go-sdk
The official Go SDK for Model Context Protocol servers and clients. Maintained in collaboration with Google.
No outside reports on file
Go-sdk itself is an official, well-maintained tool, but risks depend entirely on which services and data you connect it to and how carefully you configure permissions and input validation.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (modelcontextprotocol/go-sdk)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/modelcontextprotocol/go-sdk ↗
About Go Sdk
Go-sdk is an official toolkit for building servers and clients that use the Model Context Protocol (MCP). MCP is a standard way for AI assistants to connect to tools, databases, and other services. This Go version lets developers write these connections in the Go programming language.
Who it’s for
Go developers and teams building MCP servers or integrations. Organizations using Claude or other AI assistants that support MCP connections.
Alternatives
- Python SDK: The official Model Context Protocol SDK for Python.
- Node.js/TypeScript SDK: The official SDK for JavaScript/TypeScript environments.
- Anthropic SDK: Broader Python/Node.js libraries for building Claude integrations without MCP.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/modelcontextprotocol/go-sdk (opens external site) for installation and usage examples specific to your Go version.
Why this grade
Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 5.3k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Tool access through MCP: Once connected, the AI can call any tools or methods the server exposes, potentially accessing databases, file systems, or APIs the server is configured to reach.
- Prompt injection via untrusted data: If the server reads files, API responses, or user input and passes them to the AI without sanitization, attackers could craft malicious content to manipulate the AI's behavior.
- Dependency vulnerabilities: The SDK depends on other Go packages; unpatched vulnerabilities in those packages could be exploited.
- Credential exposure: If API keys, passwords, or tokens are hardcoded or logged during server setup, they could leak to logs or error messages the AI sees.
- Man-in-the-middle attacks: Communication between the AI and MCP server could be intercepted if not using secure transport (TLS).
How to lower the risk
Least-privilege permissions
- Only expose MCP tools and resources the AI absolutely needs.
- Restrict server access to specific databases, files, or API endpoints using allowlists.
Network isolation
- Run the MCP server on a private network or localhost when possible.
- Use TLS/HTTPS for all connections between the AI and server.
Monitoring
- Log all MCP calls and data exchanged; review logs regularly.
- Alert on unusual tool calls or data access patterns.
Red flags to watch for
- Credentials appearing in logs, error messages, or AI responses.
- Unexpected tools being called or data being accessed.
- Sudden increases in API usage or data transfer.
Questions
How do I install Go Sdk?
Go Sdk does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/modelcontextprotocol/go-sdk.
Are there security reports about Go Sdk?
No reports found for this package in our research (last checked 2026-10-29). Go Sdk currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include tool access through mcp, prompt injection via untrusted data, dependency vulnerabilities.
Is Go Sdk actively maintained?
Go Sdk has 5.3k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/modelcontextprotocol/go-sdk before pinning it in production.
What are alternatives to Go Sdk?
Notable alternatives to Go Sdk include Python SDK (The official Model Context Protocol SDK for Python), Node.js/TypeScript SDK (The official SDK for JavaScript/TypeScript environments), Anthropic SDK (Broader Python/Node.js libraries for building Claude integrations without MCP). You can also compare Go Sdk side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Go Sdk? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/modelcontextprotocol-go-sdk)HTML embed:
<a href="https://agentarmorhq.com/skills/modelcontextprotocol-go-sdk"><img src="https://agentarmorhq.com/api/badge/modelcontextprotocol-go-sdk" alt="AgentArmorHQ Risk Grade for Go Sdk" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "modelcontextprotocol-go-sdk"Share with your security lead
Need sign-off to use go-sdk? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: go-sdk
- **Listing URL:** https://agentarmorhq.com/skills/modelcontextprotocol-go-sdk
- **Type:** App connector
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 5.3k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (modelcontextprotocol/go-sdk)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/modelcontextprotocol/go-sdk
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- modelcontextprotocol
- Source code
- github.com/modelcontextprotocol/go-sdk
- Est. context load
- ~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
- Popularity
- 5.3k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-21
Community
Discussions for Go Sdk
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude