feat!: support protocol 2026-07-28 over HTTP and add --bind (#227)

Adds MCP protocol `2026-07-28` over HTTP through the official Go SDK, and validates the `Origin` header on every request as the spec requires.

Tool and Gitea failures now come back as an ordinary `tools/call` result carrying `result.isError: true`, the way the SDK's own tool wrapper reports them. Malformed requests, unknown tools or methods, and server faults stay JSON-RPC errors.

Adds `-b, --bind` to narrow the listen address. The default still accepts every interface, so this is opt-in hardening. It matters because a request that omits `Authorization` falls back to the server's own token.

**Breaking: the HTTP endpoint no longer keeps a session per client.** What changes for a client:

1. `/mcp` accepts `POST` only, and answers `405` to `GET` or `DELETE`.
2. The server neither sends nor accepts `Mcp-Session-Id`, so there is no session handshake to perform.
3. There is no standalone SSE stream and no `Last-Event-ID` resumption. If a response stream breaks, send the whole request again under a new JSON-RPC id.

Clients that already speak current streamable HTTP need no changes. Anything relying on the session handshake or the standalone SSE stream should stay on the previous release.

---------

Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/227
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>

operation/operation.go

@@ -4,9 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -36,11 +38,6 @@ import (
 // base64 file content create_or_update_file accepts.
 const maxRequestBodyBytes = 32 << 20
 
-// sessionTimeout expires idle sessions, which the SDK otherwise keeps for the
-// process lifetime: a client that goes away without DELETE /mcp leaks its
-// session, and initialize takes no token. Clients re-initialize on the 404.
-const sessionTimeout = 30 * time.Minute
-
 // httpReadHeaderTimeout bounds slow header reads without limiting SSE writes.
 const httpReadHeaderTimeout = 10 * time.Second
 
@@ -107,17 +104,35 @@ func authTokenMiddleware(next mcp.MethodHandler) mcp.MethodHandler {
 	}
 }
 
+func protectMCPOrigin(next http.Handler) http.Handler {
+	protection := http.NewCrossOriginProtection()
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Check exempts safe methods, but MCP requires Origin validation on every request.
+		checkRequest := r
+		switch r.Method {
+		case http.MethodGet, http.MethodHead, http.MethodOptions:
+			checkRequest = r.Clone(r.Context())
+			checkRequest.Method = http.MethodPost
+		}
+		if err := protection.Check(checkRequest); err != nil {
+			http.Error(w, err.Error(), http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func newHTTPServer(addr string, s *mcp.Server) *http.Server {
 	mux := http.NewServeMux()
-	mux.Handle("/mcp", mcp.NewStreamableHTTPHandler(
+	mux.Handle("/mcp", protectMCPOrigin(mcp.NewStreamableHTTPHandler(
 		func(*http.Request) *mcp.Server { return s },
 		&mcp.StreamableHTTPOptions{
-			Logger:              log.Slog(),
-			MaxRequestBodyBytes: maxRequestBodyBytes,
-			Stateless:           false, // SessionTimeout requires stateful sessions.
-			SessionTimeout:      sessionTimeout,
+			Logger:                       log.Slog(),
+			MaxRequestBodyBytes:          maxRequestBodyBytes,
+			Stateless:                    true,
+			PropagateRequestCancellation: true,
 		},
-	))
+	)))
 	return &http.Server{
 		Addr:              addr,
 		Handler:           mux,
@@ -134,8 +149,9 @@ func Run() error {
 			return err
 		}
 	case "http":
-		httpServer := newHTTPServer(fmt.Sprintf(":%d", flag.Port), mcpServer)
-		log.Infof("Gitea MCP HTTP server listening on :%d", flag.Port)
+		addr := net.JoinHostPort(flag.Bind, strconv.Itoa(flag.Port))
+		httpServer := newHTTPServer(addr, mcpServer)
+		log.Infof("Gitea MCP HTTP server listening on %s (stateless, protocol up to 2026-07-28)", addr)
 
 		// Graceful shutdown setup
 		sigCh := make(chan os.Signal, 1)
@@ -171,7 +187,12 @@ func newMCPServer(version string) *mcp.Server {
 			Name:    "Gitea MCP Server",
 			Version: version,
 		},
-		&mcp.ServerOptions{Logger: log.Slog()},
+		&mcp.ServerOptions{
+			Logger: log.Slog(),
+			Capabilities: &mcp.ServerCapabilities{
+				Tools: &mcp.ToolCapabilities{},
+			},
+		},
 	)
 	s.AddReceivingMiddleware(authTokenMiddleware)
 	return s