{"id":11862189,"name":"github.com/modelcontextprotocol/go-sdk","ecosystem":"go","description":"","homepage":"https://github.com/modelcontextprotocol/go-sdk","licenses":"Apache-2.0,CC-BY-4.0,MIT","normalized_licenses":["Apache-2.0","CC-BY-4.0","MIT"],"repository_url":"https://github.com/modelcontextprotocol/go-sdk","keywords_array":[],"namespace":"github.com/modelcontextprotocol","versions_count":33,"first_release_published_at":"2025-07-01T17:49:23.000Z","latest_release_published_at":"2026-09-04T08:08:52.000Z","latest_release_number":"v1.8.0","last_synced_at":"2026-10-07T09:19:16.190Z","created_at":"2025-07-02T10:35:30.370Z","updated_at":"2026-10-07T15:19:07.873Z","registry_url":"https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk","install_command":"go get github.com/modelcontextprotocol/go-sdk","documentation_url":"https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk#section-documentation","metadata":null,"repo_metadata":{"id":301224744,"uuid":"971300888","full_name":"modelcontextprotocol/go-sdk","owner":"modelcontextprotocol","description":"The official Go SDK for Model Context Protocol servers and clients. Maintained in collaboration with Google.","archived":false,"fork":false,"pushed_at":"2026-10-02T15:24:41.000Z","size":5555,"stargazers_count":5180,"open_issues_count":117,"forks_count":565,"subscribers_count":57,"default_branch":"main","last_synced_at":"2026-10-03T02:59:14.533Z","etag":null,"topics":["go","mcp"],"latest_commit_sha":null,"homepage":"https://modelcontextprotocol.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/modelcontextprotocol.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-04-23T10:07:33.000Z","updated_at":"2026-10-02T17:17:17.000Z","dependencies_parsed_at":"2025-07-11T23:23:40.468Z","dependency_job_id":"203a593f-1823-439b-ae74-b15b95f96aee","html_url":"https://github.com/modelcontextprotocol/go-sdk","commit_stats":null,"previous_names":["modelcontextprotocol/go-sdk"],"tags_count":32,"template":false,"template_full_name":null,"purl":"pkg:github/modelcontextprotocol/go-sdk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/modelcontextprotocol","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/sbom","scorecard":{"id":1245066,"data":{"date":"2026-03-20T23:48:33Z","repo":{"name":"github.com/modelcontextprotocol/go-sdk","commit":"ea161959d7c87bd3d4bbd63cfa8df01d3ab3b304"},"scorecard":{"version":"v5.3.0","commit":"c22063e786c11f9dd714d777a687ff7c4599b600"},"score":9.5,"checks":[{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#security-policy"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dependency-update-tool"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#packaging"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#binary-artifacts"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#code-review"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:26","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:27","Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yml:23","Info: topLevel permissions set to 'read-all': .github/workflows/codeql.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/conformance.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/docs-check.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly.yml:10","Info: topLevel permissions set to 'read-all': .github/workflows/publish-docs.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:10","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  22 out of  22 GitHub-owned GitHubAction dependencies pinned","Info:   6 out of   6 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#cii-best-practices"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#signed-releases"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#vulnerabilities"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'","Info: 'stale review dismissal' is required to merge on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is required - but no codeowners file found in repo","Info: 'last push approval' is required to merge on branch 'main'","Info: 'up-to-date branches' is required to merge on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#branch-protection"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: GoBuiltInFuzzer integration found: internal/json/json_test.go:105","Info: GoBuiltInFuzzer integration found: internal/json/json_test.go:138"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#fuzzing"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#sast"}},{"name":"CI-Tests","score":10,"reason":"30 out of 30 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#ci-tests"}},{"name":"Contributors","score":10,"reason":"project has 4 contributing companies or organizations","details":["Info: found contributions from: Smart-Class, google, postgraduate, software engneer"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#contributors"}}]},"last_synced_at":"2026-03-21T03:25:19.869Z","repository_id":301224744,"created_at":"2026-03-21T03:25:19.870Z","updated_at":"2026-03-21T03:25:19.870Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343072799,"owners_count":37969659,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-03T02:00:07.567Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"modelcontextprotocol","name":"Model Context Protocol","uuid":"182288589","kind":"organization","description":"An open protocol that enables seamless integration between LLM applications and external data sources and tools.","email":null,"website":"https://modelcontextprotocol.io","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/182288589?v=4","repositories_count":42,"last_synced_at":"2026-10-02T18:46:23.908Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/modelcontextprotocol","funding_links":[],"total_stars":189110,"followers":51049,"following":0,"created_at":"2024-11-25T17:24:25.327Z","updated_at":"2026-10-02T18:46:23.931Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/modelcontextprotocol","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/modelcontextprotocol/repositories"},"tags":[{"name":"v1.8.0-pre.2","sha":"3f3b699b2b67e1ed033a63d6651671dab53c2d32","kind":"tag","published_at":"2026-09-04T09:03:35.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.8.0-pre.2","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0-pre.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.8.0-pre.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.8.0-pre.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.8.0-pre.2/manifests"},{"name":"v1.8.0-pre.1","sha":"830f0b76e7d4ed2f2b77ca9eb4c481d880771fff","kind":"tag","published_at":"2026-09-04T08:38:11.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.8.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.8.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.8.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.8.0-pre.1/manifests"},{"name":"v1.7.0","sha":"bc72835f62eb94d0fb484439f886b6885b075f36","kind":"tag","published_at":"2026-07-28T12:10:11.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.7.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0/manifests"},{"name":"v1.7.0-pre.3","sha":"827f90ba0c13edb546028df42fadc9f1211a4ff2","kind":"tag","published_at":"2026-07-17T11:54:48.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.7.0-pre.3","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0-pre.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.7.0-pre.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.3/manifests"},{"name":"v1.7.0-pre.2","sha":"b426fbf6153b1be855a79a6d616bee0796ec75be","kind":"tag","published_at":"2026-07-09T09:09:25.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.7.0-pre.2","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0-pre.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.7.0-pre.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.2/manifests"},{"name":"v1.7.0-pre.1","sha":"22d4988a164e4bdff39f49fe1bb063b84e83c431","kind":"tag","published_at":"2026-06-24T12:58:25.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.7.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.7.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.7.0-pre.1/manifests"},{"name":"v1.6.1","sha":"d454bbaf06a342aee5336df3370321d9cdec2478","kind":"tag","published_at":"2026-05-22T11:33:58.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.6.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.1/manifests"},{"name":"v1.6.0-pre.1","sha":"f5f2015413f17f578fbacc839d2c05d0fdb3f1cc","kind":"tag","published_at":"2026-04-30T11:54:04.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.6.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.6.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.6.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.0-pre.1/manifests"},{"name":"v1.6.0","sha":"f5f2015413f17f578fbacc839d2c05d0fdb3f1cc","kind":"tag","published_at":"2026-04-30T08:57:16.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.6.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.6.0/manifests"},{"name":"v1.5.0","sha":"d3fd25b68a4b966b5f788a0b49e4ddf3e6048992","kind":"tag","published_at":"2026-04-07T13:13:21.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.5.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.5.0/manifests"},{"name":"v1.5.0-pre.1","sha":"d3fd25b68a4b966b5f788a0b49e4ddf3e6048992","kind":"tag","published_at":"2026-03-31T11:43:11.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.5.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.5.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.5.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.5.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.5.0-pre.1/manifests"},{"name":"v1.4.1","sha":"580f2a09be5c5b7ed4d868aa74ad1019dfd5160a","kind":"tag","published_at":"2026-03-13T10:43:47.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.4.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"c9317fb5b75328ca2faeaf8ea0e23a53c37de49f","kind":"tag","published_at":"2026-02-27T14:31:17.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.4.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.4.0/manifests"},{"name":"v1.3.1","sha":"6e8ca568e4f259fa33445e8a637057751cb26787","kind":"tag","published_at":"2026-02-18T16:02:43.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.3.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"6b75899fd7dbc168b44b9403b7556be077f88fee","kind":"commit","published_at":"2026-01-25T18:48:35.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.3.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.0/manifests"},{"name":"v1.3.0-pre.1","sha":"6b75899fd7dbc168b44b9403b7556be077f88fee","kind":"commit","published_at":"2026-01-25T18:48:35.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.3.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.3.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.3.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.3.0-pre.1/manifests"},{"name":"v1.2.0","sha":"411d5a049ae1006cf01ab9f5ac49d249ab3e8e2b","kind":"commit","published_at":"2025-12-19T21:44:10.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.2.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0/manifests"},{"name":"v1.2.0-pre.2","sha":"411d5a049ae1006cf01ab9f5ac49d249ab3e8e2b","kind":"commit","published_at":"2025-12-19T21:44:10.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.2.0-pre.2","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.2.0-pre.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.2.0-pre.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0-pre.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0-pre.2/manifests"},{"name":"v1.2.0-pre.1","sha":"875d1d30c2afd8261a0bb2fb3cb9df9e1515c526","kind":"commit","published_at":"2025-12-12T18:49:41.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.2.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.2.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.2.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.2.0-pre.1/manifests"},{"name":"v1.1.0-pre.2","sha":"72afbc91bd0d3b6b9fd2d2b6a21556a28c668b5b","kind":"commit","published_at":"2025-10-29T14:08:40.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.1.0-pre.2","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.1.0-pre.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.1.0-pre.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0-pre.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0-pre.2/manifests"},{"name":"v1.1.0","sha":"72afbc91bd0d3b6b9fd2d2b6a21556a28c668b5b","kind":"commit","published_at":"2025-10-29T14:08:40.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.1.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0/manifests"},{"name":"v1.1.0-pre.1","sha":"1a907bcd6fddbac1116145f81fa7bb9f76d59b1a","kind":"commit","published_at":"2025-10-23T13:29:53.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.1.0-pre.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.1.0-pre.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.1.0-pre.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0-pre.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.1.0-pre.1/manifests"},{"name":"v1.0.0","sha":"1c3f38f777421774329bc81aefec0e8c0caffdb0","kind":"commit","published_at":"2025-09-30T20:07:07.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v1.0.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v1.0.0/manifests"},{"name":"v0.8.0","sha":"ab092510d20a23bed672a27164957e0ff1104bc7","kind":"commit","published_at":"2025-09-26T18:16:10.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.8.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.8.0/manifests"},{"name":"v0.7.0","sha":"07f6c490c68284a1f152ec9c0f71e2861b0e687d","kind":"commit","published_at":"2025-09-24T18:07:27.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.7.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"8c42b69817fcdc11f1249282fc5c43ff7fa8feaa","kind":"commit","published_at":"2025-09-19T17:01:57.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.6.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.6.0/manifests"},{"name":"v0.5.0","sha":"c2c810bf40eb390df87680736fa9efd642b399dc","kind":"commit","published_at":"2025-09-12T16:00:54.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.5.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.5.0/manifests"},{"name":"v0.4.0","sha":"4656930de8ce967845da3e16c6afe31b260d66a4","kind":"commit","published_at":"2025-09-05T20:57:02.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.4.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"8f11a868987f493ed074b2297a4c7bf8a2003939","kind":"commit","published_at":"2025-08-29T19:28:05.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.3.1","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"f37e549e2584381b023db70df02cdfe5a586c16d","kind":"commit","published_at":"2025-08-22T20:03:15.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.3.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"78a66a438a4ef06fa50c8e5d6c559669f26ccd3b","kind":"commit","published_at":"2025-07-11T12:08:14.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.2.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.2.0/manifests"},{"name":"v0.1.0","sha":"9b6327b3b7b3d8e57e74b59b509cceca3754e91d","kind":"commit","published_at":"2025-07-01T17:49:23.000Z","download_url":"https://codeload.github.com/modelcontextprotocol/go-sdk/tar.gz/v0.1.0","html_url":"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/modelcontextprotocol/go-sdk@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-10-03T10:54:01.273Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":5.669780822233416,"dependent_packages_count":5.312670504468068,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":5.4912256633507415},"purl":"pkg:golang/github.com/modelcontextprotocol/go-sdk","advisories":[{"uuid":"GSA_kwCzR0hTQS14dzU5LWh2bTItOHBqNs4ABUk1","url":"https://github.com/advisories/GHSA-xw59-hvm2-8pj6","title":"DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost","description":"The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with `StreamableHTTPHandler` or `SSEHandler`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.\n\nNote that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.\n\nServers created via `StreamableHTTPHandler` or `SSEHandler` now have this protection enabled by default when binding to `localhost`. Users are advised to update to version `1.4.0` to receive this automatic protection.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-01T21:09:09.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.6,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6","https://nvd.nist.gov/vuln/detail/CVE-2026-34742","https://github.com/modelcontextprotocol/go-sdk/pull/760","https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d","https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/security/cve/CVE-2026-34742","https://bugzilla.redhat.com/show_bug.cgi?id=2454608","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34742.json","https://github.com/advisories/GHSA-xw59-hvm2-8pj6"],"source_kind":"github","identifiers":["GHSA-xw59-hvm2-8pj6","CVE-2026-34742"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-01T22:00:08.746Z","updated_at":"2026-09-25T12:04:49.971Z","epss_percentage":0.00664,"epss_percentile":0.49534,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14dzU5LWh2bTItOHBqNs4ABUk1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14dzU5LWh2bTItOHBqNs4ABUk1","packages":[{"ecosystem":"go","package_name":"github.com/modelcontextprotocol/go-sdk","versions":[{"first_patched_version":"1.4.0","vulnerable_version_range":"\u003c 1.4.0"}],"purl":"pkg:go/github.com%2Fmodelcontextprotocol%2Fgo-sdk"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14dzU5LWh2bTItOHBqNs4ABUk1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04OXh2LTJqNmYtcWhjOM4ABT3L","url":"https://github.com/advisories/GHSA-89xv-2j6f-qhc8","title":"Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk","description":"The Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution.\n\n#### Impact:\n\nA malicious website may have been able to send cross-site POST requests with `Content-Type: text/plain`, which due to CORS-safelisted properties would reach the MCP message handling without any CORS preflight barrier.\n\n#### Fix:\n\nThe SDK was modified to perform `Content-Type` header validation for POST requests and introduced a configurable protection for verifying the origin of the request in commit a433a83. Users are advised to update to v1.4.1 to use this additional protection.\n\nNote: v1.4.1 requires Go 1.25 or later.\n\n#### Credits:\n\nThank you to Lê Minh Quân for reporting the issue.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-19T16:42:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":["https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-89xv-2j6f-qhc8","https://github.com/modelcontextprotocol/go-sdk/commit/a433a831d6e5d5ac3b9e625a8095aa8eaa040dfc","https://nvd.nist.gov/vuln/detail/CVE-2026-33252","https://github.com/advisories/GHSA-89xv-2j6f-qhc8"],"source_kind":"github","identifiers":["GHSA-89xv-2j6f-qhc8","CVE-2026-33252"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-19T17:00:09.196Z","updated_at":"2026-10-07T15:04:54.487Z","epss_percentage":0.00212,"epss_percentile":0.10516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OXh2LTJqNmYtcWhjOM4ABT3L","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04OXh2LTJqNmYtcWhjOM4ABT3L","packages":[{"ecosystem":"go","package_name":"github.com/modelcontextprotocol/go-sdk","versions":[{"first_patched_version":"1.4.1","vulnerable_version_range":"\u003c= 1.4.0"}],"purl":"pkg:go/github.com%2Fmodelcontextprotocol%2Fgo-sdk"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OXh2LTJqNmYtcWhjOM4ABT3L/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xMzgyLXZjOHEtN2poas4ABT2q","url":"https://github.com/advisories/GHSA-q382-vc8q-7jhj","title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","description":"The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.\n\n#### Impact\n\nWhen combined with duplicate keys, the described behavior leads to a \"last key wins\" resolution that could override the intended MCP message. This had the potential for:\n  - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n  - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n####  Fix:\n\nThe `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.\n\n#### Credits:\nThank you to Francesco Lacerenza (Doyensec) for reporting this issue.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-19T12:44:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","references":["https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-q382-vc8q-7jhj","https://github.com/modelcontextprotocol/go-sdk/commit/724dd47aa3431b9d4cf9ac2eebbf7b38a629afca","https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb","https://github.com/advisories/GHSA-q382-vc8q-7jhj"],"source_kind":"github","identifiers":["GHSA-q382-vc8q-7jhj"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-19T13:00:11.279Z","updated_at":"2026-09-19T09:04:41.244Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMzgyLXZjOHEtN2poas4ABT2q","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xMzgyLXZjOHEtN2poas4ABT2q","packages":[{"ecosystem":"go","package_name":"github.com/modelcontextprotocol/go-sdk","versions":[{"first_patched_version":"1.4.1","vulnerable_version_range":"\u003c= 1.4.0"}],"purl":"pkg:go/github.com%2Fmodelcontextprotocol%2Fgo-sdk"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMzgyLXZjOHEtN2poas4ABT2q/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13dmoyLTk2d3AtZnEzZs4ABS3u","url":"https://github.com/advisories/GHSA-wvj2-96wp-fq3f","title":"MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity","description":"The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:\"method\" would also match \"Method\", \"METHOD\", etc. Additionally, Go's standard library folds the Unicode characters ſ (U+017F) and K (U+212A) to their ASCII equivalents s and k, meaning fields like \"paramſ\" would match \"params\". This violated the JSON-RPC 2.0 specification, which defines exact field names.\n\n#### Impact:\n\nA malicious MCP peer may have been able to send protocol messages with non-standard field casing (e.g., \"Method\" instead of \"method\") that the SDK would silently accept. This had the potential for:\n  - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n  - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n####  Fix:\n\nGo's standard JSON unmarshaling was replaced with a case-sensitive decoder (github.com/segmentio/encoding) in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.\n\n#### Credits:\nMCP Go SDK thanks Francesco Lacerenza (Doyensec) for reporting this issue.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-26T22:20:08.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":["https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f","https://nvd.nist.gov/vuln/detail/CVE-2026-27896","https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0","https://github.com/advisories/GHSA-wvj2-96wp-fq3f"],"source_kind":"github","identifiers":["GHSA-wvj2-96wp-fq3f","CVE-2026-27896"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-26T23:00:08.585Z","updated_at":"2026-10-07T15:05:27.443Z","epss_percentage":0.00457,"epss_percentile":0.37529,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13dmoyLTk2d3AtZnEzZs4ABS3u","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13dmoyLTk2d3AtZnEzZs4ABS3u","packages":[{"ecosystem":"go","package_name":"github.com/modelcontextprotocol/go-sdk","versions":[{"first_patched_version":"1.3.1","vulnerable_version_range":"\u003c 1.3.1"}],"purl":"pkg:go/github.com%2Fmodelcontextprotocol%2Fgo-sdk"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13dmoyLTk2d3AtZnEzZs4ABS3u/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/modelcontextprotocol/go-sdk","docker_dependents_count":1,"docker_downloads_count":11932,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/modelcontextprotocol/go-sdk","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/modelcontextprotocol/go-sdk/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-02T12:02:22.937Z","issues_count":270,"pull_requests_count":408,"avg_time_to_close_issue":1325288.310810811,"avg_time_to_close_pull_request":563826.4247104247,"issues_closed_count":148,"pull_requests_closed_count":259,"pull_request_authors_count":122,"issue_authors_count":128,"avg_comments_per_issue":2.3777777777777778,"avg_comments_per_pull_request":0.7598039215686274,"merged_pull_requests_count":218,"bot_issues_count":0,"bot_pull_requests_count":6,"past_year_issues_count":106,"past_year_pull_requests_count":156,"past_year_avg_time_to_close_issue":1546994.5918367347,"past_year_avg_time_to_close_pull_request":1171162.543478261,"past_year_issues_closed_count":49,"past_year_pull_requests_closed_count":92,"past_year_pull_request_authors_count":75,"past_year_issue_authors_count":69,"past_year_avg_comments_per_issue":1.8773584905660377,"past_year_avg_comments_per_pull_request":0.7884615384615384,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":5,"past_year_merged_pull_requests_count":72,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/modelcontextprotocol%2Fgo-sdk/issues","maintainers":[{"login":"yarolegovich","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/yarolegovich"},{"login":"sambhav","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sambhav"},{"login":"h9jiang","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/h9jiang"}],"active_maintainers":[{"login":"yarolegovich","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/yarolegovich"},{"login":"sambhav","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sambhav"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fmodelcontextprotocol%2Fgo-sdk/codemeta","maintainers":[]}