github modelcontextprotocol/go-sdk v1.7.0
on GitHub

6 hours ago

This release brings full support for protocol version 2026-07-28.
The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

Deprecation of roots, sampling, and logging (SEP-2577)

Roots, sampling, and logging are formally deprecated on the 2026-07-28 revision. The SDK continues to expose the corresponding Go types for backward compatibility with older peers, but new servers should not rely on them.

Behavior changes guarded by MCPGODEBUG

Seven escape-hatch flags are added in this release to restore behavior that changed as part of spec-compliance fixes. All will be removed in v1.9.0.

  • customresnotfounderrcode=1 — restore the old -32002 code for ResourceNotFoundError.
  • hintomitempty=1 — restore omitempty on ToolAnnotations.ReadOnlyHint and IdempotentHint. The default now always serializes these fields because the Go types are bare bool (not *bool), so omitting false made it indistinguishable from "unset".
  • allowsessionsinstateless=1 — restore session-id handling on stateless streamable HTTP servers (read/write Mcp-Session-Id, accept DELETE). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return 405 Method Not Allowed for DELETE.
  • nomethodnotfoundcodeinerror=1 — restore the previous STDIO behavior where the JSON-RPC MethodNotFound (-32601) code is omitted from the error response for unhandled methods. The default now includes the code.
  • noprotocolerrorbody=1 — restore the previous streamable HTTP client behavior of not decoding the JSON-RPC error body of a non-2xx HTTP response. The default now surfaces the underlying JSON-RPC error.
  • nowrapinvalidparams=1 — restore the previous behavior of returning raw unmarshalParams errors from receiving handlers instead of wrapping them as a JSON-RPC -32602 Invalid params error. Introduced by #1087.
  • disablecompleteparamsvalidation=1 — restore the previous behavior of accepting completion/complete responses without validating the presence of the completion params object. Introduced by #1080.

Other Changes to the SDK

Streamable HTTP transport:

Custom methods and MCPGODEBUG-guarded fixes:

Additional spec-compliance fixes:

Auth and OAuth:

Session, keepalive and misc:

Conformance tests, documentation and CI:

New Contributors

Full Changelog: v1.6.0...v1.7.0

Check out latest releases or
releases around modelcontextprotocol/go-sdk v1.7.0

Don't miss a new go-sdk release

NewReleases is sending notifications on new releases.

Get notifications