## Testing

`TestMcpNameHeaderEncodingRoundTrip` drives `setStandardHeaders` and
then feeds its output to `validateMcpHeaders`, so it pins the client and
server halves against each other rather than asserting the encoding in
isolation. Cases: an ASCII-safe name (must stay unencoded, no churn for
the common path), non-ASCII, a leading space, a control character, and
the sentinel-shaped literal above.

Verified failing before the change and passing after. `go test ./...`
passes.

A note on process:
[@remote-controlled-man](https://github.com/remote-controlled-man) asked
about this issue earlier today and proposed much the same scope. I had
the change written before I saw that comment and thought the #1242
interaction was worth surfacing either way, but I'm happy to close this
if they'd rather carry it — please just say so.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_011Wf643Lx36V5wdwuuf2EdT
2026-09-07 10:16:16 +02:00
..
testdata mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
cache.go mcp: do not enforce TTL on cached tool (#1053) 2026-07-07 13:43:10 +02:00
capabilities_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
client.go fix: only subscribe when server advertises capability (#1221) 2026-09-01 14:43:23 +02:00
client_example_test.go mcp: add docs for tier 1 assessment (#1195) 2026-08-24 12:00:59 +02:00
client_list_test.go mcp: allow any value for schemas (#517) 2025-09-26 11:55:54 -04:00
client_test.go mcp: export ClientSessionOptions.ProtocolVersion (#1127) 2026-08-03 15:29:52 +02:00
cmd.go mcp: speed up TestCommandTransportDuration 2025-09-12 12:00:29 -04:00
cmd_export_test.go mcp: speed up TestCommandTransportDuration 2025-09-12 12:00:29 -04:00
cmd_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
conformance_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
content.go mcp: Deprecate roots, sampling and logging (SEP-2577) (#1017) 2026-06-23 11:11:08 +02:00
content_nil_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
content_test.go mcp: switch icon theme to named string type (#733) 2025-12-19 16:44:10 -05:00
elicitation_test.go mcp: add ServerSession.NotifyElicitationComplete (#1194) 2026-08-24 10:14:28 +02:00
error_test.go mcp: add ServerSession.NotifyElicitationComplete (#1194) 2026-08-24 10:14:28 +02:00
event.go mcp: add an sse event size cap (#1205) 2026-09-02 11:35:23 +02:00
event_test.go mcp: add an sse event size cap (#1205) 2026-09-02 11:35:23 +02:00
features.go mcp: minor cleanup of some TODOs (#332) 2025-08-20 12:55:19 -04:00
features_test.go mcp: change tool handler design (#325) 2025-08-20 19:36:34 -04:00
logging.go mcp: keep request log levels scoped to each request (#1168) 2026-08-17 14:00:41 +02:00
mcp.go mcp: fix inaccurate package doc (#534) 2025-09-26 14:16:10 -04:00
mcp_example_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
mcp_test.go fix: only subscribe when server advertises capability (#1221) 2026-09-01 14:43:23 +02:00
mrtr.go mcp: don't mutate caller params on multi-round-trip retries (#1145) 2026-08-31 13:53:34 +02:00
mrtr_test.go mcp: don't mutate caller params on multi-round-trip retries (#1145) 2026-08-31 13:53:34 +02:00
prompt.go mcp: align PromptHandler args with other handlers (#348) 2025-08-22 10:44:05 -04:00
protocol.go refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1237) 2026-09-04 10:08:52 +02:00
protocol_test.go mcp: include resultType on new-protocol responses (#1060) 2026-07-13 11:51:19 +00:00
requests.go mcp: Implement subscriptions/listen rpc (SEP-2575) (#1007) 2026-06-22 18:57:36 +02:00
resource.go mcp: align resource not found error code with sep-2164 (#931) 2026-05-05 16:20:02 +02:00
resource_test.go mcp/Resource: Refactor URI Template Matching with uritemplate Library (#100) 2025-07-08 15:52:54 -04:00
sampling_test.go mcp: export ClientSessionOptions.ProtocolVersion (#1127) 2026-08-03 15:29:52 +02:00
schema_cache.go perf: add schema caching to avoid repeated reflection (#685) 2026-01-20 20:16:46 -05:00
schema_cache_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
server.go mcp: allow per request Cacheable customization (#1203) 2026-09-01 18:57:51 +00:00
server_example_test.go mcp: add docs for tier 1 assessment (#1195) 2026-08-24 12:00:59 +02:00
server_test.go mcp: allow per request Cacheable customization (#1203) 2026-09-01 18:57:51 +00:00
session.go mcp: allow restricting the protocol versions a server supports (#1199) 2026-08-28 16:06:10 +02:00
shared.go mcp: do not check metatada on notifications (#1215) 2026-09-01 13:30:20 +00:00
shared_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
sse.go refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1237) 2026-09-04 10:08:52 +02:00
sse_example_test.go mcp: add docs for tier 1 assessment (#1195) 2026-08-24 12:00:59 +02:00
sse_test.go mcp: add a max request body size of the old transport (#1224) 2026-09-01 17:28:35 +02:00
streamable.go refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1237) 2026-09-04 10:08:52 +02:00
streamable_bench_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
streamable_client.go mcp: do not call DELETE for sessionless & doc adjustments (#960) 2026-05-15 21:47:34 +02:00
streamable_client_test.go mcp: tolerate 404 on subscriptions/listen in stateless mode (#1193) 2026-08-25 14:27:37 +02:00
streamable_example_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
streamable_headers.go mcp: base64-encode a non-header-safe Mcp-Name (#1246) 2026-09-07 10:16:16 +02:00
streamable_headers_test.go mcp: base64-encode a non-header-safe Mcp-Name (#1246) 2026-09-07 10:16:16 +02:00
streamable_server.go mcp: simplify stream state management in streamable transport 2025-12-10 13:28:25 -05:00
streamable_test.go mcp: add an sse event size cap (#1205) 2026-09-02 11:35:23 +02:00
tool.go mcp: add docs for tier 1 assessment (#1195) 2026-08-24 12:00:59 +02:00
tool_example_test.go mcp: add docs for tier 1 assessment (#1195) 2026-08-24 12:00:59 +02:00
tool_test.go mcp: tool.InputSchema and tool.OutputSchema validation (SEP-2106) (#1009) 2026-06-16 13:55:47 +02:00
transport.go mcp: add an sse event size cap (#1205) 2026-09-02 11:35:23 +02:00
transport_example_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
transport_test.go mcp: add an sse event size cap (#1205) 2026-09-02 11:35:23 +02:00
util.go all: use case-sensitive JSON unmarshaling (#807) 2026-02-18 16:38:36 +01:00