Upgrade go-sdk to v1.7.0

[SamMorrowDrums]

What

• Bumps github.com/modelcontextprotocol/go-sdk from v1.7.0-pre.3 → v1.7.0 (notes).
• Regenerates the third-party license files to reflect the new version tag.
• Stops advertising listChanged (and the deprecated logging) capabilities we don't actually support, and adds a regression test for the capability contract.

Changes between v1.7.0-pre.3 and v1.7.0

The final tag is not identical to pre.3 — there are 4 upstream commits between them (827f90b..bc72835). None are breaking and none require changes on our side; they are transport-layer bug fixes and a micro-optimization:

• 问我  #1107 mcp: derive Mcp-Protocol-Version header from the outgoing message — the streamable HTTP client now sources the Mcp-Protocol-Version header from the request's _meta.protocolVersion first (falling back to context, then the initialized result). Client-side header correctness; no server-side impact.
• How to use "AssignCodingAgent" prompt (GitHub MCP Server) in another MCP client? #1106 mcp: avoid double-copy of payload in writeEvent — SSE writeEvent writes the payload into a pre-grown buffer instead of string(evt.Data). Pure perf micro-optimization.
• build(deps): bump github.com/mark3labs/mcp-go from 0.36.0 to 0.40.0 #1115 mcp: fix potential nil-pointer dereference on message send — robustness fix in the streamable client Write path.
• Add tools for Projects V2 #1114 chore: update conformance — conformance test fixtures only; not shipped code.

Assessment: these only touch the streamable HTTP client and SSE writing; the bug fixes are strictly beneficial and there are no API or behavior changes affecting this server. go build, the full test suite, and lint all pass on v1.7.0.

Capability change (no list-changed advertising)

The go-sdk infers listChanged: true for tools/prompts/resources whenever items are registered. But this server exposes a static set of tools/prompts/resources and never mutates them at runtime, so it never emits list_changed notifications — we were advertising a capability we don't implement. The 2026-07-28 spec (unified subscriptions/listen) tightens expectations here.

The remote/HTTP handler already set empty capabilities explicitly. This moves that declaration into NewMCPServer so both the stdio and remote servers advertise honestly, and removes the now-redundant duplication in the handler (leaving only the remote-specific schema cache).

Advertised capabilities before → after (stdio):

{"logging":{},"tools":{"listChanged":true}, ...}   →   {"tools":{},"prompts":{},"resources":{}}

Note: this also drops the deprecated logging capability from the stdio server, matching what the remote server already advertised and aligning with the new spec's deprecation of logging.

TestNewMCPServer_AdvertisedCapabilities locks this in for both the stdio path (items present) and the HTTP path (inventory emptied for discovery), asserting listChanged == false, no logging, and preserved completions. Verified it fails without the fix.

Validation

• ✅ go build ./...
• ✅ script/test (full suite, -race)
• ✅ script/lint — 0 issues
• ✅ script/licenses-check — passes for all platforms

No tool schemas changed, so toolsnaps and generated README docs are unaffected.

[Copilot]

Pull request overview

Upgrades the MCP Go SDK and centralizes capability declarations.

Changes:

• Upgrades go-sdk to v1.7.0.
• Disables unsupported list-change and deprecated logging capabilities.
• Regenerates platform license manifests.

Show a summary per file

File	Description
go.mod	Updates SDK version.
go.sum	Updates dependency checksums.
pkg/github/server.go	Defines shared server capabilities.
pkg/http/handler.go	Removes redundant HTTP capability setup.
third-party-licenses.darwin.md	Updates Darwin license links.
third-party-licenses.linux.md	Updates Linux license links.
third-party-licenses.windows.md	Updates Windows license links.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 2
• Review effort level: Medium

[SamMorrowDrums]

Good catch — you're right, v1.7.0 is not identical to pre.3. There are 4 intervening commits (827f90b..bc72835):

• 问我  #1107 derive Mcp-Protocol-Version header from the outgoing message (streamable HTTP client)
• How to use "AssignCodingAgent" prompt (GitHub MCP Server) in another MCP client? #1106 avoid double-copy of payload in writeEvent (SSE perf)
• build(deps): bump github.com/mark3labs/mcp-go from 0.36.0 to 0.40.0 #1115 fix potential nil-pointer dereference on message send (streamable client robustness)
• Add tools for Projects V2 #1114 conformance fixtures update (test infra only)

I've assessed them: all are transport-layer bug fixes / a micro-optimization, none breaking, and none require changes on our side (they only touch the streamable HTTP client and SSE writing). Updated the PR description to list them and drop the "tag-only release" framing.

[SamMorrowDrums]

Done — added TestNewMCPServer_AdvertisedCapabilities in pkg/github/server_test.go (commit 1709a5d). It connects an in-memory client and asserts the advertised capabilities: tools/prompts/resources present with listChanged == false, resources.subscribe == false, completions preserved, and logging absent. It runs two sub-cases sharing the NewMCPServer entry point — the stdio path (full inventory, items present) and the HTTP path (ForMCPRequest(MCPMethodDiscover, ""), no items registered) — so both users are covered. I verified it fails without the capability declaration (tools would advertise listChanged:true on stdio and be absent entirely on the HTTP/discovery path).