MCP SDK Tier Audit: modelcontextprotocol/go-sdk

Date: 2026-08-10
Branch: main (commit e9a85e2)
Version: v1.7.0 · pkg.go.dev/github.com/modelcontextprotocol/go-sdk@v1.7.0
Requested tier: Tier 1
Tool: @modelcontextprotocol/conformance tier-check 0.2.0-alpha.11
Previous assessment: #2279 (Tier 1, v1.4.0, 2026-02-27)

Tier Assessment: Tier 1

All Tier 1 requirements are met. Conformance is 100% across every tier-scored server and client scenario in both frozen requirement revisions (2025-11-25 at the stateful wire, 2026-07-28 at the stateless wire), all repository-health and governance requirements clear the Tier 1 bar.

Requirements Summary

① Labels — Labels check failed for "bug", "enhancement" and "question", because we use GitHub issue types (each mirrors precedent set in #2279).

Tier Determination

• Tier 1: PASS — 10/10 requirements met (three items footnoted, all matching Go SDK — Tier 1 Assessment #2279 precedent)
• Tier 2: PASS — 9/9 requirements met
• Final Tier: 1

Server Conformance Details

Pass rate: 100% (67/67). Tested against the frozen requirement sets for 2025-11-25 (stateful wire, -stateless=false) and 2026-07-28 (stateless wire, default). The two invocations come from the go-sdk entry in src/sdk-runner/known-sdks.ts, so tier-check --sdk-path spawns the correct server per revision automatically.

Client Conformance Details

Full-suite pass rate (tier-scored): 100% (50/50).

Suite breakdown: Core: 11/11 (100%), Auth: 39/39 (100%).
Tier scoring covers the frozen requirement sets for 2025-11-25 and 2026-07-28. Extension scenarios and scenarios added after a revision shipped are informational and not counted toward tier advancement, per the conformance testing rules.

Conformance Matrix

* Pairs of (scenario, revision); a scenario belonging to both revisions is run once per revision on that revision's wire.

Baseline (conformance/baseline.yml): 7 client-side auth scenarios are documented as expected failures — auth/client-credentials-basic, auth/client-credentials-jwt, auth/enterprise-managed-authorization, auth/dpop, auth/dpop-nonce, auth/wif-jwt-bearer. All fall in the extension category and are not scored for tier. No unexpected failures.

Informational (not scored for tier):

The 10 failing server extensions and all 12 failing client extensions belong to the Tasks family (SEP-2322 request state, MRTR composition, dispatch/envelope, lifecycle, capability negotiation) and the SEP-1932/SEP-1933/SEP-1934 client-side auth extensions (auth/dpop, auth/dpop-nonce, auth/wif-jwt-bearer, auth/enterprise-managed-authorization, auth/client-credentials-basic, auth/client-credentials-jwt) — all off-timeline extensions that the SDK does not yet implement. The 2 failing client added-after-release items are two revisions of json-schema-2020-12-preservation, added to the suite after both 2025-11-25 and 2026-07-28 shipped. None of these affect tier classification.

Core Scenarios (scored)

Auth Scenarios (scored)

Issue Triage Details

Analysis period: last 45 open issues.
Labels: needs confirmation, needs repro, ready for work, good first issue, help wanted, P0, P1, P2, P3 — plus org-wide native Issue Types (Task, Bug, Enhancement, Question) used for Type categorization. See Note ① for the tool-detection caveat.

P0 resolution: 1 P0 closed within 7 days; 0 currently open.

Spec tracking: latest spec release 2026-07-28; latest SDK release 2026-07-28 (13-day gap).

Stable release: v1.7.0 — semantic version 1.7.0 (>= 1.0.0), not a pre-release. Go module SemVer is enforced by the toolchain; spec-compatibility guarantees are documented in README § "Version Compatibility".

Documentation Coverage

Documentation locations: root README.md (getting-started + spec-version compatibility matrix), docs/README.md, docs/quick_start.md, docs/protocol.md, docs/server.md, docs/client.md, docs/troubleshooting.md, docs/mcpgodebug.md, docs/rough_edges.md; examples/ with 20+ programs under server/, client/, auth/, http/; and Go Example* functions in mcp/*_example_test.go rendered on pkg.go.dev. Source-of-truth for generated docs is in internal/docs/*.src.md (regenerated via go generate ./internal/docs per AGENTS.md).

Summary: 48/48 non-experimental features documented with examples (100%); core features 36/36 (100%).

Policy Evaluation

1. Dependency Update Policy — PASS

Verdict: PASS — a substantive written policy (CONTRIBUTING.md) and a working Dependabot configuration are present and consistent. Matches #2279 treatment.

2. Roadmap — PASS

Verdict (Tier 1): PASS — ROADMAP.md lists concrete work items tracking MCP spec components: SEP-1730 Tier 1 support (#675), SEP-1577 (Sampling with Tools completing 2025-11-25), client-side OAuth SEPs, ext-auth extensions, and Tasks (experimental).

3. Versioning Policy — PASS (see Note ③)

Verdict (Tier 1): PASS — matches #2279 treatment ("Go uses semantic versioning by default. No additional policies are needed.").

Reproduce This Assessment

# From the conformance repo at the alpha.11 revision
git clone https://github.com/modelcontextprotocol/conformance.git
cd conformance
git checkout c321dd3  # @modelcontextprotocol/conformance 0.2.0-alpha.11
npm install

# GitHub API access for repo-health checks
gh auth login
export GITHUB_TOKEN=$(gh auth token)

# tier-check spawns the correct server invocation per revision, per
# the go-sdk entry in src/sdk-runner/known-sdks.ts (stateful for
# 2025-11-25, stateless for 2026-07-28). No separate server terminal needed.
node dist/index.js tier-check \
  --sdk-path /path/to/go-sdk \
  --requirements 2025-11-25,2026-07-28 \
  --output markdown

# Verify the stable release metadata directly
gh release view v1.7.0 --repo modelcontextprotocol/go-sdk