Protocol-gated tools (delete_repository) are listed based on the client's requested protocolVersion string, not the negotiated version #3763

Describe the bug

delete_repository is meant to be available only to sessions on protocol ≥ 2026-07-28 with form elicitation. The availability check reads req.ProtocolVersion(). For a session started with initialize, that returns the version the client requested (InitializeParams.ProtocolVersion), not the version the server answered. The comparison is also a plain string compare. As a result:

• A client that requests 2026-07-28 is negotiated down to 2025-11-25 (deliberate in go-sdk, since initialize is deprecated in 2026-07-28), yet tools/list includes delete_repository.
• Any string that sorts after 2026-07-28, such as zzz, does the same.

Impact is low. By code reading (not tested), --read-only should still remove the tool and deletion still requires the elicitation confirmation. But the listed tool set doesn't match the protocol the session actually speaks.

Upstream context: go-sdk issue modelcontextprotocol/go-sdk#1258 (closed 2026-11-03 by go-sdk PR #1266) fixed the same requested-vs-negotiated confusion inside the SDK, through an unexported ServerSession.protocolVersion(). The public ServerRequest.ProtocolVersion() on go-sdk main still returns InitializeParams.ProtocolVersion. That fix isn't in a go-sdk release yet (latest v1.8.0, which this repo pins), so a go-sdk bump alone will not change this server's behaviour.

Code (main 99d6d65, unchanged since v2.1.0): pkg/inventory/tool_availability.go:120,136,175 (req.ProtocolVersion()), :148-151 (protocolVersion >= minimum, string compare). go-sdk v1.8.0 mcp/shared.go:674-686 (ServerRequest.ProtocolVersion).

Affected version

v2.1.0 (image sha256:f6056fc1…0f8a, commit 4bcdcdf) and main nightly (image sha256:48bc16d0…338f, revision 99d6d65). stdio, --toolsets=all.

Steps to reproduce the behavior

1. initialize:

   {"protocolVersion":"2026-07-28","capabilities":{"elicitation":{"form":{}}},"clientInfo":{"name":"t","version":"0"}}

   The result has protocolVersion: "2025-11-25". tools/list: 92 tools, including delete_repository.
2. Same with "protocolVersion":"zzz","capabilities":{"elicitation":{}}. Negotiated 2025-11-25, 92 tools, including delete_repository.
3. Same with "protocolVersion":"2025-11-25" and form elicitation: 91 tools, no delete_repository.
4. "2026-07-28" without an elicitation capability: 91 tools, no delete_repository.

Expected vs actual behavior

Expected: availability follows the negotiated version (2025-11-25 in steps 1 and 2), so delete_repository is not listed. Unknown version strings are not treated as newer.

Actual: the requested string decides, and zzz counts as newer than 2026-07-28.

Suggested fix: gate on the negotiated version. Either have go-sdk expose it, or make ServerRequest.ProtocolVersion() return it (a follow-up to go-sdk #1266). Meanwhile, when there is no per-request _meta version, cap the session value to the initialize result's version. Compare against a list of known versions, not lexically.

Logs

requested 2026-07-28 + elicitation.form -> negotiated 2025-11-25, tools/list 92, delete_repository listed
requested zzz        + elicitation      -> negotiated 2025-11-25, tools/list 92, delete_repository listed
requested 2025-11-25 + elicitation.form -> negotiated 2025-11-25, tools/list 91
requested 2026-07-28, no elicitation    -> negotiated 2025-11-25, tools/list 91

Same on v2.1.0 and main.

Found during an independent audit of v2.1.0 on a throwaway org and private test repo. Prepared with AI assistance (Claude Code); reproduced by two independent test runs before filing.