feat: upgrade mcp-go to v0.43.2 with streamable HTTP transport#38
Open
danielheringers wants to merge 8 commits intooisee:mainfrom
Open
feat: upgrade mcp-go to v0.43.2 with streamable HTTP transport#38danielheringers wants to merge 8 commits intooisee:mainfrom
danielheringers wants to merge 8 commits intooisee:mainfrom
Conversation
marianfoo
requested changes
Mar 13, 2026
reports/2026-02-25-001-mcp-go-0.43.2-http-streamable-pr-summary.md
Outdated
Show resolved
Hide resolved
- Revert embedded/deps/embed.go GetDependencyZIP to main branch's switch-based implementation (resolves conflict per reviewer request) - Revert server.go formatting-only changes: struct field alignment, map entry alignment, tool count comment (81 tools, not 41) - Add Origin header validation middleware to ServeStreamableHTTP per MCP spec (prevents DNS rebinding attacks): https://modelcontextprotocol.io/specification/2025-03-26/basic/transports - originValidationMiddleware wraps the MCP handler - isSameOriginHost normalizes 127.0.0.1/::1/localhost as equivalent - Adds listenAndServeFunc var for testability - Updates streamableHTTPStarter interface to include http.Handler - Adds 3 new Origin validation tests + updates existing transport tests - Update report to note GetDependencyZIP test is resolved (commit 5317105) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- CLAUDE.md: keep correct tool count (81/122) + add SAP_TRANSPORT row - README.md: keep correct tool count (122) + add --transport example Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5 tasks
- Config struct: add HTTPAddr field for http-streamable listen address - Serve(): use Config.HTTPAddr when set, falls back to DefaultStreamableHTTPAddr (127.0.0.1:8080) so local usage remains safe by default - main.go: add --http-addr flag and SAP_HTTP_ADDR env var; update verbose log to print the actual resolved address - server_transport_test.go: add TestServe_UsesConfigHTTPAddr covering the Config.HTTPAddr override path Made-with: Cursor
Use SAP_DISABLED_GROUPS=W (or --disabled-groups W) to remove all create/update/delete/execute tools from the MCP tool list entirely, giving a clean read-only context with no write tools visible to the LLM. Covered tools: WriteSource, EditSource, UpdateSource, WriteProgram, WriteClass, UpdateClassInclude, CreateObject, DeleteObject, RenameObject, MoveObject, CloneObject, CreatePackage, CreateTable, CreateTestInclude, CreateAndActivateProgram, CreateClassWithTests, LockObject, UnlockObject, Activate, ActivatePackage, PrettyPrint, SetPrettyPrinterSettings, SetTextElements, ImportFromFile, DeployFromFile, ExecuteABAP, CallRFC, SetBreakpoint, DeleteBreakpoint, AMDPSetBreakpoint, PublishServiceBinding, UnpublishServiceBinding, CreateTransport, ReleaseTransport, DeleteTransport, InstallZADTVSP, InstallAbapGit, InstallDummyTest, UI5UploadFile, UI5DeleteFile, UI5CreateApp, UI5DeleteApp Combine with SAP_READ_ONLY=true for defence-in-depth: SAP_DISABLED_GROUPS=W — tools not shown to LLM SAP_READ_ONLY=true — runtime block if a write is attempted anyway Made-with: Cursor
marianfoo
added a commit
to marianfoo/vibing-steampunk
that referenced
this pull request
Mar 23, 2026
- Revert embedded/deps/embed.go GetDependencyZIP to main branch's switch-based implementation (resolves conflict per reviewer request) - Revert server.go formatting-only changes: struct field alignment, map entry alignment, tool count comment (81 tools, not 41) - Add Origin header validation middleware to ServeStreamableHTTP per MCP spec (prevents DNS rebinding attacks): https://modelcontextprotocol.io/specification/2025-03-26/basic/transports - originValidationMiddleware wraps the MCP handler - isSameOriginHost normalizes 127.0.0.1/::1/localhost as equivalent - Adds listenAndServeFunc var for testability - Updates streamableHTTPStarter interface to include http.Handler - Adds 3 new Origin validation tests + updates existing transport tests - Update report to note GetDependencyZIP test is resolved (commit 5317105) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github.com/mark3labs/mcp-gofromv0.17.0tov0.43.2request.Params.Argumentstorequest.GetArguments()--transport http-streamable)stdioas the default transportChanges
go.mod,go.summcp-goand update transitive depsinternal/mcp/handlers_*.gorequest.GetArguments()internal/mcp/server.goServe,ServeStdio,ServeStreamableHTTP)cmd/vsp/main.go--transportflag andSAP_TRANSPORTenv supportstdio,http-streamable)internal/mcp/arguments_migration_test.gointernal/mcp/server_transport_test.gocmd/vsp/main_test.goREADME.md,ARCHITECTURE.md,CLAUDE.mdTest plan
go test -run TestHandlersUseGetArgumentsAPI ./internal/mcp -vgo test -run "TestServe_|TestServeStreamableHTTP_" ./internal/mcp -vgo test -run "TestValidateConfig_Transport|TestResolveConfig_Transport|TestRootCmdHasTransportFlag" ./cmd/vsp -vgo test ./internal/mcp ./cmd/vspgo test -cover ./internal/mcp ./cmd/vspinternal/mcp:9.1%cmd/vsp:15.1%/mcpinitialize: OKnotifications/initialized: OKtools/list: OK (non-empty list)Notes
go test ./...currently fails inpkg/cache(Example_withSQLite) due CGO/SQLite runtime constraint (CGO_ENABLED=0), which is outside this PR scope.GetDependencyZIPcompatibility behavior inembedded/deps/embed.goto avoid regressions while related upstream discussion is ongoing.Fixes #21