
Security News
New CVE Forecasting Tool Predicts 47,000 Disclosures in 2025
CVEForecast.org uses machine learning to project a record-breaking surge in vulnerability disclosures in 2025.
Security News
Sarah Gooding
July 2, 2025
The Model Context Protocol (MCP) is finally getting an official Go SDK, joining the existing set of first-party libraries for TypeScript, Python, Java, Rust, Kotlin, and C#. Though still considered “unreleased,” a stable version is expected in August.
Despite Go’s popularity for writing tools, backend systems, and AI infrastructure, developers have had to rely on community-maintained libraries like mcp-go
. That library is already widely used (it is imported by over 400 packages that span 200+ modules) and its influence is acknowledged in the design of the official SDK. But the new version takes a more opinionated approach, aiming to provide idiomatic Go APIs while aligning tightly with the latest MCP spec.
"We admire mcp-go, and where possible tried to align with its design," the design document states. "However, the APIs here diverge in a number of ways in order to keep the official SDK minimal, allow for future spec evolution, and support additional features... Although the API here is not compatible with mcp-go, translating between them should be straightforward in most cases. (Later, we will provide a detailed translation guide.)"
The SDK is built around a single core package, mcp
, mirroring the approach of Go’s standard libraries like net/http
. Servers and clients are first-class types, and connections are modeled using a low-level Transport
interface that abstracts over stdio, SSE, or streamable HTTP. It's designed to make custom transports easy to plug in.
Instead of splitting the SDK across multiple packages (like client
, server
, and transport
), everything lives under mcp
, improving discoverability and making the package easier to explore and document.
The SDK also makes heavy use of generics to simplify tool and prompt implementation. Developers can bind handlers directly to typed Go structs, with input schemas inferred automatically and validated at runtime. Schema customization is supported via options, but in most cases developers don’t have to write any boilerplate.
The design doc for the SDK outlines the following goals for its architecture:
Internally, the SDK uses a battle-tested JSON-RPC implementation maintained by the Go team, originally built for gopls
. It handles cancellation, session management, and error propagation under the hood, while exposing clean abstractions to users.
Unlike the community SDKs, which sometimes expose session internals or conflate layers of the protocol, this version keeps concerns separated: transports connect sessions, which bind to clients and servers, which then define tools and resources. It’s intentionally a few layers deeper but also more stable and maintainable in the long term.
This structure makes it easier to manage per-session behavior, customize server instances for each connection, and cleanly support features like progress notifications and context injection without leaking transport-specific logic into the application layer.
While the SDK is already quite feature-rich, it is not yet stable and breaking changes are expected ahead of the August release. Key features still in progress include:
streamable
transport lifecycleThere’s also an antitrust policy in the works to ensure neutrality across vendors and avoid ecosystem capture, a sign that the team is thinking about the long-term health of the protocol, not just the code. The details of this policy are being handled by Google and Anthropic lawyers.
A stable 1.0 release will consist of a single Go module and will follow semver and include release notes and versioning tags. Contributors plan to release it when it's production ready and "sufficiently complete" but some unimplemented features will happen in subsequent releases. They plan to add new APIs in minor versions but breaking changes will require a v2 release of the Go module.
Contributions are welcome via GitHub discussions and PRs, and the project is hosted under the modelcontextprotocol
organization.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
CVEForecast.org uses machine learning to project a record-breaking surge in vulnerability disclosures in 2025.
Security News
Browserslist-rs now uses static data to reduce binary size by over 1MB, improving memory use and performance for Rust-based frontend tools.
Research
Security News
Eight new malicious Firefox extensions impersonate games, steal OAuth tokens, hijack sessions, and exploit browser permissions to spy on users.