golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.7-02): decide the MCP Go SDK

Browse Source 
- decision note for go-sdk v1.8.0 and jsonschema-go v0.4.3 with the
  transitive graph, size, govulncheck result and the build-tag containment
- STACK.md rows for both modules naming the note (D-24)
This commit is contained in:
Jakub Zych
2026-10-22 18:00:16 +02:00
parent 3746675c72
commit 3ea82a1543
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.planning/notes/2026-10-22-mcp-go-sdk.md Normal file
View File

@@ -0,0 +1,48 @@
# Decision: the MCP endpoint uses the official Go SDK behind a build tag
**Date:** 2026-10-22
**Status:** Accepted
**Context:** Phase 19.7 (generic MCP module, D-24, D-25, D-32, D-33), 19.7-RESEARCH.md § "Standard Stack", § "Package Legitimacy Audit", § "Architecture Patterns" (Pattern 8), plan 19.7-02 Task 1 (human legitimacy check, approved 2026-10-22)
## Decision
The framework module `pier` serves the MCP streamable HTTP endpoint on the official Go SDK and reflects tool schemas with the schema library the SDK itself uses.
- **`github.com/modelcontextprotocol/go-sdk` pinned at v1.8.0.** Published 2026-09-04, the newest tag (`@latest` resolves to v1.8.0 on proxy.golang.org, 2026-10-22). Origin `https://github.com/modelcontextprotocol/go-sdk`, commit `3f3b699b2b67e1ed033a63d6651671dab53c2d32`, sum `h1:KIvahhYqwtbeniWVPs3TcXEA7b8jEtwfBpOTAI+Urx4=`. Licence: MIT transitioning to Apache-2.0 (new code Apache-2.0, older contributions MIT until relicensed; documentation CC-BY-4.0). `go 1.25.0` in its go.mod, so no toolchain change. Packages imported: `mcp` (server, sessions, streamable transport, test client), `auth` (bearer middleware, protected resource metadata handler), `oauthex` (the RFC 9728 metadata type), `jsonrpc` (error codes).
- **`github.com/google/jsonschema-go` pinned at v0.4.3.** Published 2026-04-17, the newest tag. Origin `https://github.com/google/jsonschema-go`, commit `8c4ab4f02ef64dcea5502e47a6113e8292944087`, sum `h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=`. Licence MIT. Package imported: `jsonschema` (`ForType` reflection of a tool's input struct, `Resolve` and `Validate` of every call's arguments).
- **Only `modules/pier` imports either module**, plus the tagged `modules/surf/pier_on.go` that imports `pier`. `pact` stays free of both (its `TestPactStaysSDKFree` runs `go list -deps`), so a plugin declaring tools compiles with and without the module.
- **Linked only with the `summercms_mcp` build tag (D-33).** `summer.yaml` `build.tags: [summercms_mcp]` passes it to `go build`, as `summercms_s3` does for the S3 driver. Without the tag `surf.mountPier` stays nil, `go version -m` of the binary lists no `modelcontextprotocol` module, and `mcp.enabled: true` fails boot naming the tag. With the tag the `mcp.enabled` flag still defaults to off (D-30).
- **The SDK keeps stateful sessions only in process memory**, in `StreamableHTTPHandler.sessions`, with no pluggable store and a 404 for an unknown `Mcp-Session-Id`. D-25 (sessions shared across instances through Redis) is therefore built as pier's own session router over the exported `StreamableServerTransport{SessionID}` and `Server.Connect(ctx, t, &ServerSessionOptions{State})`: the JSON-serialisable `ServerSessionState` is stored in Redis and a session is rehydrated on whichever instance receives the next request. The SDK still owns JSON-RPC framing, SSE, protocol negotiation and `list_changed` debouncing; pier bypasses only the private session map. The 2026-07-28 protocol, which the SDK serves only through `StreamableHTTPOptions.Stateless`, gets the SDK's stateless handler next to the stateful router (D-32).
## Measurements
- **New modules in the graph** (measured with `go list -m all` on a scratch module importing `mcp`, `auth`, `oauthex` and `jsonschema`): `github.com/modelcontextprotocol/go-sdk v1.8.0`, `github.com/google/jsonschema-go v0.4.3`, `github.com/segmentio/asm v1.1.3`, `github.com/segmentio/encoding v0.5.4`, `github.com/yosida95/uritemplate/v3 v3.0.2`, `golang.org/x/oauth2 v0.35.0`, `golang.org/x/time v0.15.0`. `golang.org/x/sync` and `golang.org/x/sys` stay at the framework's newer v0.23.0 and v0.48.0 under minimal version selection. `github.com/golang-jwt/jwt/v5`, `golang.org/x/tools`, `github.com/google/go-cmp` and `cloud.google.com/go/compute/metadata` appear in the SDK's go.mod but are not linked by these packages; the framework already requires jwt/v5 and go-cmp at its own versions.
- **Binary size: +2.9 MiB stripped** on a program importing `mcp`, `auth` and `jsonschema` next to a bare `net/http` program (8,835,335 vs 5,832,967 bytes, 19.7-RESEARCH.md). The scratch probe above with `oauthex` added builds to 7,782,663 bytes stripped. An application that already links `x/sys`, `x/oauth2` and `x/time` grows by less. The tag keeps every untagged binary at its current size.
- **Vulnerabilities:** `govulncheck` v1.9.0 (`go run golang.org/x/vuln/cmd/govulncheck@latest ./...` over the scratch module, 2026-10-22): "No vulnerabilities found" in the code and in the imported packages. One module-level finding, GO-2026-5024 (`golang.org/x/sys/windows` `NewNTUnicodeString`, Windows only, fixed in x/sys v0.44.0), concerns the SDK's own minimum x/sys v0.41.0; the framework requires x/sys v0.48.0, above the fix, and no imported package calls the symbol. After the import lands, the same command runs as `go run golang.org/x/vuln/cmd/govulncheck@latest ./modules/pier/...` from the framework root.
## Maintenance risk
The SDK is maintained by the Model Context Protocol organisation together with the Go team, releases monthly, and tracks the specification closely (v1.8.0 supports 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05). The risk is churn, not abandonment: the `allowsessionsinstateless` compatibility knob is announced to go in v1.9.0, and the stateful `initialize` handshake is deprecated by the 2026-07-28 specification. pier contains both: plugins compile against `pact` only, the SDK types never appear in a plugin-facing signature, and the session router is about 300 lines over four exported SDK calls (`NewServer`, `Connect`, `StreamableServerTransport.ServeHTTP`, `NewStreamableHTTPHandler`). Re-check `@latest` before bumping; research's validity note dates the SDK audit at 2026-10-21.
## Rejected alternatives
- **`github.com/mark3labs/mcp-go`.** Not considered: D-24 locks the official SDK, which is the only one that follows the specification's monthly moves and ships the test client pier's smoke tests use.
- **The SDK's `StreamableHTTPHandler` as the whole server.** Its session map is in-memory and unexported; two instances behind one load balancer would answer 404 for each other's sessions. The own router keeps D-25 and reuses every other SDK layer.
- **A hand-written streamable HTTP transport.** JSON-RPC batching rules per protocol version, SSE priming events, `Last-Event-ID` resumption, header validation and version negotiation are specification edge cases the SDK already handles and tests.
- **Always linking pier.** +2.9 MiB on every application for a feature most do not enable; the tag pattern already exists (`summercms_s3`).
## Related dependencies
- **`github.com/redis/go-redis/v9` v9.23.0** (already required, 19.3 `cooler`): session records, sliding TTL and pub/sub fan-out; `github.com/alicebob/miniredis/v2` v2.40.0 (already required) backs the Docker-free session tests.
- **`golang.org/x/oauth2`**: new to the framework's graph through the SDK's `auth` package; already approved in 19.4 for the workspace (`sm-oauthserver-plugin` tests) and in 19.5 (`goth`).
## Package legitimacy
The package-legitimacy seam checks npm, PyPI and crates only, so both modules were [ASSUMED] in research and gated by a blocking human check (plan 19.7-02 Task 1) before any `go get`. The human approved exactly `github.com/modelcontextprotocol/go-sdk@v1.8.0` and `github.com/google/jsonschema-go@v0.4.3` on 2026-10-22, with the proxy origins, commits, sums and licences listed above gathered beforehand. The transitive modules listed under Measurements are covered by the same check.
## Consequences
- The framework `go.mod` gains `github.com/modelcontextprotocol/go-sdk v1.8.0` and `github.com/google/jsonschema-go v0.4.3` as direct requirements, added in the commit after this note (D-24: the note and the STACK.md row precede the import).
- `grep -rl modelcontextprotocol/go-sdk modules --include=*.go` must list only `modules/pier/*` and `modules/surf/pier_on.go`; the phase gate (plan 05) asserts it, together with "only `modules/pier` calls `bouncer.WithDispatch` outside tests".
- `examples/hello` and every application built without the tag carry no MCP code; `go version -m` of such a binary is the proof.
- Applications that enable MCP add `summercms_mcp` to `summer.yaml` `build.tags` and set `mcp.enabled: true`; the `mcp.*` keys are documented in `modules/pier/README.md` and `docs/services/mcp.md`.

2
.planning/research/STACK.md
View File

@@ -53,6 +53,8 @@ This extends `.planning/research/go-ecosystem.md` (2026-09-16 GitHub-API-verifie
| `charm.land/huh/v2` | v2.0.3 | Interactive prompts on a terminal | Decided in .planning/notes/2026-10-21-console-charm-stack.md (Phase 19.8 D-02); imported only by modules/bonfire and modules/diary |
| `charm.land/fang/v2` | v2.0.1 | Cobra error rendering hook (used narrowly) | Decided in .planning/notes/2026-10-21-console-charm-stack.md (Phase 19.8 D-02); imported only by modules/bonfire and modules/diary |
| `github.com/charmbracelet/colorprofile` | v0.4.3 | Color profile detection and downsampling writer (`--ansi`, `--no-ansi`, `NO_COLOR`) | Decided in .planning/notes/2026-10-21-console-charm-stack.md (Phase 19.8 D-02); imported only by modules/bonfire and modules/diary |
| `github.com/modelcontextprotocol/go-sdk` (packages `mcp`, `auth`, `oauthex`, `jsonrpc`) | v1.8.0 | MCP server, sessions, streamable HTTP transport, bearer middleware, RFC 9728 metadata, test client for the `pier` module | Decided in .planning/notes/2026-10-22-mcp-go-sdk.md (Phase 19.7 D-24, D-33); imported only by modules/pier and the tagged modules/surf/pier_on.go, linked only with the `summercms_mcp` build tag |
| `github.com/google/jsonschema-go` (package `jsonschema`) | v0.4.3 | Reflects MCP tool input and output schemas from Go structs and validates call arguments | Decided in .planning/notes/2026-10-22-mcp-go-sdk.md (Phase 19.7 D-24); the schema library the SDK itself uses; imported only by modules/pier |
### Development Tools