Harden MCP pagination against cursor cycles and add go-sdk registration canaries by Copilot · Pull Request #4302 · github/gh-aw-mcpg

Copilot · 2026-04-21T23:47:13Z

This updates the go-sdk integration points highlighted in the review: production pagination now fails fast on cyclical cursors, and upgrade-sensitive behavior around tool registration is covered by a stronger canary. It also clarifies transport-specific protocol/session handling to reduce future maintenance ambiguity.

Pagination safety in internal/mcp/connection.go
- Added cursor-cycle detection to paginateAll using a seenCursors set.
- Returns an explicit error when a backend repeats a cursor instead of continuing until the page cap.
Pagination behavior coverage in internal/mcp/connection_test.go
- Added a cycle-focused test case to TestPaginateAll that verifies early termination on repeated cursors.
- Adjusted the max-pages test to use unique cursors so it continues validating the cap path independently.
Transport-scope clarity in internal/mcp/http_transport.go
- Clarified that MCPProtocolVersion applies to the plain JSON-RPC fallback path only.
- Added inline rationale in isSessionNotFoundError for string fallback matching when SDK typed errors are unavailable.
SDK-upgrade canary for schema-validation bypass in internal/server/routed_test.go
- Extended TestRegisterToolWithoutValidation with a strict-schema tool and intentionally schema-invalid arguments.
- Verifies the registerToolWithoutValidation/Server.AddTool path still invokes handlers without SDK argument-value validation regressions.

seenCursors := make(map[string]struct{})
for pageCount := 1; cursor != ""; pageCount++ {
    if _, seen := seenCursors[cursor]; seen {
        return nil, fmt.Errorf("list%s: backend serverID=%s returned cyclical cursor %q", itemKind, serverID, cursor)
    }
    seenCursors[cursor] = struct{}{}
    // fetch next page...
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

example.com
- Triggering command: /tmp/go-build2010847725/b513/launcher.test /tmp/go-build2010847725/b513/launcher.test -test.testlogfile=/tmp/go-build2010847725/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2010847725/b423/vet.cfg rotocol/go-sdk@v1.5.0/jsonrpc/jsonrpc.go -trimpath x_amd64/vet gci-lint failed /opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet 7457537/b209/sym-atomic -lang=go1.25 x_amd64/vet -p g_.a 477457537/b287//-ifaceassert x_amd64/vet -I go-sdk/mcp 7457537/b287/ x_amd64/vet (dns block)
- Triggering command: /tmp/go-build81877103/b513/launcher.test /tmp/go-build81877103/b513/launcher.test -test.testlogfile=/tmp/go-build81877103/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s rds/�� lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_git lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_commit -guard/target/debug/deps/rustco0oSqi/symbols.o -guard/target/debash b0d7 -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.03.rcgu.o -gua�� -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.05.rcgu/opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.06.rcgu/tmp/go-build3709670566/b506/vet.cfg -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.07.rcgu.o -guard/target/debash -guard/target/de--norc -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.11.rcgu.o (dns block)
invalid-host-that-does-not-exist-12345.com
- Triggering command: /tmp/go-build2010847725/b495/config.test /tmp/go-build2010847725/b495/config.test -test.testlogfile=/tmp/go-build2010847725/b495/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2010847725/b397/vet.cfg @v1.1.3/cpu/x86/-c=4 ggXp/9qGZEHgmklo-nolocalimports x_amd64/vet --gdwarf-5 nal/encoding/tag-atomic -o x_amd64/vet 7457�� g_.a ache/go/1.25.9/x-ifaceassert x_amd64/vet -I /opt/hostedtoolc-atomic -I x_amd64/vet (dns block)
nonexistent.local
- Triggering command: /tmp/go-build2010847725/b513/launcher.test /tmp/go-build2010847725/b513/launcher.test -test.testlogfile=/tmp/go-build2010847725/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2010847725/b423/vet.cfg rotocol/go-sdk@v1.5.0/jsonrpc/jsonrpc.go -trimpath x_amd64/vet gci-lint failed /opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet 7457537/b209/sym-atomic -lang=go1.25 x_amd64/vet -p g_.a 477457537/b287//-ifaceassert x_amd64/vet -I go-sdk/mcp 7457537/b287/ x_amd64/vet (dns block)
- Triggering command: /tmp/go-build81877103/b513/launcher.test /tmp/go-build81877103/b513/launcher.test -test.testlogfile=/tmp/go-build81877103/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s rds/�� lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_git lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_commit -guard/target/debug/deps/rustco0oSqi/symbols.o -guard/target/debash b0d7 -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.03.rcgu.o -gua�� -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.05.rcgu/opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.06.rcgu/tmp/go-build3709670566/b506/vet.cfg -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.07.rcgu.o -guard/target/debash -guard/target/de--norc -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.11.rcgu.o (dns block)
slow.example.com
- Triggering command: /tmp/go-build2010847725/b513/launcher.test /tmp/go-build2010847725/b513/launcher.test -test.testlogfile=/tmp/go-build2010847725/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2010847725/b423/vet.cfg rotocol/go-sdk@v1.5.0/jsonrpc/jsonrpc.go -trimpath x_amd64/vet gci-lint failed /opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet 7457537/b209/sym-atomic -lang=go1.25 x_amd64/vet -p g_.a 477457537/b287//-ifaceassert x_amd64/vet -I go-sdk/mcp 7457537/b287/ x_amd64/vet (dns block)
- Triggering command: /tmp/go-build81877103/b513/launcher.test /tmp/go-build81877103/b513/launcher.test -test.testlogfile=/tmp/go-build81877103/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s rds/�� lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_git lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_commit -guard/target/debug/deps/rustco0oSqi/symbols.o -guard/target/debash b0d7 -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.03.rcgu.o -gua�� -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.05.rcgu/opt/hostedtoolcache/go/1.25.9/x64/pkg/tool/linux_amd64/vet -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.06.rcgu/tmp/go-build3709670566/b506/vet.cfg -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.07.rcgu.o -guard/target/debash -guard/target/de--norc -guard/target/de--noprofile -guard/target/debug/deps/serde_derive-bdc7cd22a58a5141.serde_derive.12123747d8da05ed-cgu.11.rcgu.o (dns block)
this-host-does-not-exist-12345.com
- Triggering command: /tmp/go-build2010847725/b522/mcp.test /tmp/go-build2010847725/b522/mcp.test -test.testlogfile=/tmp/go-build2010847725/b522/testlog.txt -test.paniconexit0 -test.timeout=10m0s abis�� cfg -I x_amd64/vet --gdwarf-5 ce -o x_amd64/vet cfg 7457537/b449/_pkg_.a nLJk/a4JpKmHiBmr_E514nLJk x_amd64/vet --gdwarf-5 ntio/asm/keyset -o x_amd64/vet (dns block)
- Triggering command: /tmp/go-build81877103/b522/mcp.test /tmp/go-build81877103/b522/mcp.test -test.testlogfile=/tmp/go-build81877103/b522/testlog.txt -test.paniconexit0 -test.timeout=10m0s lib/�� lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_git lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_commit lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-m lib/rustlib/x86_bash b0d7 lib/rustlib/x86_--noprofile lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib/libminiz_oxide-2b6a8d2f6e1dc71b.rlib lib/�� lib/rustlib/x86_64-REDACTED-linux-gnu/lib/librustc_std_workspace_alloc-76b5fe9328c1063f.rlib lib/rustlib/x86_64-REDACTED-linux-gnu/lib/libminiz_oxide-2b6a8d2f6e1dc71b.rlib iginal -f "$GOPATH/bin/bash -I yload_StoredInPa--noprofile -guard/target/debug/deps/libserde_derive-bdc7cd22a58a5141.so (dns block)
- Triggering command: /tmp/go-build1985989918/b522/mcp.test /tmp/go-build1985989918/b522/mcp.test -test.testlogfile=/tmp/go-build1985989918/b522/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp�� /run/containerd/-p herFiles,CFiles,main by/31b594e5b708d-lang=go1.25 ntime.v2.task/mogit -guard/target/deshow -guard/target/de7291de63ecded2ae0119c7bba93a1d428d68106a:internal/server/routed_test.go 296/log.json b2f7�� 081a786f99487854go1.25.9 y er-linux ntime.v2.task/mo/opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/lib/jspawnhelper /tmp/awmg-log-te21.0.9+10-LTS --routed er-linux (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/4d4e8792-d37a-4028-8eaa-15752f44b0d7 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

This PR hardens MCP backend pagination and strengthens test canaries around go-sdk tool registration behavior, reducing the risk of runaway pagination and catching SDK upgrade regressions early.

Changes:

Add cursor-cycle detection to paginateAll so repeated cursors fail fast with an explicit error.
Extend pagination tests to cover cyclical cursors and keep the max-pages cap test focused on the cap path.
Clarify HTTP transport protocol/session handling comments and extend routed-mode tool registration canary to ensure schema-invalid arguments still reach handlers.

Show a summary per file

File	Description
internal/mcp/connection.go	Add `seenCursors` tracking to detect cursor cycles during pagination and return a clear error.
internal/mcp/connection_test.go	Add a cyclical-cursor test and adjust the max-pages test to use unique cursors.
internal/mcp/http_transport.go	Clarify `MCPProtocolVersion` scope and document why string-matching remains for session-missing detection in plain JSON fallback.
internal/server/routed_test.go	Strengthen the `registerToolWithoutValidation` canary using a strict schema and intentionally schema-invalid arguments.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 0

Initial plan

b557015

Copilot AI assigned Copilot and lpcox Apr 21, 2026

Copilot started work on behalf of lpcox April 21, 2026 23:47 View session

Copilot AI linked an issue Apr 21, 2026 that may be closed by this pull request

[go-fan] Go Module Review: modelcontextprotocol/go-sdk #4251

Closed

5 tasks

Copilot AI and others added 2 commits April 21, 2026 23:51

fix pagination cursor cycle handling and add sdk canary coverage

d19198b

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/4d4e8792-d37a-4028-8eaa-15752f44b0d7 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: address validation feedback on go-sdk canary changes

798dc9a

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/4d4e8792-d37a-4028-8eaa-15752f44b0d7 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Review Go module modelcontextprotocol/go-sdk~~ Harden MCP pagination against cursor cycles and add go-sdk registration canaries Apr 21, 2026

Copilot AI requested a review from lpcox April 21, 2026 23:55

Copilot finished work on behalf of lpcox April 21, 2026 23:55

lpcox marked this pull request as ready for review April 22, 2026 00:00

Copilot AI review requested due to automatic review settings April 22, 2026 00:00

Copilot started reviewing on behalf of lpcox April 22, 2026 00:01 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

lpcox merged commit 25821a0 into main Apr 22, 2026
26 of 27 checks passed

lpcox deleted the copilot/go-fan-module-review branch April 22, 2026 00:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Harden MCP pagination against cursor cycles and add go-sdk registration canaries#4302

Harden MCP pagination against cursor cycles and add go-sdk registration canaries#4302
lpcox merged 3 commits intomainfrom
copilot/go-fan-module-review

Copilot AI commented Apr 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 21, 2026 •

edited

Loading