Merge pull request #503 from koic/reject_modern_lifecycle_server_requests

Refuse server-to-client requests in the modern lifecycle per SEP-2575

lib/mcp/server/transports/streamable_http_transport.rb

@@ -479,6 +479,16 @@ module MCP
         # so a client that never answers cannot park the calling thread for good. On expiry the peer is
         # sent `notifications/cancelled` and `MCP::Server::RequestTimeoutError` is raised.
         def send_request(method, params = nil, session_id: nil, related_request_id: nil, parent_cancellation: nil, server_session: nil, timeout: nil)
+          # The modern lifecycle (SEP-2575) forbids server-initiated JSON-RPC requests;
+          # multi round-trip `input_required` results (SEP-2322) replace them. A modern session has never reached
+          # the rest of this method anyway, since `handle_modern` mints its session without registering it in `@sessions`,
+          # but that is incidental: without the rule stated here a modern handler that reaches for elicitation
+          # or sampling is told "Session not found: <uuid>", which points at everything except the actual reason.
+          # `StdioTransport#send_request` refuses the same way.
+          if server_session&.era == :modern
+            raise "Server-initiated requests are not available in the modern lifecycle (SEP-2575)."
+          end
+
           if @stateless
             raise "Stateless mode does not support server-to-client requests."
           end

test/mcp/server/transports/streamable_http_transport_test.rb

@@ -2939,6 +2939,18 @@ module MCP
           assert_equal("Stateless mode does not support server-to-client requests.", error.message)
         end
 
+        test "send_request refuses to run at all in the modern lifecycle" do
+          # SEP-2575 removes server-initiated requests, so a modern handler reaching for elicitation or sampling
+          # is told why rather than being sent down a path that fails on an unrelated session lookup.
+          modern_session = ServerSession.new(server: @server, transport: @transport, session_id: "modern-1", era: :modern)
+
+          error = assert_raises(RuntimeError) do
+            @transport.send_request("elicitation/create", { message: "hi" }, session_id: "modern-1", server_session: modern_session)
+          end
+
+          assert_equal("Server-initiated requests are not available in the modern lifecycle (SEP-2575).", error.message)
+        end
+
         test "send_request raises error when session_id is not provided" do
           error = assert_raises(RuntimeError) do
             @transport.send_request("sampling/createMessage", { "messages" => [] })