MCP SDK for Go 1.7.0

Apply the Go 1.27 baseline first. Use github.com/modelcontextprotocol/go-sdk v1.7.0 APIs with a supported, patched Go toolchain; its Go 1.25.0 module minimum is not a support guarantee. These rules cover MCP 2026-07-28 and the SDK's legacy protocol compatibility paths.

Handlers and access control

• Register only required tools, resources, templates, prompts, and custom methods. Enforce method and object authorization in handlers or Server.AddReceivingMiddleware, including discovery, lists, completions, and subscriptions; hiding an item from a list does not prevent direct invocation.
• Prefer generic mcp.AddTool[In, Out] with narrow input and output types. It applies schema defaults and validates inputs before dispatch and typed output before returning it. Supply explicit bounds and allowed values in Tool.InputSchema; review defaults as actual handler inputs. An Out type of any omits the inferred output schema.
• When using low-level Server.AddTool with ToolHandler, explicitly decode and validate req.Params.Arguments and validate returned structured content against the declared output schema. This API supplies neither input nor output validation. Keep custom MCP parsers consistent with the SDK's case-sensitive decoding and patched JSON dependency.
• Validate prompt arguments and resource-template variables before use. A registered resource URI or matching template only selects a handler; enforce tenant ownership and the Go baseline's filesystem or outbound-network restrictions on the actual destination.
• Keep a shared Server registry free of