Maciej Kisiel
580f2a09be
mcp: verify 'Origin' and 'Content-Type' headers ( #842 ) ...
This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).
Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.
2026-03-13 10:43:25 +00:00
go.mod: upgrade to jsonschema v0.4.2 ( #732 )
2026-01-04 09:18:01 -05:00
mcp: add Capabilities fields to ServerOptions and ClientOptions ( #713 )
2025-12-11 20:17:46 -05:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
mcp: fix goroutine leaks in unit tests ( #496 )
2025-10-16 11:13:30 -04:00
mcp: allow any value for schemas ( #517 )
2025-09-26 11:55:54 -04:00
mcp: add Extensions field to capabilities per SEP-2133 ( #794 )
2026-02-17 16:10:07 +01:00
mcp: speed up TestCommandTransportDuration
2025-09-12 12:00:29 -04:00
mcp: speed up TestCommandTransportDuration
2025-09-12 12:00:29 -04:00
mcp: use synctest for timing-dependent tests ( #756 )
2026-02-10 10:40:11 +01:00
mcp: use synctest for timing-dependent tests ( #756 )
2026-02-10 10:40:11 +01:00
internal/mcp: update protocol versions
2025-06-18 08:11:16 -07:00
internal/mcp: update protocol versions
2025-06-18 08:11:16 -07:00
mcp: switch icon theme to named string type ( #733 )
2025-12-19 16:44:10 -05:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
mcp: add CallToolResult.getError ( #481 )
2025-09-18 08:08:23 -04:00
mcp: switch icon theme to named string type ( #733 )
2025-12-19 16:44:10 -05:00
mcp: use synctest for timing-dependent tests ( #756 )
2026-02-10 10:40:11 +01:00
mcp: use synctest for timing-dependent tests ( #756 )
2026-02-10 10:40:11 +01:00
mcp: add Capabilities fields to ServerOptions and ClientOptions ( #713 )
2025-12-11 20:17:46 -05:00
mcp: improve http transports error handling and make transport work with any size message ( #734 )
2026-02-05 12:59:37 +01:00
mcp: improve http transports error handling and make transport work with any size message ( #734 )
2026-02-05 12:59:37 +01:00
mcp: minor cleanup of some TODOs ( #332 )
2025-08-20 12:55:19 -04:00
mcp: change tool handler design ( #325 )
2025-08-20 19:36:34 -04:00
mcp: use rand.Text and slog.DiscardHandler over internal implementation ( #773 )
2026-02-03 14:23:59 +01:00
mcp: fix inaccurate package doc ( #534 )
2025-09-26 14:16:10 -04:00
docs: add feature and troubleshooting documentation ( #463 )
2025-09-16 11:13:40 -04:00
mcp: use synctest for timing-dependent tests ( #756 )
2026-02-10 10:40:11 +01:00
mcp: fix multi-select enum elicitation
2026-02-17 14:42:18 +01:00
mcp: align PromptHandler args with other handlers ( #348 )
2025-08-22 10:44:05 -04:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
mcp: implement sampling with tools ( #699 )
2026-02-17 12:07:08 +01:00
mcp: implement sampling with tools ( #699 )
2026-02-17 12:07:08 +01:00
mcp: finalize cleanup of Go 1.23, make Go version support explicit
2026-02-06 12:50:01 +01:00
mcp/Resource: Refactor URI Template Matching with uritemplate Library ( #100 )
2025-07-08 15:52:54 -04:00
mcp: implement sampling with tools ( #699 )
2026-02-17 12:07:08 +01:00
perf: add schema caching to avoid repeated reflection ( #685 )
2026-01-20 20:16:46 -05:00
perf: add schema caching to avoid repeated reflection ( #685 )
2026-01-20 20:16:46 -05:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
doc: document logging ( #497 )
2025-09-19 11:58:58 -04:00
mcp: add Extensions field to capabilities per SEP-2133 ( #794 )
2026-02-17 16:10:07 +01:00
mcp: support stateless streamable sessions ( #277 )
2025-08-11 16:43:46 -04:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
all: remove ServerRequest[T] for concrete T ( #342 )
2025-08-21 12:10:53 -04:00
mcp: use rand.Text and slog.DiscardHandler over internal implementation ( #773 )
2026-02-03 14:23:59 +01:00
SSE: Add support for SSE handler options ( #508 )
2025-09-19 13:01:57 -04:00
mcp: add Allow header to 405 responses per RFC 9110 §15.5.6 ( #757 )
2026-01-22 09:43:45 +01:00
mcp: verify 'Origin' and 'Content-Type' headers ( #842 )
2026-03-13 10:43:25 +00:00
mcp: don't persist failed streamable sessions ( #605 )
2025-10-27 16:29:16 -04:00
mcp: export session missing error ( #771 )
2026-02-03 15:46:49 +01:00
all: client side OAuth support ( #785 )
2026-02-27 15:30:13 +01:00
all: client side OAuth support ( #785 )
2026-02-27 15:30:13 +01:00
mcp: fix goroutine leaks in unit tests ( #496 )
2025-10-16 11:13:30 -04:00
mcp: simplify stream state management in streamable transport
2025-12-10 13:28:25 -05:00
mcp: verify 'Origin' and 'Content-Type' headers ( #842 )
2026-03-13 10:43:25 +00:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
mcp: allow any value for schemas ( #517 )
2025-09-26 11:55:54 -04:00
all: expose JSON-RPC error codes, and support URLElicitationRequired errors ( #655 )
2025-12-01 11:29:17 -05:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
mcp: fix broken client root capabilities ( #698 )
2025-12-11 10:16:56 -05:00
fix: handle Windows CRLF in MCP client( #664 ) ( #665 )
2025-12-01 12:16:39 -05:00
all: use case-sensitive JSON unmarshaling ( #807 )
2026-02-18 16:38:36 +01:00
580f2a09be