580f2a09beThis PR introduces protection against cross-origin requests by installing `http.CrossOriginProtection`. By default, the zero value is used which does not contain any trusted origins or bypass patterns. The protection can be customized by providing a custom `http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently, the deny handler set on the protection is ignored. This default has an MCPGODEBUG option (`disableoriginverification`) to disable the default protection. It will be available until `v1.6.0` of the SDK. We also increase the Go version required by the SDK to 1.25, since this is the version that introduced `http.CrossOriginProtection`. This is in line with the SDK's policy of supporting two newest Go versions (1.26 was released in February 2026). Additionally, we start validating if the `Content-Type` header for `POST` requests is set to `application/json` to avoid accepting CORS-safelisted requests.
18 lines
414 B
Modula-2
18 lines
414 B
Modula-2
module github.com/modelcontextprotocol/go-sdk
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/jsonschema-go v0.4.2
|
|
github.com/segmentio/encoding v0.5.4
|
|
github.com/yosida95/uritemplate/v3 v3.0.2
|
|
golang.org/x/oauth2 v0.34.0
|
|
golang.org/x/tools v0.41.0
|
|
)
|
|
|
|
require (
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
golang.org/x/sys v0.40.0 // indirect
|
|
)
|