Trylle

This release brings full support for protocol version 2026-07-28. The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

mcp: Implement support for SEP-2575 on client side by @guglielmo-san (#975)
mcp: Implement server-side support for discover method (SEP-2575) by @guglielmo-san (#987)
mcp: Implement stateless server (SEP-2575) by @guglielmo-san (#965)
mcp: add support for logging level (SEP-2575) by @guglielmo-san (#997)
mcp: Remove resumability and introduce MissingRequiredClientCapability error data by @guglielmo-san (#1005)
mcp: remove session header handling in stateless mode by @maciej-kisiel (#952)
mcp: do not call DELETE for sessionless & doc adjustments by @maciej-kisiel (#960)
mcp: Implement retry on advised supportedVersions in UnsupportedProtocolVersion error by @guglielmo-san (#989)
mcp: Enable legacy initialize fallback on any error by @guglielmo-san (#1014)

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

mcp: Implement subscriptions/listen rpc (SEP-2575) by @guglielmo-san (#1007)
mcp: refactor notification of subscribed sessions by @guglielmo-san (#1018)

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

feat: multi-round-trip request implementation (SEP-2322) by @yarolegovich (#950)

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

mcp: add ttl for list results (SEP-2549) by @guglielmo-san (#1008)
mcp: add Cacheable fields to DiscoverResult by @guglielmo-san (#1022)

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

mcp: HTTP Header Standardization for x-mcp-header by @guglielmo-san (#915)
mcp: fix http-standardization (SEP-2243) by @guglielmo-san (#1010)

Deprecation of roots, sampling, and logging (SEP-2577)

Roots, sampling, and logging are formally deprecated on the 2026-07-28 revision. The SDK continues to expose the corresponding Go types for backward compatibility with older peers, but new servers should not rely on them.

mcp: Deprecate roots, sampling and logging (SEP-2577) by @guglielmo-san (#1017)

Behavior changes guarded by MCPGODEBUG

Seven escape-hatch flags are added in this release to restore behavior that changed as part of spec-compliance fixes. All will be removed in v1.9.0.

customresnotfounderrcode=1 — restore the old -32002 code for ResourceNotFoundError.
hintomitempty=1 — restore omitempty on ToolAnnotations.ReadOnlyHint and IdempotentHint. The default now always serializes these fields because the Go types are bare bool (not *bool), so omitting false made it indistinguishable from "unset".
allowsessionsinstateless=1 — restore session-id handling on stateless streamable HTTP servers (read/write Mcp-Session-Id, accept DELETE). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return 405 Method Not Allowed for DELETE.
nomethodnotfoundcodeinerror=1 — restore the previous STDIO behavior where the JSON-RPC MethodNotFound (-32601) code is omitted from the error response for unhandled methods. The default now includes the code.
noprotocolerrorbody=1 — restore the previous streamable HTTP client behavior of not decoding the JSON-RPC error body of a non-2xx HTTP response. The default now surfaces the underlying JSON-RPC error.
nowrapinvalidparams=1 — restore the previous behavior of returning raw unmarshalParams errors from receiving handlers instead of wrapping them as a JSON-RPC -32602 Invalid params error. Introduced by #1087.
disablecompleteparamsvalidation=1 — restore the previous behavior of accepting completion/complete responses without validating the presence of the completion params object. Introduced by #1080.

Other Changes to the SDK

Streamable HTTP transport:

mcp: allow opt-in to cancel handler ctx on aborted POST by @guglielmo-san (#1099)
mcp: enforce body size limit in Streamable connection by @guglielmo-san (#1055)
mcp: close HTTP response body from DELETE request in streamableClientConn.Close by @blackwell-systems (#929)
mcp: write SSE comment on standalone stream so HTTP/2 reverse proxies flush HEADERS frame by @jchangx (#938)
mcp: refactor streamable handler control flow by @maciej-kisiel (#949)
mcp: add MCPGODEBUG for opt-in Content-Type check by @guglielmo-san (#1012)
fix: prevent duplicate in-flight request IDs by @guglielmo-san (#1011)
fix: reject duplicate initialize requests by @he-yufeng (#962)
fix(jsonrpc2): decode requests when method key is present by @piyushbag (#1000)

Custom methods and MCPGODEBUG-guarded fixes:

mcp: Allow registration of custom JSON-RPC methods by @guglielmo-san (#956)
mcp: wrap unmarshalParams with jsonrpc error by @guglielmo-san (#1087)
mcp: add param check for CompleteResult by @guglielmo-san (#1080)

Additional spec-compliance fixes:

mcp: update return meta in DiscoverResult (SEP-2575) by @guglielmo-san (#1097)
mcp: add return type to subscriptions/listen by @guglielmo-san (#1088)
mcp: reject calls to server/discover for <2026-07-28 requests by @guglielmo-san (#1084)
mcp: include resultType on new-protocol responses by @ychampion (#1060)
mcp: infer elicit mode from ElicitParams by @guglielmo-san (#1078)
mcp: do not ApplyDefault when res.Content == nil by @guglielmo-san (#1069)
mcp: do not exclude Notifications from carrying InitializeParams in Meta by @guglielmo-san (#1049)
mcp: cap negotiated protocolVersion in legacy initialize to protocolVersion20251125 by @guglielmo-san (#1051)
mcp: make NotificationSubscriptions a mandatory field by @guglielmo-san (#1050)
mcp: do not enforce TTL on cached tool by @guglielmo-san (#1053)
mcp: block server-initiated requests (SEP-2322) by @guglielmo-san (#1057)
fix: extra wrapper for input response map by @yarolegovich (#1045)
fix: do not omitempty ReadOnlyHint in ToolAnnotations by @pvlbzn (#908)
fix: add implementation description metadata by @he-yufeng (#981)
fix(mcp): prevent SIGSEGV in AddTool when schema is nil by @wucm667 (#918)
mcp: tool.InputSchema and tool.OutputSchema validation (SEP-2106) by @guglielmo-san (#1009)
mcp: update JSON-RPC error codes to align with updated MCP specification by @guglielmo-san (#1016)
mcp: bump protocol version from 2026-06-30 to 2026-07-28 by @guglielmo-san (#1015)
mcp: add 2026-07-28 to the supported protocol versions by @guglielmo-san (#1020)
mcp: derive Mcp-Protocol-Version header from the outgoing message by [@jan-xyz]

Auth and OAuth:

auth: support OAuth2 session persistence by @smlx (#1058)
mcp: align resource not found error code with SEP-2164 by @yarolegovich (#931)
mcp: OIDC-Flavored Refresh Token Guidance (SEP-2207) by @guglielmo-san (#939)
mcp: add client-side scope accumulation (SEP-2350) by @guglielmo-san (#944)
mcp: add optional issuer validator for pre-registered client validation (SEP-2352) by @guglielmo-san (#946)
auth: issuer mix-up mitigation (SEP-2468) by @max-stytch (#859)
auth: compare auth server metadata issuer ignoring trailing slash by @gainsley (#955)
auth: bind refreshing token source to a background context, not the request ctx by @toabctl (#988)
auth: add ClockSkew option to RequireBearerTokenOptions by @BorisTyshkevich (#969)
auth: add AllowMissingExpiration option to RequireBearerTokenOptions by @BorisTyshkevich (#971)
oauthex: add MatchesResource helper (RFC 9728/8707 audience comparison) by @BorisTyshkevich (#970)
fix: handle oauth2.RetrieveError during token refresh by @smlx (#917)

Session, keepalive and misc:

mcp: use golang.org/x/time/rate for LoggingHandler rate limiting by @wucm667 (#927)
mcp: add configurable keepalive failure threshold by @tdabasinskas (#982)
mcp: remove outdated comment by @guglielmo-san (#1003)

Conformance tests, documentation and CI:

mcp: add integration for server conformance tests by @guglielmo-san (#1054)
mcp: add conformance tests on client by @guglielmo-san (#1063)
mcp: Upgrade conformance test to latest available deployment by @guglielmo-san (#1021)
mcp: add documentation for new protocol version by @guglielmo-san (#1019)
mcp: update docs references by @guglielmo-san (#1023)
docs: update docs by @guglielmo-san (#1089)
docs: update troubleshoot.md to include resultType by @guglielmo-san (#1081)
ci: update dependabot rules by @guglielmo-san (#1059)
ci: fix nightly runs by @guglielmo-san (#1086)
build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot (#922)
build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 by @dependabot (#986)
build(deps): bump the codeql-action group with 3 updates by @dependabot (#1064)
build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot (#923)
build(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot (#1065)
build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot (#921)
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot (#920)
build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot (#1040)
build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot (#1038)
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot (#1066)
build(deps): bump github/codeql-action/upload-sarif from 4.36.0 to 4.36.2 by @dependabot (#1039)

New Contributors

@MatyasVondraOutreach made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/877
@rafaeljusto made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/878
@begelundmuller made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/856
@Dinesht04 made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/883
@N-Masi made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/896
@jpugliesi made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/888
@blackwell-systems made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/929
@smlx made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/917
@yarolegovich made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/931
@wucm667 made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/918
@jchangx made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/938
@gainsley made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/955
@he-yufeng made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/962
@pvlbzn made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/908
@max-stytch made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/859
@tdabasinskas made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/982
@BorisTyshkevich made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/971
@piyushbag made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/1000
@toabctl made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/988
@ychampion made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/1060
@jan-xyz made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/1107
@george1410 made their first contribution in https://github.com/modelcontextprotocol/go-sdk/pull/1106

Full Changelog: https://github.com/modelcontextprotocol/go-sdk/compare/v1.6.0...v1.7.0