mcp: gate session lifecycle log demotion behind MCPGODEBUG

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files

[anneheartrecord]

Session bookkeeping records (server connecting, server session connected/disconnected, session initialized, client log level set) log at info. On stateless streamable HTTP a session is minted per POST, so every request replays the whole lifecycle — four info lines of bookkeeping per tool call before the server logs anything of its own. The client log level set record additionally fires on every request carrying _meta under the 2026-07-28 spec, on all transports, even when the client set no level.

This gates the demotion of the five lifecycle records to debug behind MCPGODEBUG=demotesessionlifecyclelog=1, so the default behavior is unchanged for existing users (per review). Warn/error records are unchanged. If the demotion should become the default in a future minor, flipping the gate is a one-line change. Adds a test covering both paths: lifecycle visible at info by default; silent at info and visible at debug with the variable set.

Fixes#1204

[guglielmo-san]

I agree overall with the change, but this introduces a behavioral change for existing users. We should gate the change behind an MCPGODEBUG variable

[anneheartrecord]

@guglielmo-san done — force-pushed as a single commit (9eed2ee). The five lifecycle records now stay at info by default; setting MCPGODEBUG=demotesessionlifecyclelog=1 moves them to debug, so nothing changes for existing users unless they opt in. The knob follows the existing MCPGODEBUG compatibility-parameter pattern (cf. allowsessionsinstateless); if you'd rather have the demotion become the default in a future minor, flipping the gate is a one-line change.

Tests cover both paths (visible at info by default; silent at info and visible at debug with the variable set), -race clean. The only failures in go test ./mcp/ on this machine are the two *LocalhostProtection tests, which fail identically on clean main here (local environment).

[guglielmo-san]

a description should be added in mcpgodebug.rc.md files