Repository navigation
[go-fan] Go Module Review: modelcontextprotocol/go-sdkΒ #67932
Description
πΉ Go Fan Report: modelcontextprotocol/go-sdk
Deep dive on github.com/modelcontextprotocol/go-sdk v1.8.0 β the official Go SDK for MCP servers/clients, picked as today's module because it had the most recent pushed_at among gh-aw's direct dependencies.
Module Overview
The official Go implementation of the Model Context Protocol (JSON-RPC 2.0 wire protocol, tool/resource/prompt registration, stdio + streamable-HTTP transports, OAuth client-auth helpers), maintained by the modelcontextprotocol org with Google.
Current Usage in gh-aw
- Files: 13 non-test
.gofiles (pkg/cli/mcp_*.go,pkg/parser/mcp.go), ~20 test files. - Import count: 18 import lines of
mcp/jsonrpcsubpackages. - Key APIs used:
mcp.NewServer/ServerOptions/ServerCapabilities,mcp.AddToolwith typed-args generics for all 11 registered tools,mcp.ToolAnnotations(ReadOnly/Idempotent/OpenWorld hints),mcp.NewStreamableHTTPHandler+StreamableHTTPOptions,server.AddReceivingMiddleware(custom argument-validation middleware),req.Session.NotifyProgressfor progress on long-running tools,jsonrpc.Error/Code*for structured errors,mcp.Icon, andjsonschema.For[T](from the companiongoogle/jsonschema-gomodule) wrapped in a localGenerateSchema[T]()helper.
Usage is idiomatic: a single long-lived *mcp.Server built once, small register<Name>Tool functions per tool, typed handlers returning (*mcp.CallToolResult, any, error), and explicit reliance on the SDK's automatic schema caching (called out in a code comment) instead of a hand-rolled cache.
Research Findings
Version status: go.mod pins v1.8.0, published 2026-09-14 β this is the latest stable release. No upgrade needed.
Recent Updates (v1.8.0, since v1.7.0)
ServerOptions.SupportedProtocolVersionsβ lets a server explicitly narrow (never widen) the protocol versions it advertises; panics at construction if given an unimplemented version.ServerOptions.SetCacheableβ post-handler hook to setttlMs/cacheScopeonserver/discover, the fourlistmethods, andresources/readresults.ServerSession.NotifyElicitationCompleteβ new elicitation-completion notification.- Hardening: bounded JSON nesting depth, SSE
MaxEventSizecaps, stdioMaxLineLengthcaps, OAuth DCR response size caps β resource-exhaustion fixes for any HTTP-exposed server. - A stateful streamable handler now returns a proper JSON-RPC
-32022 CodeUnsupportedProtocolVersionerror instead of a plain-text 400 on protocol mismatch β directly relevant to gh-aw's own stay-stateful design (seemcp_server_http.go). - Removed legacy
MCPGODEBUGflags (seterroroverwrite,enableoriginverification,disablecontenttypecheck,disablelocalhostprotection) β gh-aw already uses the correct field replacement (DisableLocalhostProtection), so no action needed.
Best Practices: Typed-args mcp.AddTool generics, ToolAnnotations hints, and structured jsonrpc.Error responses are exactly what the SDK's own docs recommend β gh-aw already follows this.
Improvement Opportunities
π Quick Wins
- None required for correctness β current usage already matches SDK best practice.
β¨ Feature Opportunities
ServerOptions.SupportedProtocolVersions: gh-aw currently documents its stateful-mode protocol-negotiation tradeoff only in a code comment inmcp_server_http.go. Setting this option explicitly would make the supported version range self-documenting in code and fail fast (panic at construction) if an unimplemented version is ever referenced by mistake.ServerOptions.SetCacheable: gh-aw's tool list is static (ListChanged: false) β exactly the scenario this hook targets. Markingserver/discover/tools/listas cacheable with a TTL could reduce repeated list round-trips from polling MCP clients (editor integrations, etc.).ServerSession.NotifyElicitationComplete: not applicable today (no elicitation flow in use), but worth keeping in mind if an interactive tool (add/fix) is ever extended to ask clarifying questions via MCP elicitation instead of CLI prompts.
π Best Practice Alignment
- Progress notifications (
notifyProgress/NotifyProgress) are wired up only forlogs,audit, andaudit-diff.compile(can watch/recompile many files) andwork-queue(hits a Git-backed store) are also potentially long-running and could reuse the same helper for a consistent UX.
π§ General Improvements
- No redundant or custom reimplementation of SDK functionality found β gh-aw consistently leans on the SDK's generics, annotations, and schema caching rather than hand-rolling equivalents.
Recommendations
- Consider adding
ServerOptions.SupportedProtocolVersionstocreateMCPServerto make the protocol-version contract explicit in code (low effort,pkg/cli/mcp_server.go). - Evaluate
ServerOptions.SetCacheablefortools/list/server/discovergiven the static tool set (pkg/cli/mcp_server.go). - Extend
notifyProgresscoverage tocompileandwork-queuetools for UX consistency withlogs/audit/audit-diff(pkg/cli/mcp_tools_readonly.go,pkg/cli/mcp_tools_work_queue.go).
Next Steps
No urgent action required β the SDK is already at the latest stable version and usage is idiomatic. The three feature opportunities above are optional enhancements, not fixes.
Generated by Go Fan
Module summary saved to: scratchpad/mods/modelcontextprotocol-go-sdk.md
References:
Generated by πΉ Go Fan Β· claude Β· agent Β· 167 AIC Β· β 6.5K Β· β·
- expires on Oct 13, 2026, 12:27 AM UTC-08:00
Activity
github-actions commentedon Oct 12, 2026
πͺ Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! πͺ