Affected by GO-2026-4770
and 2 other vulnerabilities
GO-2026-4770: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
GO-2026-4773: Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
GO-2026-5771: DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk
The distributed command is an example of a distributed MCP server.
It forks multiple child processes (according to the -child_ports flag), each
of which is a streamable HTTP MCP server with the 'inc' tool, and proxies
incoming http requests to them.
Distributed MCP servers must be stateless, because there's no guarantee that
subsequent requests for a session land on the same backend. However, they
may still have logical session IDs, as can be seen with verbose logging
(-v).