deps: bump github.com/felixgeelhaar/mcp-go from 1.9.0 to 1.13.0

[dependabot]

Bumps github.com/felixgeelhaar/mcp-go from 1.9.0 to 1.13.0.

Release notes

Sourced from github.com/felixgeelhaar/mcp-go's releases.

v1.13.0

What's Changed

• feat(server): identity-aware list filtering for tools, resources, prompts by @​felixgeelhaar in felixgeelhaar/mcp-go#91

Full Changelog: klarlabs-studio/mcp-go@v1.12.0...v1.13.0

v1.12.0

What's Changed

• feat(auth): BearerAuth shorthand for shared-secret deployments by @​felixgeelhaar in felixgeelhaar/mcp-go#88
• feat(transport): expose TLS configuration for HTTP/gRPC/WebSocket by @​felixgeelhaar in felixgeelhaar/mcp-go#89

Full Changelog: klarlabs-studio/mcp-go@v1.11.2...v1.12.0

v1.11.2

What's Changed

• fix: spec-compliant structuredContent for typed-struct tool results by @​felixgeelhaar in felixgeelhaar/mcp-go#81

Full Changelog: klarlabs-studio/mcp-go@v1.11.0...v1.11.2

v1.11.0

What's Changed

Fixes

• schema: always emit properties for object schemas (#79). OpenAI strict tool-calling rejects object schemas that omit the properties key (object schema missing properties. (format)), which broke any tool whose handler input is struct{}. Custom MarshalJSON now forces properties ({} when empty) and writes additionalProperties: false for struct-derived schemas — making generated schemas strict-mode compatible end-to-end. Map-derived schemas stay open. Reported by a downstream consumer running OpenAI gpt-4o through OpenClaw.
• ci: pin nox version and use curl -fsSL so a stale download URL fails fast instead of feeding HTML to tar (#80).

Internal

• chore: extract repeated string literals to satisfy goconst; reuse protocol.Method* constants in audit middleware; reflect.Ptr → reflect.Pointer (#77). No behaviour change.

New public API

• schema.Schema.AdditionalProperties any — set per-schema; struct-derived schemas default to false (closed).
• server.CompletionRefPrompt, server.CompletionRefResource — string constants for CompletionRef.Type values.
• transport.JSONRPCVersion — "2.0", the JSON-RPC version emitted in transport-level notifications.

Full Changelog: klarlabs-studio/mcp-go@v1.10.1...v1.11.0

What's Changed

• deps(website): bump astro v5 → v6.3.1 by @​felixgeelhaar in felixgeelhaar/mcp-go#76
• chore: extract repeated string literals to satisfy goconst by @​felixgeelhaar in felixgeelhaar/mcp-go#77
• fix(schema): always emit properties for object schemas (OpenAI strict mode) by @​felixgeelhaar in felixgeelhaar/mcp-go#79
• fix(ci): pin nox version and fail fast on download error by @​felixgeelhaar in felixgeelhaar/mcp-go#80

Full Changelog: klarlabs-studio/mcp-go@v1.10.1...v1.11.0

... (truncated)

Changelog

Sourced from github.com/felixgeelhaar/mcp-go's changelog.

1.13.0

Features

Identity-aware list filtering for tools, resources, and prompts (#90, #91)

• Added mcp.WithToolFilter(func(ctx, name) bool) ServeOption — predicate gates tools/list visibility AND tools/call execution, so the filter is the authoritative contract rather than a display layer
• Added mcp.WithResourceFilter(func(ctx, uri, name) bool) ServeOption — gates resources/list + resources/read
• Added mcp.WithPromptFilter(func(ctx, name) bool) ServeOption — gates prompts/list + prompts/get
• Predicates receive the request context — pair with IdentityFromContext for identity-aware authz (e.g. admin-only tools hidden from read-only clients)
• Filters apply during typed list construction, so they're immune to the schema-coupling problem of post-response middleware approaches (response-map walking breaks silently when the response shape evolves)
• Added (*server.Resource).URITemplate() and (*server.Resource).Name() accessors so resource filter predicates can be implemented without poking at unexported fields

1.12.0

Features

BearerAuth shorthand for shared-secret deployments (#87, #88)

• Added mcp.BearerAuth(tokens map[string]string, opts ...AuthOption) Middleware
• Single-call entry point for the most common bearer-auth case: reject calls that don't present a shared secret
• Map values become Identity.ID + Identity.Name surfaced via IdentityFromContext
• Handshake methods (initialize, notifications/initialized, ping) exempted automatically
• The full Auth + BearerTokenAuthenticator + StaticTokens primitives remain in place for scope-aware authz, multi-tenant identity, and per-token metadata

TLS configuration for HTTP, gRPC, and WebSocket transports (#86, #89)

• Added mcp.WithTLSConfig(*tls.Config) HTTPOption — switches the HTTP transport to ServeTLS
• Added mcp.WithWebSocketTLSConfig(*tls.Config) WebSocketOption — switches WebSocket to ListenAndServeTLS
• Added mcp.WithGRPCTLSConfig(*tls.Config) GRPCOption — wraps grpc.Creds(credentials.NewTLS(cfg)) and composes with WithServerOptions
• *tls.Config is the only surface — operators bring their own cert loading + rotation strategy (LoadX509KeyPair, autocert, SPIFFE workload API, etc.)
• Set ClientCAs + ClientAuth on the config for mTLS — common in service-mesh + regulated single-binary deployments where ops doesn't want a separate TLS-terminating proxy

Commits

• 3ed22e8 chore(release): v1.13.0 changelog
• 210e46d feat(server): identity-aware list filtering for tools, resources, prompts (#9...
• 9df8c05 chore(release): v1.12.0 changelog
• f9bf61e feat(transport): expose TLS configuration for HTTP/gRPC/WebSocket (#89)
• 951db13 feat(auth): add BearerAuth shorthand for shared-secret deployments (#88)
• 04962c5 fix: spec-compliant structuredContent for typed-struct tool results (#81)
• 5f54e1a fix(ci): pin nox version and fail fast on download error (#80)
• abdc0a6 fix(schema): always emit properties for object schemas (#79)
• a4fca26 chore: extract repeated string literals to satisfy goconst (#77)
• cfded00 fix(ci): bump pages workflow Node 20 → 22 for Astro v6
• Additional commits viewable in compare view

[felixgeelhaar]

@dependabot recreate