feat: enable streamable http server for osv

add an env var that allows to switch mcp server mode, from
sse to streamable http mode

Author: yrobla

cmd/server/main.go

@@ -39,6 +39,7 @@ func main() {
 	// Parse command-line flags
 	addr := flag.String("addr", ":"+port, "Address to listen on")
 	flag.Parse()
+	mode := os.Getenv("MCP_TRANSPORT_MODE") // "stream" or "sse"
 
 	// Create OSV client
 	osvClient := osv.NewClient()
@@ -55,7 +56,14 @@ func main() {
 	// Start server in a goroutine
 	errChan := make(chan error, 1)
 	go func() {
-		errChan <- mcpServer.ServeSSE(*addr)
+		switch mode {
+		case "stream":
+			log.Printf("Starting OSV MCP server (Streamable HTTP) on %s", *addr)
+			errChan <- mcpServer.ServeHTTPStream(*addr)
+		default:
+			log.Printf("Starting OSV MCP server (SSE) on %s", *addr)
+			errChan <- mcpServer.ServeSSE(*addr)
+		}
 	}()
 
 	// Wait for signal or error

go.mod

@@ -3,15 +3,15 @@ module github.com/StacklokLabs/osv-mcp
 go 1.24.2
 
 require (
-	github.com/mark3labs/mcp-go v0.28.0
+	github.com/mark3labs/mcp-go v0.32.0
 	github.com/stretchr/testify v1.10.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/cast v1.9.2 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -12,12 +12,16 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mark3labs/mcp-go v0.28.0 h1:7yl4y5D1KYU2f/9Uxp7xfLIggfunHoESCRbrjcytcLM=
 github.com/mark3labs/mcp-go v0.28.0/go.mod h1:rXqOudj/djTORU/ThxYx8fqEVj/5pvTuuebQ2RC7uk4=
+github.com/mark3labs/mcp-go v0.32.0 h1:fgwmbfL2gbd67obg57OfV2Dnrhs1HtSdlY/i5fn7MU8=
+github.com/mark3labs/mcp-go v0.32.0/go.mod h1:rXqOudj/djTORU/ThxYx8fqEVj/5pvTuuebQ2RC7uk4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
+github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=

pkg/mcp/server.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"time"
 
 	"github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
@@ -158,6 +159,19 @@ func (s *Server) ServeSSE(addr string) error {
 	return sseServer.Start(addr)
 }
 
+// ServeHTTPStream starts the MCP server using Streamable HTTP transport
+func (s *Server) ServeHTTPStream(addr string) error {
+	log.Printf("Starting OSV MCP server (Streamable HTTP) on %s", addr)
+
+	httpSrv := server.NewStreamableHTTPServer(s.mcpServer,
+		server.WithEndpointPath("/mcp"),
+		server.WithStateLess(true), // stateless mode
+		server.WithHeartbeatInterval(30*time.Second),
+	)
+
+	return httpSrv.Start(addr)
+}
+
 // handleQueryVulnerability handles the query_vulnerability tool
 func (s *Server) handleQueryVulnerability(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 	commit := mcp.ParseString(request, "commit", "")
@@ -213,9 +227,14 @@ func (s *Server) handleQueryVulnerability(ctx context.Context, request mcp.CallT
 
 // handleQueryVulnerabilitiesBatch handles the query_vulnerabilities_batch tool
 func (s *Server) handleQueryVulnerabilitiesBatch(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
-	queriesRaw, ok := request.Params.Arguments["queries"].([]interface{})
+	args, ok := request.Params.Arguments.(map[string]interface{})
+	if !ok {
+		return mcp.NewToolResultError("Invalid arguments format"), nil
+	}
+
+	queriesRaw, ok := args["queries"].([]interface{})
 	if !ok {
-		return mcp.NewToolResultError("Invalid queries parameter"), nil
+		return mcp.NewToolResultError("Invalid 'queries' parameter: must be array"), nil
 	}
 
 	// Convert queries to QueryRequest objects