
Security News
NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.
The official Go SDK for the Model Context Protocol is in development, with a stable, production-ready release expected by August 2025.

July 2, 2025
3 min read


The Model Context Protocol (MCP) is finally getting an official Go SDK, joining the existing set of first-party libraries for TypeScript, Python, Java, Rust, Kotlin, and C#. Though still considered “unreleased,” a stable version is expected in August.
Despite Go’s popularity for writing tools, backend systems, and AI infrastructure, developers have had to rely on community-maintained libraries like mcp-go. That library is already widely used (it is imported by over 400 packages that span 200+ modules) and its influence is acknowledged in the design of the official SDK. But the new version takes a more opinionated approach, aiming to provide idiomatic Go APIs while aligning tightly with the latest MCP spec.
"We admire mcp-go, and where possible tried to align with its design," the design document states. "However, the APIs here diverge in a number of ways in order to keep the official SDK minimal, allow for future spec evolution, and support additional features... Although the API here is not compatible with mcp-go, translating between them should be straightforward in most cases. (Later, we will provide a detailed translation guide.)"
The SDK is built around a single core package, mcp, mirroring the approach of Go’s standard libraries like net/http. Servers and clients are first-class types, and connections are modeled using a low-level Transport interface that abstracts over stdio, SSE, or streamable HTTP. It's designed to make custom transports easy to plug in.
Instead of splitting the SDK across multiple packages (like client, server, and transport), everything lives under mcp, improving discoverability and making the package easier to explore and document.
The SDK also makes heavy use of generics to simplify tool and prompt implementation. Developers can bind handlers directly to typed Go structs, with input schemas inferred automatically and validated at runtime. Schema customization is supported via options, but in most cases developers don’t have to write any boilerplate.
The design doc for the SDK outlines the following goals for its architecture:
Internally, the SDK uses a battle-tested JSON-RPC implementation maintained by the Go team, originally built for gopls. It handles cancellation, session management, and error propagation under the hood, while exposing clean abstractions to users.
Unlike the community SDKs, which sometimes expose session internals or conflate layers of the protocol, this version keeps concerns separated: transports connect sessions, which bind to clients and servers, which then define tools and resources. It’s intentionally a few layers deeper but also more stable and maintainable in the long term.
This structure makes it easier to manage per-session behavior, customize server instances for each connection, and cleanly support features like progress notifications and context injection without leaking transport-specific logic into the application layer.
While the SDK is already quite feature-rich, it is not yet stable and breaking changes are expected ahead of the August release. Key features still in progress include:
streamable transport lifecycleThere’s also an antitrust policy in the works to ensure neutrality across vendors and avoid ecosystem capture, a sign that the team is thinking about the long-term health of the protocol, not just the code. The details of this policy are being handled by Google and Anthropic lawyers.
A stable 1.0 release will consist of a single Go module and will follow semver and include release notes and versioning tags. Contributors plan to release it when it's production ready and "sufficiently complete" but some unimplemented features will happen in subsequent releases. They plan to add new APIs in minor versions but breaking changes will require a v2 release of the Go module.
Contributions are welcome via GitHub discussions and PRs, and the project is hosted under the modelcontextprotocol organization.

Subscribe to our newsletter
Get notified when we publish new security blog posts!

Security News
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.

Company News
/Security News
Socket is an initial recipient of OpenAI's Cybersecurity Grant Program, which commits $10M in API credits to defenders securing open source software.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.