Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-06 · high
A merged patch stops the MCP Go SDK from rejecting names it should have accepted, and no release has shipped it yet.
Why now: The fix merged September 6, per the pull request on GitHub.
MCP's Go SDK refused connections it should have accepted. PR #1242 merged September 6 and fixes a header comparison bug in validateMcpHeaders.
A client following the spec correctly got turned away for no reason it could see on its own end. That's the kind of failure that sends a developer digging through their own request code first, when the bug was on the server.
The transport spec published July 28 lets a client wrap a name or resource URI in Base64 using the =?base64?...?= form, for cases where the raw value isn't safe to put in an HTTP header. The spec requires the server to decode that wrapper before comparing values.
The SDK's validation code did decode Mcp-Param-* headers that way. It never did the same for Mcp-Name. A client sending a spec-legal, Base64-wrapped name got compared against the raw, undecoded string. It didn't match, and the server rejected it.
The bug sat for over a month because a changelog sweep wouldn't have caught it. The Go SDK hasn't cut a release since the spec update went out, so the mismatch lived in code between releases, invisible to anyone checking what shipped.
Each link below shares sources, entities, or timing with this story.
JSON payloads are rejected past 1000 levels of nesting before the parser recurses, both SSE readers cap per-event bytes through a new MaxEventSize, stdio caps a single JSON-RPC frame via StdioTransport.MaxLineLength, and OAuth dynamic client registration responses are capped a...
basecamp/hey-cli is a Go CLI at 318 stars whose repo description is literally "HEY CLI and Agent Skills," tagged with the agent-skills topic, cutting v1.2.0 through v1.4.0 between August 26 and September 2. Small, but it's a mainstream consumer SaaS shipping agent skills as a...
PR #3426, merged September 2, backports session lifecycle ownership: session_idle_timeout existed on StreamableHTTPSessionManager but defaulted to None and couldn't be set from FastMCP, so at stock settings a session whose client never sent DELETE stayed registered until proce...
Version 0.12.0, September 4, adds branch and project cost confirmation elicitations and hides the legacy cost tools from form-capable clients, so an agent can't just call the old tool instead. Server instructions were rewritten to be intent-based rather than naming specific to...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
zendev-sh/goai (Go, 194 stars, 21+ providers, stdlib only), juspay/neurolink (TypeScript, 128 stars, 24+ providers), sno-ai/llmix (Python, 132 stars, adding cache, retries, circuit breakers and key rotation) and r-uby-dev/llm (Ruby, 139 stars, A2A and MCP client), all pushed b...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.