Files
Sam Morrow 225c47cda1 chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec) (#2787)
* chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)

Bumps github.com/modelcontextprotocol/go-sdk v1.6.1 -> v1.7.0-pre.1, the
pre-release that implements the new stateless MCP spec (SEP-2575 server/discover,
SEP-2567 sessionless, MRTR per SEP-2322).

The only source-visible change is tool annotation serialization: the new SDK
drops `omitempty` on ToolAnnotations.ReadOnlyHint and IdempotentHint, so false
values are now emitted explicitly. Regenerated the 113 affected toolsnaps to
match. No behavioural changes; build, vet, test and lint all pass.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: regenerate license files

Auto-generated by license-check workflow

* ci(mcp-diff): pin to cross-spec-aware mcp-server-diff (3c2d5ea)

Pins both the stdio and streamable-http MCP Server Diff jobs to the 3.0
branch of SamMorrowDrums/mcp-server-diff (commit 3c2d5ea), which normalizes
cross-spec-version churn: _meta protocol plumbing, CacheableResult cache
hints, the initialize envelope, and tool-annotation default hints. Without it
the go-sdk v1.6.1 -> v1.7.0-pre.1 bump would surface ~113 spurious
idempotentHint/readOnlyHint:false diffs from the SDK dropping omitempty.

Temporary commit pin; move to the v3.0.0 tag once it ships.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(mcp-diff): bump to a2ba618 (stateless server/discover probe)

a2ba618 adds the SEP-2575 server/discover stateless probe path, so each
server is probed at its own newest supported spec (base v1.6.1 via
initialize/2025-11-25, this branch via server/discover/2026-07-28) rather
than negotiating both down to the legacy handshake. Produces an honest,
signal-only cross-spec diff. Still a temporary commit pin; moves to v3.0.0
once tagged.

Refs: github/copilot-mcp-core#1709

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(mcp-diff): use full commit SHA for action pin

Actions rejects shortened SHAs ('not supported'); use the full
a2ba618c42293fb36e67be88e59c60d5608a302a so the action resolves.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(mcp-diff): track 3.0 HEAD (8fc26d8, becomes v3.0.0)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(inventory): project owner/repo to Mcp-Param-* headers (SEP-2243)

Annotates owner/repo tool params with x-mcp-header so the SDK projects them
to Mcp-Param-owner/Mcp-Param-repo request headers. A remote proxy can route
and filter on owner/repo from headers instead of re-parsing the JSON-RPC body
(headers are SDK-validated against the body). No-op for tools without these
params; old-protocol traffic unaffected.

Refs: github/copilot-mcp-core#1709, #1828

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(inventory): preserve instructions in ForMCPRequest incl. server/discover

ForMCPRequest dropped the generated instructions when narrowing the per-request
inventory, so HTTP server/discover (and initialize) returned empty instructions
even though the full inventory had them. Preserve instructions on the copy and
treat server/discover like initialize. Fixes discover<->initialize parity flagged
on go-sdk#1034 (root cause was here, not the SDK).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(mcp-diff): pin to mcp-server-diff v3.0.0

Release is out; move both jobs from the 3.0-branch SHA to v3.0.0
(3521651, full SHA since Actions rejects short SHAs).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(github): enforce owner/repo header projection across all tools

Export HeaderParams + AnnotateHeaderParams and add a coverage test over the
full all-toolsets inventory asserting every owner/repo param projects to its
Mcp-Param-* header. Guards the remote proxy's per-request header read so a new
tool can never silently ship without it (would fall back to body re-parsing).
Adding a future routing param is one entry in inventory.HeaderParams.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(inventory): clone schema before header annotation to avoid shared-map race

AnnotateHeaderParams mutated the *jsonschema.Schema (and per-property Extra
maps) shared with the original tool definition via the caller's shallow copy.
Under per-request registration (remote server), concurrent requests could race
on — and fatally panic from — the same Extra map. Now clone only what we touch
(schema value, Properties map, annotated property schemas + their Extra maps);
the original is never written. Adds a no-mutation test and a 64-goroutine
race regression (go test -race clean).

Addresses Copilot review on #2787.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-07-01 18:12:12 +02:00

45 lines
1.5 KiB
Go

package github
import (
"context"
"testing"
"github.com/github/github-mcp-server/pkg/inventory"
"github.com/google/jsonschema-go/jsonschema"
"github.com/stretchr/testify/require"
)
// TestAllToolsRoutingParamsGetHeaders enforces that every tool exposing a
// routing-relevant param (owner/repo, per inventory.HeaderParams) has it
// projected to an Mcp-Param-* header. This guards the per-request header
// optimization used by the remote proxy: a future tool must not silently ship
// without its owner/repo header, so it can never fall back to body re-parsing.
func TestAllToolsRoutingParamsGetHeaders(t *testing.T) {
inv, err := NewInventory(stubTranslator).WithToolsets([]string{"all"}).Build()
require.NoError(t, err)
tools := inv.AvailableTools(context.Background())
require.NotEmpty(t, tools)
checked := 0
for _, st := range tools {
tool := st.Tool
inventory.AnnotateHeaderParams(&tool)
schema, ok := tool.InputSchema.(*jsonschema.Schema)
if !ok || schema == nil {
continue
}
for prop, header := range inventory.HeaderParams {
ps, ok := schema.Properties[prop]
if !ok || ps == nil {
continue
}
require.NotNilf(t, ps.Extra, "tool %q param %q missing x-mcp-header annotation", tool.Name, prop)
require.Equalf(t, header, ps.Extra["x-mcp-header"],
"tool %q param %q must project to Mcp-Param-%s", tool.Name, prop, header)
checked++
}
}
require.Positive(t, checked, "expected at least one owner/repo param across all toolsets")
}