Affected by GO-2026-4569 and 2 other vulnerabilities

GO-2026-4569: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk

GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

jsonrpc

package

v1.1.0-pre.2 Latest Latest Go to latest Published: Oct 29, 2025 License: MIT Imports: 1 Imported by: 24

Details

Package jsonrpc exposes part of a JSON-RPC v2 implementation for use by mcp transport authors.

This section is empty.

This section is empty.

func EncodeMessage(msg Message) ([]byte, error)

EncodeMessage serializes a JSON-RPC message to its wire format.

type ID = jsonrpc2.ID

ID is a JSON-RPC request ID.

func MakeID(v any) (ID, error)

MakeID coerces the given Go value to an ID. The value should be the default JSON marshaling of a Request identifier: nil, float64, or string.

Returns an error if the value type was not a valid Request ID type.

type Message = jsonrpc2.Message

Message is a JSON-RPC message.

func DecodeMessage(data []byte) (Message, error)

DecodeMessage deserializes JSON-RPC wire format data into a Message. It returns either a Request or Response based on the message content.

type Request = jsonrpc2.Request

Request is a JSON-RPC request.

type Response = jsonrpc2.Response

Response is a JSON-RPC response.