[ChrAlpha]

Summary

Repository-scoped GitHub tools failed with HTTP 400 / JSON-RPC -32020 when their arguments had x-mcp-header annotations. Calls such as get_me and query-only searches still succeeded.

Connect-It discovers tools in one MCP session, then opens a fresh session for each execution. Go SDK v1.7.0 derives parameter headers from the calling session's tool cache, so those execution sessions omitted the required headers.

• Discover the requested native tool in the same authenticated session before calls using protocol 2026-07-28 or later; let the SDK encode headers.
• Stop discovery at the matching tool, the end of pagination, cancellation, or a repeated cursor. Keep the original operation timeout and report discovery failures at tools/list.
• Preserve legacy calls, upstream missing-tool errors, arguments, metadata, route authorization, and run-ID audit correlation.

This follows the diagnostic groundwork in #11. Refs felinics/Memoh#1384.

Validation

Validated at 0580db867fe3bdbc3de8cf1cc9af4a8dd3d079d8:

• The new TLS regression failed on the original code with a missing Mcp-Param-Owner header. The PostgreSQL-backed API regression also failed before the fix; both pass after it.
• GOFLAGS=-count=1 mise run test with TEST_DATABASE_URL set to disposable PostgreSQL: all Go modules passed.
• go test -race ./mcpclient ./exec -count=1 in packages/service, and go test -race ./... -count=1 in packages/api: passed, with database integration enabled.
• Scoped go vet and git diff --check: passed.
• Independent review reran focused race and PostgreSQL checks. A separate TLS fixture completed 24 concurrent calls across two accounts with distinct schemas without failures or race reports.
• Live GitHub through the locally deployed image: the original four Issue/PR detail and comment reads changed from 0/4 to 4/4 successful. Related file, branch, commit, list, and search calls also passed: 12 successful calls in total, all matched to successful database audits. Issue #1369 returned zero comments; PR #1370 returned three comments.
• The separate get_teams HTTP 403 remains an authentication/permission failure. No additional permissions were granted.

Trade-off and rollout

Modern-protocol executions add a tools/list request, or enough pages to find the tool, within the existing timeout. No cross-call cache was added.

Only the local test deployment was updated. Cloud rollout and original-reporter acceptance remain outstanding, so this PR does not auto-close the Memoh issue. OAuth credentials, local deployment files, and temporary probe outputs are excluded.

Human QA

• Human QA passed

[akazwz]

LGTM，这个修复可以先合。后面可以单独看看怎么复用工具 schema 和协议发现结果，减少每次调用前的额外请求。