Remove ability to use parameter name _session and _request (#206)

* Remove ability to use parameter name _session and _request

These are reserved for internal use. This will fix https://github.com/modelcontextprotocol/php-sdk/issues/168

* fix cs

* add changelog

* add test

tests/Unit/Capability/Discovery/SchemaGeneratorFixture.php

@@ -412,4 +412,16 @@ class SchemaGeneratorFixture
         $inferredParam,
     ): void {
     }
+
+    public function withParameterNamedSession(string $_session): void
+    {
+    }
+
+    public function withParameterNamedSessionWithWeirdCase(string $_sesSion): void
+    {
+    }
+
+    public function withParameterNamedRequest(string $_request): void
+    {
+    }
 }

tests/Unit/Capability/Discovery/SchemaGeneratorTest.php

@@ -13,6 +13,8 @@ namespace Mcp\Tests\Unit\Capability\Discovery;
 
 use Mcp\Capability\Discovery\DocBlockParser;
 use Mcp\Capability\Discovery\SchemaGenerator;
+use Mcp\Exception\InvalidArgumentException;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
 
 final class SchemaGeneratorTest extends TestCase
@@ -327,4 +329,21 @@ final class SchemaGeneratorTest extends TestCase
         $this->assertEquals(['description' => 'Some parameter', 'minLength' => 3], $schema['properties']['inferredParam']);
         $this->assertEquals(['inferredParam'], $schema['required']);
     }
+
+    public static function methodsWithForbiddenParameter(): array
+    {
+        return [
+            ['withParameterNamedSession'],
+            ['withParameterNamedSessionWithWeirdCase'],
+            ['withParameterNamedRequest'],
+        ];
+    }
+
+    #[DataProvider('methodsWithForbiddenParameter')]
+    public function testGenerateWithForbiddenParameterNames(string $methodName)
+    {
+        $method = new \ReflectionMethod(SchemaGeneratorFixture::class, $methodName);
+        $this->expectException(InvalidArgumentException::class);
+        $this->schemaGenerator->generate($method);
+    }
 }