fix(deps): update module github.com/modelcontextprotocol/go-sdk to v0.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/modelcontextprotocol/go-sdk	v0.3.1 -> v0.4.0

---

Release Notes

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v0.4.0

Compare Source

This release fixes several bugs, and expands on OAuth support and examples. It also makes a few (hopefully minor) API changes as we approach a release candidate (see #​328).

For more details, see the v0.4.0 milestone.

Thank you to all who tested the SDK, filed bugs, and contributed.

API Changes

This release includes the following incompatible changes:

• mcp.CallToolRequest now holds an mcp.CallToolParamsRaw, to avoid confusion about the raw state of Arguments (see proposal #​377)
• mcp.ToolFor is unexported, as it was also a footgun: modifying the resulting schema was ineffective (see proposal #​401).
• auth.TokenVerifier is changed from func(context.Context, string) (*TokenInfo, error) to func(context.Context, string, *net/http.Request) (*TokenInfo, error), to allow access to the HTTP request (see proposal #​403).

Additionally, it includes the following additions:

• mcp.StreamableServerTransport.JSONResponse and mcp.StreamableHTTPOptions.JSONResponse are exported, to configure serving responses as application/json rather than text/event-stream (#​397).
• auth.ErrOAuth is added.

New Examples

Several new examples are added to demonstrate different ways to use the SDK. We will continue to expand on these examples and other documentation as we approach the release.

• examples/server/auth-middleware provides an example of server-side auth middleware.
• examples/http provides an example of HTTP logging middleware.
• examples/server/distributed provides an example of an MCP server distributed across multiple subprocesses.
• examples/server/toolschemas provides several examples of configuring tool schemas.

Bug fixes

Several notable bugs or misbehaviors are addressed:

• Typed tool handlers now verify against their output schema (#​301).
• The streamable hanging GET now sends HTTP headers immediately, to avoid client timeouts (#​410).
• Strictness around notifications/initialized is relaxed, to fix flaky initialization with Claude (#​395).
• Mcp-Session-Id response headers are now sent only for the Initialize request, per the spec (#​416).

New Contributors

• @​bradhoekstra made their first contribution in #​392
• @​CCpro10 made their first contribution in #​397
• @​KasonBraley made their first contribution in #​420

Full Changelog: modelcontextprotocol/go-sdk@v0.3.1...v0.4.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.