MCP Go SDK v1.8.0-pre bounds every buffering decode path after resource-exhaustion reports from production users

GitHub·high signalXBlueskyLinkedInCopy link

The Go SDK's v1.8.0 prerelease, published 2026-09-04, caps every decoding path that buffers untrusted input: JSON payloads are rejected past 1000 levels of nesting before the parser recurses (#1200), both SSE readers cap per-event bytes via a new MaxEventSize on SSEClientTransport and StreamableClientTransport (#1205), stdio caps a single JSON-RPC frame via StdioTransport.MaxLineLength, and OAuth dynamic client registration responses are bounded to 1 MB (#1206). The release notes attribute the work to session leaks, deadlocks and teardown hangs found by users running the 2026-07-28 protocol at scale, and it adds no new protocol revision. If you run an MCP server in Go, these are the first hard limits on what a hostile client can make you allocate.