feat!: support protocol 2026-07-28 over HTTP and add --bind (#227)

Adds MCP protocol `2026-07-28` over HTTP through the official Go SDK, and validates the `Origin` header on every request as the spec requires.

Tool and Gitea failures now come back as an ordinary `tools/call` result carrying `result.isError: true`, the way the SDK's own tool wrapper reports them. Malformed requests, unknown tools or methods, and server faults stay JSON-RPC errors.

Adds `-b, --bind` to narrow the listen address. The default still accepts every interface, so this is opt-in hardening. It matters because a request that omits `Authorization` falls back to the server's own token.

**Breaking: the HTTP endpoint no longer keeps a session per client.** What changes for a client:

1. `/mcp` accepts `POST` only, and answers `405` to `GET` or `DELETE`.
2. The server neither sends nor accepts `Mcp-Session-Id`, so there is no session handshake to perform.
3. There is no standalone SSE stream and no `Last-Event-ID` resumption. If a response stream breaks, send the whole request again under a new JSON-RPC id.

Clients that already speak current streamable HTTP need no changes. Anything relying on the session handshake or the standalone SSE stream should stay on the previous release.

---------

Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/227
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>

cmd/cmd.go

@@ -17,6 +17,7 @@ import (
 
 var (
 	host                            string
+	bind                            string
 	port                            int
 	token                           string
 	tools                           string
@@ -32,6 +33,8 @@ func initFlagSet(fs *flag.FlagSet, args []string, getenv func(string) string, re
 	fs.StringVar(&flagPkg.Mode, "transport", "stdio", "")
 	fs.StringVar(&host, "H", getenv("GITEA_HOST"), "")
 	fs.StringVar(&host, "host", getenv("GITEA_HOST"), "")
+	fs.StringVar(&bind, "b", "", "")
+	fs.StringVar(&bind, "bind", "", "")
 	fs.IntVar(&port, "p", 8080, "")
 	fs.IntVar(&port, "port", 8080, "")
 	fs.StringVar(&token, "T", "", "")
@@ -68,6 +71,7 @@ func initFlagSet(fs *flag.FlagSet, args []string, getenv func(string) string, re
 		fmt.Fprintln(stderr, "Options:")
 		fmt.Fprintf(w, "  -t, -transport <type>\tTransport type: stdio or http (default: stdio)\n")
 		fmt.Fprintf(w, "  -H, -host <url>\tGitea host URL (default: https://gitea.com)\n")
+		fmt.Fprintf(w, "  -b, -bind <address>\tHTTP listen address, e.g. 127.0.0.1 (default: all interfaces)\n")
 		fmt.Fprintf(w, "  -p, -port <number>\tHTTP server port (default: 8080)\n")
 		fmt.Fprintf(w, "  -T, -token <token>\tPersonal access token\n")
 		fmt.Fprintf(w, "  -r, -read-only\tExpose only read-only tools\n")
@@ -99,6 +103,7 @@ func initFlagSet(fs *flag.FlagSet, args []string, getenv func(string) string, re
 		flagPkg.Host = "https://gitea.com"
 	}
 
+	flagPkg.Bind = bind
 	flagPkg.Port = port
 	flagPkg.MaxInlineAttachmentBytes = maxInlineAttachmentBytes
 

cmd/cmd_test.go

@@ -10,6 +10,27 @@ import (
 	flagPkg "gitea.com/gitea/gitea-mcp/pkg/flag"
 )
 
+func TestInitFlagSetBind(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		args []string
+		want string
+	}{
+		{name: "default is empty, meaning all interfaces", args: []string{}},
+		{name: "-b sets the address", args: []string{"-b", "127.0.0.1"}, want: "127.0.0.1"},
+		{name: "-bind sets an IPv6 literal", args: []string{"-bind", "::1"}, want: "::1"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Cleanup(func() { flagPkg.Bind = "" })
+			fs := flag.NewFlagSet("test", flag.ContinueOnError)
+			initFlagSet(fs, test.args, func(string) string { return "" }, func(string) ([]byte, error) { return nil, nil }, &bytes.Buffer{})
+			if flagPkg.Bind != test.want {
+				t.Errorf("Bind = %q, want %q", flagPkg.Bind, test.want)
+			}
+		})
+	}
+}
+
 func TestInitFlagSetScopes(t *testing.T) {
 	tests := []struct {
 		name string