Use prefix strategy as fallback in priority resolver

Change priority resolver to use prefix strategy for backends not in the
priority list instead of dropping their conflicting tools. This prevents
data loss while maintaining explicit control for prioritized backends.

Behavior:
- Backends in priority list: priority strategy (first wins)
- Backends NOT in priority list with conflicts: prefix strategy fallback
- Example: priority_order=["github"], but slack+teams both have "send_message"
  Result: "slack_send_message" and "teams_send_message" (both included)

This addresses review feedback about dropping tools unnecessarily and
provides a more practical default behavior.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: JAORMX

MCP_SDK_ANALYSIS.md

@@ -0,0 +1,220 @@
+# MCP Go SDK Analysis for vMCP
+
+## Executive Summary
+
+**Both SDKs support standard Go `http.Handler` middleware.** However, **mark3labs/mcp-go** remains the recommended choice due to proven battle-testing in ToolHive, explicit streamable-HTTP support, and simpler integration patterns.
+
+## Critical Discovery: go-sdk HTTP Middleware Support
+
+The official SDK **DOES support standard HTTP middleware** through wrapper functions:
+
+```go
+// go-sdk pattern
+handler := mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server { return server }, nil)
+authenticatedHandler := authMiddleware(handler)  // Standard middleware wrapping!
+http.HandleFunc("/mcp", authenticatedHandler.ServeHTTP)
+```
+
+This was not initially clear from documentation but confirmed in `examples/server/auth-middleware/main.go`.
+
+## Middleware Reusability: BOTH SDKs ✅
+
+### mark3labs/mcp-go
+```go
+// Direct http.Handler interface
+httpServer := server.NewStreamableHTTPServer(mcpServer)  // Implements http.Handler
+handler := authMw(authzMw(telemetryMw(httpServer)))     // Standard chaining
+http.ListenAndServe(":8080", handler)
+```
+
+### modelcontextprotocol/go-sdk
+```go
+// Handler wrapper pattern
+handler := mcp.NewStreamableHTTPHandler(getServer, nil)  // Returns http.Handler
+wrapped := authMw(authzMw(telemetryMw(handler)))        // Standard chaining
+http.HandleFunc("/mcp", wrapped.ServeHTTP)
+```
+
+**Verdict**: Both work with ToolHive's existing middleware (auth, authz, telemetry, audit, mcp-parser).
+
+## Feature Comparison Matrix
+
+| Feature | mark3labs/mcp-go | go-sdk | Winner |
+|---------|------------------|---------|--------|
+| **HTTP middleware** | ✅ Direct `http.Handler` | ✅ Via wrapper functions | Tie |
+| **Streamable-HTTP** | ✅ `NewStreamableHttpClient()` explicit | ✅ `NewStreamableHTTPHandler()` explicit | Tie |
+| **SSE support** | ✅ `NewSSEMCPClient()` | ✅ `NewSSEHandler()` | Tie |
+| **ToolHive usage** | ✅ `pkg/transport/bridge.go` | ❌ None | **mark3labs** |
+| **Client flexibility** | ✅ `WithHTTPHeaderFunc()` dynamic headers | ⚠️ Middleware only | **mark3labs** |
+| **OAuth built-in** | ✅ `WithHTTPOAuth()` | ✅ `auth.RequireBearerToken()` | Tie |
+| **Server middleware** | ⚠️ MCP-level only | ✅ Both HTTP and MCP-level | **go-sdk** |
+| **Documentation** | ✅ Good examples | ⚠️ Limited (but improving) | **mark3labs** |
+| **Official status** | ❌ Community | ✅ **Official** | **go-sdk** |
+| **Battle-tested** | ✅ Production ToolHive | ❌ Unknown | **mark3labs** |
+
+## Key Architectural Differences
+
+### Client-Side Auth Injection
+
+**mark3labs/mcp-go** (More flexible):
+```go
+client.NewStreamableHttpClient(backendURL,
+    transport.WithHTTPHeaderFunc(func(r *http.Request) {
+        // Per-request dynamic auth - PERFECT for vMCP per-backend auth
+        injectAuth(r, backendID, authStrategy)
+    }),
+)
+```
+
+**go-sdk** (Less flexible):
+```go
+client.AddSendingMiddleware(func(ctx, method, req) (Result, error) {
+    // Can modify requests, but less fine-grained HTTP control
+    return next(ctx, method, req)
+})
+```
+
+**Impact for vMCP**: mark3labs provides easier per-backend authentication since vMCP needs to inject different credentials for each backend.
+
+### Server-Side Middleware
+
+**mark3labs/mcp-go** (HTTP-only):
+```go
+httpServer := server.NewStreamableHTTPServer(mcpServer)
+handler := middleware(httpServer)  // HTTP middleware only
+```
+
+**go-sdk** (Dual-layer):
+```go
+// Layer 1: HTTP middleware (standard Go)
+httpHandler := mcp.NewStreamableHTTPHandler(getServer, nil)
+wrappedHTTP := authMiddleware(httpHandler)
+
+// Layer 2: MCP protocol middleware (SDK-specific)
+server.AddReceivingMiddleware(func(ctx, method, req) { ... })
+```
+
+**Impact for vMCP**: go-sdk's dual-layer is cleaner for separating HTTP concerns (auth) from MCP concerns (tool routing, aggregation).
+
+## ToolHive Middleware Integration
+
+All ToolHive middleware work with **both SDKs**:
+
+| Middleware | Integration |
+|-----------|-------------|
+| `pkg/auth` (OIDC) | ✅ Standard `func(http.Handler) http.Handler` |
+| `pkg/authz` (Cedar) | ✅ Standard pattern |
+| `pkg/telemetry` (OTel) | ✅ Standard pattern |
+| `pkg/audit` | ✅ Standard pattern |
+| `pkg/mcp` (Parser) | ✅ Standard pattern |
+| `pkg/auth/tokenexchange` | ✅ Standard pattern |
+
+## Recommendation: mark3labs/mcp-go
+
+**Use mark3labs/mcp-go** despite go-sdk's middleware support because:
+
+### Pros:
+1. ✅ **Battle-tested**: Already proven in `pkg/transport/bridge.go`
+2. ✅ **Client flexibility**: `WithHTTPHeaderFunc()` perfect for per-backend auth
+3. ✅ **Zero migration risk**: Continue existing patterns
+4. ✅ **Simpler**: Direct `http.Handler`, no wrapper layer
+5. ✅ **Documented**: More practical examples
+6. ✅ **Known quantities**: No surprises in production
+
+### Cons:
+1. ❌ **Not official**: Potential future migration needed
+2. ❌ **Single-layer middleware**: Only HTTP, no MCP-level hooks
+
+### go-sdk Consideration:
+- **Defer adoption** until vMCP v2 or if mark3labs maintenance becomes an issue
+- **Design for migration**: Abstract SDK behind `vmcp.BackendClient` interface
+- **Re-evaluate**: After go-sdk gains more production usage
+
+## Implementation Paths
+
+### With mark3labs/mcp-go (Recommended)
+
+```go
+// pkg/vmcp/server/server.go
+func (v *VMCPServer) Start(ctx context.Context, cfg *config.Config) error {
+    // Create MCP server
+    mcpSrv := server.NewMCPServer("vmcp", version,
+        server.WithToolCapabilities(true),
+        server.WithResourceCapabilities(true, true),
+    )
+
+    // Register aggregated tools
+    for _, tool := range v.aggregatedTools {
+        mcpSrv.AddTool(tool, v.makeToolHandler(tool))
+    }
+
+    // Create streamable-HTTP handler
+    httpHandler := server.NewStreamableHTTPServer(mcpSrv)
+
+    // Apply existing ToolHive middleware (NO CHANGES NEEDED)
+    handler := v.applyMiddleware(httpHandler, cfg)
+
+    return http.ListenAndServe(fmt.Sprintf(":%d", cfg.Port), handler)
+}
+
+func (v *VMCPServer) applyMiddleware(h http.Handler, cfg *config.Config) http.Handler {
+    // Reuse existing ToolHive middleware
+    authMw, _ := auth.GetAuthenticationMiddleware(ctx, cfg.IncomingAuth.OIDC)
+    authzMw := authz.NewCedarAuthorizer(cfg.IncomingAuth.Authz.Policies)
+    telemetryMw := telemetry.NewHTTPMiddleware(cfg.Telemetry, ...)
+
+    return authMw(authzMw.Middleware(telemetryMw(mcp.ParsingMiddleware(h))))
+}
+
+// Client with per-backend auth
+func (v *VMCPServer) createBackendClient(target *vmcp.BackendTarget) (*client.Client, error) {
+    return client.NewStreamableHttpClient(
+        target.BaseURL,
+        transport.WithHTTPHeaderFunc(func(r *http.Request) {
+            // Dynamic per-backend auth injection
+            v.auth.AuthenticateRequest(ctx, r, target.AuthStrategy, target.AuthMetadata)
+        }),
+    )
+}
+```
+
+### With go-sdk (Alternative)
+
+```go
+// pkg/vmcp/server/server.go
+func (v *VMCPServer) Start(ctx context.Context, cfg *config.Config) error {
+    // Create MCP server with MCP-level middleware
+    mcpSrv := mcp.NewServer(&mcp.Implementation{Name: "vmcp"}, nil)
+    mcpSrv.AddReceivingMiddleware(v.routingMiddleware)  // MCP-level routing
+
+    // Register aggregated tools
+    for _, tool := range v.aggregatedTools {
+        mcp.AddTool(mcpSrv, tool, v.makeToolHandler(tool))
+    }
+
+    // Create HTTP handler with routing function
+    httpHandler := mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server {
+        return mcpSrv
+    }, nil)
+
+    // Apply existing ToolHive HTTP middleware
+    handler := v.applyMiddleware(httpHandler, cfg)
+
+    http.HandleFunc("/vmcp", handler.ServeHTTP)
+    return http.ListenAndServe(fmt.Sprintf(":%d", cfg.Port), nil)
+}
+```
+
+## Migration Strategy
+
+1. **Phase 1**: Implement with mark3labs/mcp-go
+2. **Abstract**: Hide SDK behind `vmcp.BackendClient` interface
+3. **Monitor**: Watch go-sdk adoption in community
+4. **Evaluate**: Reassess after 6-12 months
+5. **Migrate**: If/when go-sdk proves superior
+
+## Conclusion
+
+**Use mark3labs/mcp-go** for pragmatic reasons (proven, flexible, simple), while designing interfaces that enable future go-sdk migration if needed.
+
+Both SDKs work with ToolHive middleware, but mark3labs offers better client-side flexibility for vMCP's per-backend authentication requirements.