Skip to content

chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)#2787

Open
SamMorrowDrums wants to merge 11 commits into
mainfrom
sammorrowdrums-upgrade-go-sdk-mcp-spec
Open

chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)#2787
SamMorrowDrums wants to merge 11 commits into
mainfrom
sammorrowdrums-upgrade-go-sdk-mcp-spec

Conversation

@SamMorrowDrums

@SamMorrowDrums SamMorrowDrums commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What

Upgrades github.com/modelcontextprotocol/go-sdk v1.6.1 → v1.7.0-pre.1, the pre-release that implements the new stateless MCP spec:

  • SEP-2575 — server/discover (stateless, initialize no longer required)
  • SEP-2567 — sessionless (no Mcp-Session-Id)
  • SEP-2322 — Multi Round-Trip Requests (MRTR)

Part of the epic github/copilot-mcp-core#1709 (MCP Spec adoption — MRTR & stateless transport).

Changes

  • go.mod / go.sum: SDK bump + two new indirect deps (golang.org/x/sync, golang.org/x/time) pulled in by the SDK's MRTR/logging code.
  • 113 toolsnaps regenerated. The only source-visible behaviour change: the new SDK drops omitempty from ToolAnnotations.ReadOnlyHint and IdempotentHint, so their documented default (false) is now emitted explicitly instead of omitted. (The SDK offers MCPGODEBUG=hintomitempty=1 to restore the old behaviour; we intentionally adopt the new, explicit serialization.)
  • .github/workflows/mcp-diff.yml: pinned both jobs to the cross-spec-aware mcp-server-diff@3c2d5ea (see below).

No application code changes were needed — the Go API is backward compatible. script/test, go vet, and script/lint are all green; script/generate-docs produced no changes.

Does one binary serve both old and new clients? Yes.

Verified empirically against this build: supportedProtocolVersions spans 2026-07-28 (new, stateless) down to 2024-11-05, the server registers both the legacy initialize handler and the new server/discover handler, and it negotiates per connection. An old client sending initialize with protocolVersion: 2025-06-18 negotiates 2025-06-18 and gets a full tools/list over both stdio and streamable-http; the new stateless path (server/discover + tools/list with no initialize, reserved _meta per request) serves at 2026-07-28. So this server stays backward-compatible with existing clients while serving the newest spec — no routing split / legacy fork required at the OSS layer.

Diff coverage

.github/workflows/mcp-diff.yml (stdio + streamable-http) diffs this branch's server against main across the config matrix. It is pinned to mcp-server-diff@3c2d5ea, which normalizes cross-spec-version churn — _meta protocol plumbing, CacheableResult cache hints, the initialize envelope, and tool-annotation default hints — so the annotation-serialization change above shows up as no diff rather than ~113 spurious idempotentHint/readOnlyHint: false entries. The pin is temporary; it moves to the v3.0.0 tag once that ships.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

Copilot AI and others added 10 commits June 28, 2026 12:19
chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)
186381c 
Bumps github.com/modelcontextprotocol/go-sdk v1.6.1 -> v1.7.0-pre.1, the
pre-release that implements the new stateless MCP spec (SEP-2575 server/discover,
SEP-2567 sessionless, MRTR per SEP-2322).

The only source-visible change is tool annotation serialization: the new SDK
drops `omitempty` on ToolAnnotations.ReadOnlyHint and IdempotentHint, so false
values are now emitted explicitly. Regenerated the 113 affected toolsnaps to
match. No behavioural changes; build, vet, test and lint all pass.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions
chore: regenerate license files
1b2a03e 
Auto-generated by license-check workflow
ci(mcp-diff): pin to cross-spec-aware mcp-server-diff (3c2d5ea)
0b538ba 
Pins both the stdio and streamable-http MCP Server Diff jobs to the 3.0
branch of SamMorrowDrums/mcp-server-diff (commit 3c2d5ea), which normalizes
cross-spec-version churn: _meta protocol plumbing, CacheableResult cache
hints, the initialize envelope, and tool-annotation default hints. Without it
the go-sdk v1.6.1 -> v1.7.0-pre.1 bump would surface ~113 spurious
idempotentHint/readOnlyHint:false diffs from the SDK dropping omitempty.

Temporary commit pin; move to the v3.0.0 tag once it ships.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ci(mcp-diff): bump to a2ba618 (stateless server/discover probe)
497eac9 
a2ba618 adds the SEP-2575 server/discover stateless probe path, so each
server is probed at its own newest supported spec (base v1.6.1 via
initialize/2025-11-25, this branch via server/discover/2026-07-28) rather
than negotiating both down to the legacy handshake. Produces an honest,
signal-only cross-spec diff. Still a temporary commit pin; moves to v3.0.0
once tagged.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ci(mcp-diff): use full commit SHA for action pin
3e29771 
Actions rejects shortened SHAs ('not supported'); use the full
a2ba618c42293fb36e67be88e59c60d5608a302a so the action resolves.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ci(mcp-diff): track 3.0 HEAD (8fc26d8, becomes v3.0.0)
874c25d 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
feat(inventory): project owner/repo to Mcp-Param-* headers (SEP-2243)
4b6d886 
Annotates owner/repo tool params with x-mcp-header so the SDK projects them
to Mcp-Param-owner/Mcp-Param-repo request headers. A remote proxy can route
and filter on owner/repo from headers instead of re-parsing the JSON-RPC body
(headers are SDK-validated against the body). No-op for tools without these
params; old-protocol traffic unaffected.

Refs: github/copilot-mcp-core#1709, #1828

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
fix(inventory): preserve instructions in ForMCPRequest incl. server/d…
e5c53ae 
…iscover

ForMCPRequest dropped the generated instructions when narrowing the per-request
inventory, so HTTP server/discover (and initialize) returned empty instructions
even though the full inventory had them. Preserve instructions on the copy and
treat server/discover like initialize. Fixes discover<->initialize parity flagged
on go-sdk#1034 (root cause was here, not the SDK).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ci(mcp-diff): pin to mcp-server-diff v3.0.0
5c87f32 
Release is out; move both jobs from the 3.0-branch SHA to v3.0.0
(3521651, full SHA since Actions rejects short SHAs).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
test(github): enforce owner/repo header projection across all tools
df7d63c 
Export HeaderParams + AnnotateHeaderParams and add a coverage test over the
full all-toolsets inventory asserting every owner/repo param projects to its
Mcp-Param-* header. Guards the remote proxy's per-request header read so a new
tool can never silently ship without it (would fall back to body re-parsing).
Adding a future routing param is one entry in inventory.HeaderParams.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@SamMorrowDrums SamMorrowDrums marked this pull request as ready for review June 29, 2026 15:07
@SamMorrowDrums SamMorrowDrums requested a review from a team as a code owner June 29, 2026 15:07
Copilot AI review requested due to automatic review settings June 29, 2026 15:07
Copilot AI reviewed Jun 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Upgrades the MCP Go SDK to a v1.7.0 pre-release that supports the newer stateless MCP spec (including server/discover) while keeping the server’s tool surface documented and CI diffing stable across spec versions.

Changes:

  • Bumped github.com/modelcontextprotocol/go-sdk from v1.6.1 to v1.7.0-pre.1, pulling in new indirect deps (golang.org/x/sync, golang.org/x/time) and updating go.mod/go.sum.
  • Updated inventory/tool registration to (a) recognize server/discover in per-request inventory filtering and (b) annotate routing-relevant tool input params (owner/repo) for MCP header projection; added coverage tests.
  • Regenerated tool schema snapshots and updated license/CI-diff workflow metadata accordingly.
Show a summary per file
File Description
third-party/golang.org/x/time/rate/LICENSE Adds vendored license text for new indirect dependency attribution.
third-party/golang.org/x/sync/errgroup/LICENSE Adds vendored license text for new indirect dependency attribution.
third-party-licenses.windows.md Updates SDK version references; adds x/sync and x/time entries.
third-party-licenses.linux.md Updates SDK version references; adds x/sync and x/time entries.
third-party-licenses.darwin.md Updates SDK version references; adds x/sync and x/time entries.
pkg/inventory/server_tool.go Adds header-parameter schema annotations during tool registration for routing optimization.
pkg/inventory/server_tool_test.go Adds unit test coverage for header-parameter annotation behavior.
pkg/inventory/registry.go Adds server/discover method constant and preserves server instructions across per-request inventories.
pkg/inventory/registry_test.go Adds regression test ensuring per-request inventories preserve server instructions.
pkg/github/header_params_test.go Adds enforcement test ensuring all tools with owner/repo params get header-projection annotations.
pkg/github/toolsnaps/update_pull_request.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_pull_request_title.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_pull_request_state.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_pull_request_draft_state.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_pull_request_branch.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_pull_request_body.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_type.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_title.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_state.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_milestone.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_labels.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_body.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_issue_assignees.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/update_gist.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/unstar_repository.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/unresolve_review_thread.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/ui_get.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/submit_pending_pull_request_review.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/sub_issue_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/star_repository.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/set_issue_fields.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_users.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_repositories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_pull_requests.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_orgs.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_issues.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_commits.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/search_code.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/resolve_review_thread.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/request_pull_request_reviewers.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/request_copilot_review.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/reprioritize_sub_issue.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/remove_sub_issue.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/push_files.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/pull_request_review_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/pull_request_read.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/projects_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/projects_list.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/projects_get.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/merge_pull_request.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/mark_all_notifications_read.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/manage_repository_notification_subscription.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/manage_notification_subscription.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_tags.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_starred_repositories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_secret_scanning_alerts.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_repository_security_advisories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_repository_collaborators.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_releases.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_pull_requests.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_org_repository_security_advisories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_notifications.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_label.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_issues.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_issue_types.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_issue_fields.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_global_security_advisories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_gists.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_discussions.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_discussion_categories.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_dependabot_alerts.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_commits.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_code_scanning_alerts.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/list_branches.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/label_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/issue_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/issue_read.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/issue_dependency_write_ff_issue_dependencies.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/issue_dependency_read_ff_issue_dependencies.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_teams.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_team_members.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_tag.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_secret_scanning_alert.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_repository_tree.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_release_by_tag.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_notification_details.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_me.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_latest_release.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_label.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_global_security_advisory.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_gist.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_file_contents.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_file_blame.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_discussion.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_discussion_comments.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_dependabot_alert.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_commit.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_code_scanning_alert.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/get_code_quality_finding.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/fork_repository.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/dismiss_notification.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/discussion_comment_write.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/delete_pending_pull_request_review.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/delete_file.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_repository.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_pull_request.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_pull_request_review.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_or_update_file.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_issue.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_gist.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/create_branch.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/assign_copilot_to_issue.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_sub_issue.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_reply_to_pull_request_comment.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_pull_request_review_comment.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_pull_request_review_comment_reaction.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_issue_reaction.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_issue_comment.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_issue_comment_reaction.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/add_comment_to_pending_review.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/actions_run_trigger.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/actions_list.snap Toolsnap regen (explicit default hints serialized).
pkg/github/toolsnaps/actions_get.snap Toolsnap regen (explicit default hints serialized).
go.mod Bumps go-sdk version; adds new indirect deps.
go.sum Updates module checksums for go-sdk bump and new indirect deps.
.github/workflows/mcp-diff.yml Pins mcp-server-diff action to a v3 SHA for cross-spec normalization.

Review details

  • Files reviewed: 125/126 changed files
  • Comments generated: 1
  • Review effort level: Low

Comment thread pkg/inventory/server_tool.go
Comment on lines +135 to +139
func AnnotateHeaderParams(tool *mcp.Tool) {
schema, ok := tool.InputSchema.(*jsonschema.Schema)
if !ok || schema == nil {
return
}

@SamMorrowDrums SamMorrowDrums Jun 29, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — fixed in 6c6cae1. AnnotateHeaderParams no longer mutates the shared schema. Since RegisterFunc shallow-copies ServerTool.Tool, the *jsonschema.Schema and its per-property Extra maps were shared with the original definition, so per-request registration (remote server) could race — and fatally panic — on the same Extra map. It now clones only what it touches (a fresh schema value, a cloned Properties map, and fresh property schemas + Extra maps for the annotated params) and leaves the original untouched. Added TestAnnotateHeaderParams_DoesNotMutateOriginal plus a 64-goroutine TestAnnotateHeaderParams_ConcurrentRegistrationIsRaceFree; go test -race is clean.

fix(inventory): clone schema before header annotation to avoid shared…
6c6cae1 
…-map race

AnnotateHeaderParams mutated the *jsonschema.Schema (and per-property Extra
maps) shared with the original tool definition via the caller's shallow copy.
Under per-request registration (remote server), concurrent requests could race
on — and fatally panic from — the same Extra map. Now clone only what we touch
(schema value, Properties map, annotated property schemas + their Extra maps);
the original is never written. Adds a no-mutation test and a 64-goroutine
race regression (go test -race clean).

Addresses Copilot review on #2787.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@SamMorrowDrums