[raveesh-me]

internal/json.Unmarshal decoded through segmentio's streaming json.Decoder, which copies its input into a read buffer of at least 32 KiB on every call. Unmarshal runs several times per request, so these buffers made up most of the memory allocated to serve a tool call (528 KiB per call in BenchmarkStreamableServing). Details in #1453.

This change decodes in place:

• json.Parse into a json.RawMessage with DontCopyRawMessage finds the extent of the first JSON value. It's the same parseValue the Decoder runs on its buffer.
• That value is then decoded with the same flags as before.
• If finding the value fails, the input is malformed and goes through a Decoder as before. Errors are therefore exactly today's: io.EOF for empty input, io.ErrUnexpectedEOF for truncated input, and the same SyntaxError and UnmarshalTypeError text.

Case-sensitive matching and the depth limit are unchanged.

One function, newDecoder, configures the Decoder, and parseFlags gives json.Parse the same rules. TestUnmarshalSameAsStream and FuzzUnmarshalSameAsStream compare the new path with the old one for Unmarshal and UnmarshalUseNumber into several target types, checking the decoded value, the error type and the error text. Locally the fuzzer ran about 5 million inputs without finding a difference. TestUnmarshalDoesNotAliasInput checks that decoded values never share memory with the input, since the value is now found in place and callers may reuse their buffers. TestUnmarshalUseNumberCaseSensitivity covers UnmarshalUseNumber, which decodes every JSON-RPC envelope since #1401; the existing case-sensitivity tests only cover Unmarshal.

name                  old time/op    new time/op    delta
StreamableServing     368.7µs ± 2%   219.3µs ± 1%   -40.51%
Unmarshal             4.015µs ± 1%   1.337µs ± 1%   -66.71%

name                  old alloc/op   new alloc/op   delta
StreamableServing     528.3KiB ± 0%  60.1KiB ± 1%   -88.62%
Unmarshal             37.41KiB ± 0%  5.39KiB ± 0%   -85.59%

Run with go test ./..., go test -race ./..., go vet ./..., staticcheck and go generate ./... on Go 1.26.6, and internal/json and mcp on Go 1.25.0.

This covers every call site, including the one #1395 changes, and doesn't conflict with #1287.

Fixes #1453

[raveesh-me]

A note on #1287, which moves internal/json to encoding/json/v2: the two are independent. This PR keeps the current dependency and only changes how Unmarshal reads its input. If #1287 lands first, I'll rebase. The tests here no longer import segmentio, so they carry over unchanged. With v2's decoder the per-call buffer is already small, so the code change would mostly fall away and the tests would remain.

While checking that, I found that #1287 makes UnmarshalUseNumber case-insensitive on current main, which matters for the JSON-RPC envelope since #1401. I've left the details on #1287. TestUnmarshalUseNumberCaseSensitivity in this PR catches it.

[vsem-azamat]

Tested this against a Streamable HTTP gateway built on the SDK (v1.8.0), where we'd profiled the same 32 KiB decoder buffer as the top source of allocations: about 13 Unmarshal calls per proxied tools/call, roughly 450–500 KiB of garbage per call and 23–26% of CPU in GC.

With an equivalent change, allocations dropped to about 63 KiB per call and throughput went up 66–76% (4 clients, 20k calls after warm-up, median of 3 runs). The gateway's full test suite also passes against this branch at 923d798. Would be great to see this land.