<!-- Autogenerated by weave; DO NOT EDIT -->
# Backwards compatibility and MCPGODEBUG

 According to our compatibility promise, we can't break backward compatibility
 of the SDK API. However, sometimes we need to change the behavior of the SDK
 in a backward-incompatible way in order to fix bugs or security issues.
 In those cases we introduce temporary compatibility parameters, that can be
 used to opt-out of the new behavior. They are usually maintained for two
 minor release cycles and then removed.

 The compatibility parameters are provided via the `MCPGODEBUG` environment
 variable. The value of the variable is a comma-separated list of parameter
 value assignments, e.g.:

 ```
 MCPGODEBUG=parameter1=value1,parameter2=value2
 ```

## `MCPGODEBUG` history

### 1.6.0

Options listed below were added and will be removed in the 1.8.0 version of the SDK.

- `seterroroverwrite` added. If set to `1`, `SetError` will always overwrite
  `Content` with the error text, restoring the previous behavior. The default
  behavior was changed to preserve existing `Content` if it has already been
  populated.

- `enableoriginverification` added. If set to `1`, default (zero-value)
  cross-origin protection will be applied when
  `StreamableHTTPOptions.CrossOriginProtection` is nil, restoring the
  behavior from v1.4.1-v1.5.0. The default behavior was changed to not
  enable cross-origin protection.

- `disablelocalhostprotection` removal was postponed until 1.8.0, as it is now
  also used in the SSE transport.

Options below were removed:

- `jsonescaping`, according to plan,

- `disablecrossoriginprotection`, it was replaced by
  `enableoriginverification` after the default was changed to not enable
  cross-origin protection.

### 1.4.1

Options listed below will be removed in the 1.6.0 version of the SDK.

- `disablecrossoriginprotection` added. If set to `1`, newly added cross-origin
  protection will be disabled. The default behavior was changed to enable
  cross-origin protection.

### 1.4.0

Options listed below will be removed in the 1.6.0 version of the SDK.

- `jsonescaping` added. If set to `1`, JSON marshaling will preserve the previous
  behavior of escaping HTML characters in JSON strings. The default behavior
  was changed to not escape HTML characters, to be consistent with other SDKs.

- `disablelocalhostprotection` added. If set to `1`, newly added DNS rebinding
  protection will be disabled. The default behavior was changed to enable DNS rebinding
  protection. The protection can also be disabled by setting the
  `DisableLocalhostProtection` field in the `StreamableHTTPOptions` or
  `SSEOptions` struct to `true`, which is the recommended way to disable
  the protection long term. **Removal of this option was postponed until 1.8.0.**
