Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: modelcontextprotocol/go-sdk
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.4.0
Choose a base ref
...
head repository: modelcontextprotocol/go-sdk
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.4.1
Choose a head ref
  • 3 commits
  • 22 files changed
  • 1 contributor

Commits on Mar 13, 2026

  1. internal: fix Unicode zero character handling (#841) 

    A fix was submitted to our dependency, tests added to validate the
problematic scenario.

We also added some fuzz tests to check for additional issues, none were
found.
    @maciej-kisiel
    maciej-kisiel committed Mar 13, 2026
    Configuration menu
    Copy the full SHA
    515f11b View commit details
    Browse the repository at this point in the history

  2. auth: allow passing custom http.Client to AuthorizationCodeHandler (#840 

    )
    @maciej-kisiel
    maciej-kisiel committed Mar 13, 2026
    Configuration menu
    Copy the full SHA
    421ddf1 View commit details
    Browse the repository at this point in the history

  3. mcp: verify 'Origin' and 'Content-Type' headers (#842) 

    This PR introduces protection against cross-origin requests by
installing `http.CrossOriginProtection`.
By default, the zero value is used which does not contain any trusted
origins or bypass patterns.
The protection can be customized by providing a custom
`http.CrossOriginProtection` in `mcp.StreamableHTTPOptions`. Currently,
the deny handler set on the protection is ignored.
This default has an MCPGODEBUG option (`disableoriginverification`) to
disable the default protection.
It will be available until `v1.6.0` of the SDK.
We also increase the Go version required by the SDK to 1.25, since this
is the version that introduced `http.CrossOriginProtection`. This is in
line with the SDK's policy of supporting two newest Go versions (1.26
was released in February 2026).

Additionally, we start validating if the `Content-Type` header for
`POST` requests is set to `application/json` to avoid accepting
CORS-safelisted requests.
    @maciej-kisiel
    maciej-kisiel committed Mar 13, 2026
    Configuration menu
    Copy the full SHA
    580f2a0 View commit details
    Browse the repository at this point in the history
Loading