Merge branch 'main' into guglielmoc/SEP-2243_http_standardization_2

Author: guglielmo-san

docs/mcpgodebug.md

@@ -18,13 +18,39 @@
 
 ## `MCPGODEBUG` history
 
+### 1.6.0
+
+Options listed below were added and will be removed in the 1.8.0 version of the SDK.
+
+- `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite
+  `Content` with the error text, restoring the previous behavior. The default
+  behavior was changed to preserve existing `Content` if it has already been
+  populated.
+
+- `enableoriginverification` added. If set to `1`, default (zero-value)
+  cross-origin protection will be applied when
+  `StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the
+  behavior from v1.4.1-v1.5.0. The default behavior was changed to not
+  enable cross-origin protection.
+
+- `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now
+  also used in the SSE transport.
+
+Options below were removed:
+
+- `jsonescaping`, according to plan,
+
+- `disablecrossoriginprotection`, it was replaced by
+  `enableoriginverification` after the default was changed to not enable
+  cross-origin protection.
+
 ### 1.4.1
 
 Options listed below will be removed in the 1.6.0 version of the SDK.
 
 - `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
   protection will be disabled. The default behavior was changed to enable
-  cross-origin protection. **Removal of this option was postponed until 1.7.0.**
+  cross-origin protection.
 
 ### 1.4.0
 
@@ -39,4 +65,4 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
   protection. The protection can also be disabled by setting the
   `DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
   `SSEOptions` struct to `true`, which is the recommended way to disable
-  the protection long term. **Removal of this option was postponed until 1.7.0.**
+  the protection long term. **Removal of this option was postponed until 1.8.0.**

internal/docs/mcpgodebug.src.md

@@ -17,13 +17,39 @@
 
 ## `MCPGODEBUG` history
 
+### 1.6.0
+
+Options listed below were added and will be removed in the 1.8.0 version of the SDK.
+
+- `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite
+  `Content` with the error text, restoring the previous behavior. The default
+  behavior was changed to preserve existing `Content` if it has already been
+  populated.
+
+- `enableoriginverification` added. If set to `1`, default (zero-value)
+  cross-origin protection will be applied when
+  `StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the
+  behavior from v1.4.1-v1.5.0. The default behavior was changed to not
+  enable cross-origin protection.
+
+- `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now
+  also used in the SSE transport.
+
+Options below were removed:
+
+- `jsonescaping`, according to plan,
+
+- `disablecrossoriginprotection`, it was replaced by
+  `enableoriginverification` after the default was changed to not enable
+  cross-origin protection.
+
 ### 1.4.1
 
 Options listed below will be removed in the 1.6.0 version of the SDK.
 
 - `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
   protection will be disabled. The default behavior was changed to enable
-  cross-origin protection. **Removal of this option was postponed until 1.7.0.**
+  cross-origin protection.
 
 ### 1.4.0
 
@@ -38,4 +64,4 @@ Options listed below will be removed in the 1.6.0 version of the SDK.
   protection. The protection can also be disabled by setting the
   `DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
   `SSEOptions` struct to `true`, which is the recommended way to disable
-  the protection long term. **Removal of this option was postponed until 1.7.0.**
+  the protection long term. **Removal of this option was postponed until 1.8.0.**

internal/jsonrpc2/messages.go

@@ -11,8 +11,6 @@ import (
 	"fmt"
 
 	internaljson "github.com/modelcontextprotocol/go-sdk/internal/json"
-
-	"github.com/modelcontextprotocol/go-sdk/internal/mcpgodebug"
 )
 
 // ID is a Request identifier, which is defined by the spec to be a string, integer, or null.
@@ -219,18 +217,8 @@ func marshalToRaw(obj any) (json.RawMessage, error) {
 	return json.RawMessage(data), nil
 }
 
-// jsonescaping is a compatibility parameter that allows to restore
-// JSON escaping in the JSON marshaling, which stopped being the default
-// in the 1.4.0 version of the SDK. See the documentation for the
-// mcpgodebug package for instructions how to enable it.
-// The option will be removed in the 1.6.0 version of the SDK.
-var jsonescaping = mcpgodebug.Value("jsonescaping")
-
 // jsonMarshal marshals obj to JSON like json.Marshal but without HTML escaping.
 func jsonMarshal(obj any) ([]byte, error) {
-	if jsonescaping == "1" {
-		return json.Marshal(obj)
-	}
 	var buf bytes.Buffer
 	enc := json.NewEncoder(&buf)
 	enc.SetEscapeHTML(false)

mcp/streamable.go

@@ -235,7 +235,7 @@ func (h *StreamableHTTPHandler) closeAll() {
 // disablelocalhostprotection is a compatibility parameter that allows to disable
 // DNS rebinding protection, which was added in the 1.4.0 version of the SDK.
 // See the documentation for the mcpgodebug package for instructions how to enable it.
-// The option will be removed in the 1.6.0 version of the SDK.
+// The option will be removed in the 1.8.0 version of the SDK.
 var disablelocalhostprotection = mcpgodebug.Value("disablelocalhostprotection")
 
 // enableoriginverification is a compatibility parameter that restores the