Tools
MCP Go SDK caps SSE event size and adds a max request body size to the legacy transport
Merged 2026-09-02, PR #1205 (+423/-18) updates the Go SDK's SSE I/O to limit how much memory a single non-terminated event can consume, and PR #1224 (merged 2026-09-01) adds a max request body size to the old transport for consistency with the streamable transport, since SSE is not officially deprecated in the SDK. Both are unbounded-allocation defenses on the transport an MCP host exposes to servers it does not control, and neither appears in a tagged release yet.
Source
↳ Follow the thread