Upgrade MCP Go SDK to v1.7.0

[Copilot]

Updates the gateway’s core MCP dependency from github.com/modelcontextprotocol/go-sdk v1.6.1 to v1.7.0 while preserving canary coverage for SDK-specific retry and tool-validation behavior.

• Dependency update

  • Bump github.com/modelcontextprotocol/go-sdk to v1.7.0.
  • Record new transitive golang.org/x/sync and golang.org/x/time requirements.

• SDK fixture compatibility

  • Update HTTP transport canaries to return a JSON-RPC MethodNotFound response for the SDK’s new server/discover probe.
  • Return 202 Accepted for initialization notifications.
  • Echo initialize request IDs in the minimal connection fixture.

if method == "server/discover" {
    _ = json.NewEncoder(w).Encode(map[string]interface{}{
        "jsonrpc": "2.0",
        "id":      req["id"],
        "error": map[string]interface{}{
            "code":    -32601,
            "message": `method not found: "server/discover"`,
        },
    })
    return
}

• Error expectation alignment
  • Update the backend tool-registration test to assert the SDK’s structured backend-error path.

• Fixes [go-fan] Go Module Review: modelcontextprotocol/go-sdk #10710

[Copilot]

Pull request overview

Upgrades the MCP Go SDK to v1.7.0 and adapts compatibility fixtures and error assertions.

Changes:

• Bumps the SDK and transitive dependencies.
• Handles the new server/discover probe in test fixtures.
• Aligns backend error expectations with v1.7.0.

Show a summary per file

File	Description
go.mod	Updates dependency versions.
go.sum	Records updated checksums.
internal/mcp/connect_timeout_test.go	Updates the minimal handshake fixture.
internal/mcp/http_transport_test.go	Adapts the retry canary fixture.
internal/server/register_tools_from_backend_test.go	Updates the expected SDK error path.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/5 changed files
• Comments generated: 2
• Review effort level: Balanced

[lpcox]

@copilot address review feedback and fix failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/31038901757/job/92437038393?pr=10734

[Copilot]

@copilot address review feedback and fix failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/31038901757/job/92437038393?pr=10734

Addressed in 2e6ce16 (fixed test-race CI failure caused by the SDK's new server/discover probe, plus the require.NoError-in-goroutine issue) and 0bb6e39 (bypassed WrapWithSessionAutoInit for stateless 2026-07-28+ protocol requests so they aren't treated as legacy clients). Full go test -race ./internal/... suite passes.

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents via bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway exposes only 22 read-only MCP tools; all 7 write tool calls return Error [-32602]: unknown tool — gateway-level enforcement confirmed.
• Parts D/E: gh CLI has no GH_TOKEN, so all REST/GraphQL writes blocked by missing authentication.

Overall: PASS

Run: §31056783251

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool gateway error	BLOCKED	✅
C	CLI	reads (github list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Notes:

• Part B: Gateway refused all 7 write tools with MCP error [-32602] unknown tool "<name>" — write tools are not registered on the gateway, enforcing read-only at the MCP layer.
• Parts D & E: gh CLI is unauthenticated (no GH_TOKEN); all REST and GraphQL write attempts rejected before reaching the API.

References: §31056783215

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool — gateway blocks write tools absent from allowed set	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh: GH_TOKEN not set — unauthenticated, all refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh: GH_TOKEN not set — unauthenticated, all refused	BLOCKED	✅

Overall: PASS

Note: Part B refusals are gateway-enforced (write tools absent from the MCP tool manifest served by mcpg). Parts D & E blocked by unauthenticated gh CLI (no GH_TOKEN), consistent with read-only token scopes.

References: §31056783341

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime