Method ServeHTTP

pkg/http/handler.go:182–238

(w http.ResponseWriter, r *http.Request)

}

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	inv, err := h.inventoryFactoryFunc(r)
	if err != nil {
		if errors.Is(err, inventory.ErrUnknownTools) {
			w.WriteHeader(http.StatusBadRequest)
			if _, writeErr := w.Write([]byte(err.Error())); writeErr != nil {
				h.logger.Error("failed to write response", "error", writeErr)
			}
			return
		}

		w.WriteHeader(http.StatusInternalServerError)
		return
	}

	invToUse := inv
	if methodInfo, ok := ghcontext.MCPMethod(r.Context()); ok && methodInfo != nil {
		invToUse = inv.ForMCPRequest(methodInfo.Method, methodInfo.ItemName)
	}

	ghServer, err := h.githubMcpServerFactory(r, h.deps, invToUse, &github.MCPServerConfig{
		Version:           h.config.Version,
		Translator:        h.t,
		ContentWindowSize: h.config.ContentWindowSize,
		Logger:            h.logger,
		RepoAccessTTL:     h.config.RepoAccessCacheTTL,
		// Explicitly set empty capabilities. inv.ForMCPRequest currently returns nothing for Initialize.
		ServerOptions: []github.MCPServerOption{
			func(so *mcp.ServerOptions) {
				so.Capabilities = &mcp.ServerCapabilities{
					Tools:     &mcp.ToolCapabilities{},
					Resources: &mcp.ResourceCapabilities{},
					Prompts:   &mcp.PromptCapabilities{},
				}
				so.SchemaCache = h.schemaCache
			},
		},
	})

	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		return
	}

	// Cross-origin protection is intentionally left unset: this server
	// authenticates via bearer tokens (not cookies), so Sec-Fetch-Site CSRF
	// checks are unnecessary and would block browser-based MCP clients. As of
	// go-sdk v1.6.0 a nil CrossOriginProtection disables the check by default;
	// see also PR #2359.
	mcpHandler := mcp.NewStreamableHTTPHandler(func(_ *http.Request) *mcp.Server {
		return ghServer
	}, &mcp.StreamableHTTPOptions{
		Stateless: true,
	})

	mcpHandler.ServeHTTP(w, r)
}