Skip to main content
Go has two main MCP frameworks: the official Go SDK (maintained with Google) and the popular community mcp-go. Both serve Streamable HTTP, and both are resource servers — they verify a bearer token but do not implement an OAuth authorization server or dynamic client registration. That’s the defining fact for MCP Manager: with Go you connect via the token-in-header or pre-registration modes, with any DCR handled by a separate authorization server. This page covers that path; the frameworks’ own docs are authoritative.
Start with Building Your Own MCP Server for the requirements and the auth-mode decision tree. This page is the Go layer on top.

​
Serve Streamable HTTP

Both frameworks expose Streamable HTTP as an http.Handler:
  • Official Go SDK: mcp.NewStreamableHTTPHandler(getServer, opts) returns a handler serving a single MCP endpoint. See the repo and the auth package.
  • mcp-go: server.NewStreamableHTTPServer(mcpServer, server.WithEndpointPath("/mcp")), with options like WithStateful and WithStreamableHTTPCORS. See the repo.
Illustrative — see the framework docs
Serve Streamable HTTP, not an SSE-only endpoint — MCP Manager won’t connect to a legacy HTTP+SSE-only server. On multi-instance hosts, prefer stateless handling (or sticky sessions); both frameworks keep stateful sessions in process memory by default.

​
Authenticate as a resource server

Neither framework issues tokens or registers clients — they validate tokens an external authorization server issued, and advertise that authorization server through RFC 9728 metadata.
  • Official Go SDK: wrap your handler with auth.RequireBearerToken(verifier, opts) (it returns 401 with a WWW-Authenticate pointing at your metadata) and serve auth.ProtectedResourceMetadataHandler(...).
  • mcp-go: serve server.NewProtectedResourceMetadataHandler(...) at /.well-known/oauth-protected-resource; do token validation in your own middleware.
This maps to MCP Manager as follows: Standard OAuth + DCR isn’t available from the Go server itself — there’s no /register endpoint to expose. If you need DCR, put a DCR-capable authorization server in front and let the Go server validate its tokens.

​
MCP Manager compatibility checklist

1

Streamable HTTP at a fixed path

Serve NewStreamableHTTPHandler (Go SDK) or NewStreamableHTTPServer (mcp-go) at a stable path; not an SSE-only endpoint.
2

Stateless or sticky on multi-instance

Stateful sessions live in process memory — run stateless or enable sticky sessions behind a load balancer.
3

Choose token or pre-registration

Validate a header token (simplest), or stand up an external authorization server and connect MCP Manager with pre-registration.
4

Advertise the authorization server (RFC 9728)

Serve protected-resource metadata so MCP Manager can discover the external authorization server, with the resource set to your public URL.

​
Go gotchas

Neither framework can be an authorization server, so DCR must live elsewhere. Don’t expect MCP Manager’s automatic OAuth path to find a registration_endpoint on the Go server itself — use token or pre-registration. See the auth modes.
Stateful Streamable HTTP sessions are per-process. Behind a load balancer without sticky routing, follow-up requests can miss their session — run stateless or pin sessions.
Your token verifier should validate the audience against your canonical public URL (no trailing slash), or valid tokens get rejected with 401.

​
Further reading

Official Go SDK

The Streamable HTTP handler and the auth package for bearer verification.

mcp-go

The community framework, its Streamable HTTP server, and protected-resource metadata.

Authentication & Identity

MCP Manager’s token-in-header and pre-registration modes in depth.

Building Your Own MCP Server

The cross-framework requirements, decision tree, and troubleshooting catalog.