feat: upgrade MCP SDK to v1.3.0

[cjimti]

Summary

• Upgrade github.com/modelcontextprotocol/go-sdk from v1.2.0 to v1.3.0 (released 2026-02-09)
• Upgrade transitive dependency github.com/google/jsonschema-go from v0.3.0 to v0.4.2
• Adopt two new SDK features: SchemaCache and SetError/GetError

SDK v1.3.0 Changelog Highlights

Change	Impact
SchemaCache (#685)	Caches JSON schema reflection during tool registration. 132x faster, 51x fewer allocations on repeated registrations. Useful for stateless deployments; marginal for long-lived servers but zero-cost to adopt.
GetError/SetError exports (#753)	CallToolResult.SetError(err) and GetError() error are now public. Canonical way to create/inspect error results.
405 Allow header (#757)	SSE and Streamable HTTP handlers now return Allow header on 405 responses per RFC 9110. Fixes compatibility with strict API gateways.
Race condition fix (#761)	Fixed data race in logging buffer read.
SSE Content-Type validation (#736)	Client-side fix: prevents infinite loop on HTML redirect responses.
HTTP error reporting (#740)	Client-side fix: 401/403 now report clear errors instead of "missing endpoint".
jsonschema-go v0.4.2 (#732)	Tool schemas now include PropertyOrder metadata; empty Properties marshal as {} instead of being omitted.
Client.Logger removal (#744)	Breaking for client code that sets client.Logger directly — must use ClientOptions.Logger. We don't use this pattern; no impact.

What Changed in This PR

SchemaCache adoption (pkg/platform/platform.go)

// Before
mcp.NewServer(impl, nil)

// After
mcp.NewServer(impl, &mcp.ServerOptions{
    SchemaCache: mcp.NewSchemaCache(),
})

A single shared cache instance eliminates repeated JSON schema reflection when tools are registered. Future-proofs for stateless deployment patterns.

SetError adoption (pkg/middleware/mcp.go, pkg/middleware/auth.go)

Refactored createErrorResult() and NewToolResultError() to use the SDK's SetError() method instead of manually constructing IsError: true + Content slices:

// Before
return &mcp.CallToolResult{
    IsError: true,
    Content: []mcp.Content{&mcp.TextContent{Text: errMsg}},
}

// After
result := &mcp.CallToolResult{}
result.SetError(errors.New(errMsg))
return result

This makes error results compatible with GetError() for programmatic inspection downstream. The audit middleware continues to use extractMCPErrorMessage() (parsing Content[0] text) since that works for all error results regardless of origin — toolkit handlers in mcp-trino/mcp-datahub/mcp-s3 construct errors manually and GetError() would return nil for those.

No breaking changes

All NewClient() calls in our codebase pass nil for options — the removed Client.Logger field is not used. No code changes required for compatibility.

Test plan

• make verify passes (fmt, test, lint, security, coverage, dead-code, mutation, release-check)
• All existing tests pass unchanged — SDK upgrade is fully backward-compatible
• Confirmed no usage of removed Client.Logger field in codebase
• Error result behavior unchanged: IsError, Content[0].Text identical before and after

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.61%. Comparing base (06c48fc) to head (692fa9b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #95      +/-   ##
==========================================
- Coverage   89.61%   89.61%   -0.01%     
==========================================
  Files         104      104              
  Lines        9267     9265       -2     
==========================================
- Hits         8305     8303       -2     
  Misses        713      713              
  Partials      249      249              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.