Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-31 · high
A reused params struct carried old answers into new tool calls, so the client's confirmation prompt never fired.
Why now: The fix merged August 31, and anyone reusing params structs across calls has been exposed since the middleware shipped.
A bug in the MCP Go SDK let a destructive tool call skip its own confirmation prompt. The fix merged August 31 in PR #1145.
The cause sat in clientMultiRoundTripMiddleware, which writes InputResponses and RequestState through the caller's *CallToolParams pointer and never clears them afterward. If a server reused that params struct across calls, the first call's answers rode along into the next one. A server gating a destructive action on len(req.Params.InputResponses) == 0 would see a nonzero length on what it thought was a fresh, unanswered call and treat it as already confirmed. The client's ElicitationHandler, the code meant to pop the confirmation prompt, never ran.
This matters because elicitation is the mechanism MCP servers use to make sure a human actually approved a risky tool call before it executes. A gate that silently passes on stale state isn't a gate. Any server built around that len() == 0 check was trusting a struct it didn't fully control, and this bug is what that trust cost.
The fix has the retry loop copy the params instead of mutating the original, and it ships with a regression test. If your Go server or client reuses a CallToolParams struct across tool calls, pull the update. Worth checking, too, whether any destructive action logged as "confirmed" in the past actually got a live prompt or just inherited an old answer.
Each link below shares sources, entities, or timing with this story.
Same source domain / Shared topic
Reported by the same outlet (github.com); overlapping topics (already, been, call, caller, client).
Shared entity: Params / Same source domain / Earlier coverage
Both cover Params; reported by the same outlet (github.com); earlier Params coverage from 2026-08-02.
Both cover Params; reported by the same outlet (github.com); earlier Params coverage from 2026-02-25.
Same source domain / Shared topic / Tension
Reported by the same outlet (github.com); overlapping topics (call, tool); pushes against this story (against).
Reported by the same outlet (github.com); overlapping topics (answer, client); pushes against this story (against).
Reported by the same outlet (github.com); overlapping topics (call, client); pushes against this story (vs).
Reported by the same outlet (github.com); overlapping topics (answer, been); pushes against this story (but).
Same source domain / Shared topic / Downstream implication
Reported by the same outlet (github.com); overlapping topics (call, tool); traces where this leads (which means).