Sam Morrow
6e0af328bc
Bumps github.com/modelcontextprotocol/go-sdk from v1.6.0 to v1.6.1 and removes the CrossOriginProtection bypass we previously installed on the StreamableHTTP handler. As of go-sdk v1.6.0 the cross-origin check is opt-in: a nil CrossOriginProtection on StreamableHTTPOptions means no check is run. v1.6.1 also marks the field itself as deprecated (the SDK recommends wrapping the handler with middleware instead, and the field will be removed in v1.8.0). This server authenticates via bearer tokens, not cookies, so the Sec-Fetch-Site CSRF check is unnecessary and would block browser-based MCP clients. Leaving CrossOriginProtection unset preserves that behavior without depending on a deprecated API. Supersedes #2541. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
49 lines
1.9 KiB
Modula-2
49 lines
1.9 KiB
Modula-2
module github.com/github/github-mcp-server
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/go-chi/chi/v5 v5.3.0
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/google/go-github/v87 v87.0.0
|
|
github.com/google/jsonschema-go v0.4.3
|
|
github.com/josephburnett/jd/v2 v2.5.0
|
|
github.com/lithammer/fuzzysearch v1.1.8
|
|
github.com/microcosm-cc/bluemonday v1.0.27
|
|
github.com/modelcontextprotocol/go-sdk v1.6.1
|
|
github.com/muesli/cache2go v0.0.0-20221011235721-518229cd8021
|
|
github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
|
|
github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/yosida95/uritemplate/v3 v3.0.2
|
|
)
|
|
|
|
require (
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/google/go-querystring v1.2.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/sagikazarmark/locafero v0.11.0 // indirect
|
|
github.com/segmentio/asm v1.1.3 // indirect
|
|
github.com/segmentio/encoding v0.5.4 // indirect
|
|
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/net v0.38.0 // indirect
|
|
golang.org/x/oauth2 v0.35.0 // indirect
|
|
golang.org/x/sys v0.41.0 // indirect
|
|
golang.org/x/text v0.28.0 // indirect
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|