refactor!: replace mcp-go with the official MCP Go SDK

- Swap the mark3labs MCP dependency for modelcontextprotocol/go-sdk v1.7.0
- Add a declarative tool definition and JSON Schema builder to the tool package
- Adapt registered tools to the official low-level handler, recovering panics and mapping failures to JSON-RPC errors
- Narrow tool handlers to take a plain argument map instead of an SDK request type
- Rewire stdio and HTTP transports onto the official server, moving Authorization parsing into receiving middleware
- Add a golden contract test that locks the exposed tool schemas, plus SDK integration and helper tests
- Add a test target and run it in the pull request workflow

BREAKING CHANGE: The exported helpers change signature. Tool.RegisterRead and
Tool.RegisterWrite now take tool.ServerTool instead of server.ServerTool, and the
annotation constructors return *mcp.ToolAnnotations from the official SDK. Callers
must build tool definitions with tool.NewDefinition and handlers with the
func(context.Context, map[string]any) signature.

The 30-second SSE heartbeat is removed because the official SDK has no equivalent.
ServerOptions.KeepAlive is deliberately not used as a substitute, since it sends MCP
ping requests and ping is removed in protocol 2026. HTTP stays stateless=false, so
new clients negotiate at most 2025-11-25.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

operation/operation.go

@@ -29,11 +29,11 @@ import (
 	"gitea.com/gitea/gitea-mcp/pkg/log"
 	"gitea.com/gitea/gitea-mcp/pkg/tool"
 
-	"github.com/mark3labs/mcp-go/server"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
 var (
-	mcpServer *server.MCPServer
+	mcpServer *mcp.Server
 
 	domainTools = []*tool.Tool{
 		user.Tool, actions.Tool, repo.Tool, notification.Tool, issue.Tool,
@@ -43,9 +43,11 @@ var (
 	}
 )
 
-func RegisterTool(s *server.MCPServer) {
+func RegisterTool(s *mcp.Server) {
 	for _, t := range domainTools {
-		s.AddTools(t.Tools()...)
+		for _, registeredTool := range t.Tools() {
+			s.AddTool(registeredTool.Tool, registeredTool.MCPHandler())
+		}
 	}
 	tool.WarnUnmatchedAllowedTools(domainTools...)
 	tool.WarnUnmatchedAllowedScopes(domainTools...)
@@ -71,8 +73,7 @@ func parseAuthToken(authHeader string) (string, bool) {
 	return "", false
 }
 
-func getContextWithToken(ctx context.Context, r *http.Request) context.Context {
-	authHeader := r.Header.Get("Authorization")
+func getContextWithToken(ctx context.Context, authHeader string) context.Context {
 	if authHeader == "" {
 		return ctx
 	}
@@ -85,23 +86,45 @@ func getContextWithToken(ctx context.Context, r *http.Request) context.Context {
 	return context.WithValue(ctx, mcpContext.TokenContextKey, token)
 }
 
+func authTokenMiddleware(next mcp.MethodHandler) mcp.MethodHandler {
+	return func(ctx context.Context, method string, req mcp.Request) (mcp.Result, error) {
+		if extra := req.GetExtra(); extra != nil {
+			ctx = getContextWithToken(ctx, extra.Header.Get("Authorization"))
+		}
+		return next(ctx, method, req)
+	}
+}
+
+func newStreamableHTTPHandler(s *mcp.Server) http.Handler {
+	return mcp.NewStreamableHTTPHandler(
+		func(*http.Request) *mcp.Server { return s },
+		&mcp.StreamableHTTPOptions{
+			Logger:              log.Slog(),
+			MaxRequestBodyBytes: -1,
+			Stateless:           false,
+		},
+	)
+}
+
+func newHTTPServer(addr string, s *mcp.Server) *http.Server {
+	mux := http.NewServeMux()
+	mux.Handle("/mcp", newStreamableHTTPHandler(s))
+	return &http.Server{
+		Addr:    addr,
+		Handler: mux,
+	}
+}
+
 func Run() error {
 	mcpServer = newMCPServer(flag.Version)
 	RegisterTool(mcpServer)
 	switch flag.Mode {
 	case "stdio":
-		if err := server.ServeStdio(
-			mcpServer,
-		); err != nil {
+		if err := mcpServer.Run(context.Background(), &mcp.StdioTransport{}); err != nil {
 			return err
 		}
 	case "http":
-		httpServer := server.NewStreamableHTTPServer(
-			mcpServer,
-			server.WithStreamableHTTPLogger(log.Slog()),
-			server.WithHeartbeatInterval(30*time.Second),
-			server.WithHTTPContextFunc(getContextWithToken),
-		)
+		httpServer := newHTTPServer(fmt.Sprintf(":%d", flag.Port), mcpServer)
 		log.Infof("Gitea MCP HTTP server listening on :%d", flag.Port)
 
 		// Graceful shutdown setup
@@ -120,7 +143,7 @@ func Run() error {
 			close(shutdownDone)
 		}()
 
-		if err := httpServer.Start(fmt.Sprintf(":%d", flag.Port)); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			return err
 		}
 		<-shutdownDone // Wait for shutdown to finish
@@ -130,12 +153,14 @@ func Run() error {
 	return nil
 }
 
-func newMCPServer(version string) *server.MCPServer {
-	return server.NewMCPServer(
-		"Gitea MCP Server",
-		version,
-		server.WithToolCapabilities(true),
-		server.WithLogging(),
-		server.WithRecovery(),
+func newMCPServer(version string) *mcp.Server {
+	s := mcp.NewServer(
+		&mcp.Implementation{
+			Name:    "Gitea MCP Server",
+			Version: version,
+		},
+		&mcp.ServerOptions{Logger: log.Slog()},
 	)
+	s.AddReceivingMiddleware(authTokenMiddleware)
+	return s
 }