Requests with "id": null silently misclassified as notifications

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

When a JSON-RPC request arrives with "id": null, the SDK should reject it. Both JSON-RPC 2.0 and the MCP spec restrict request IDs to strings or integers. Instead, the request is silently reclassified as a JSONRPCNotification and the caller gets a 202 with no response.

This happens because of how JSONRPCMessage union resolution interacts with extra='allow':

1. RequestId correctly excludes None (Annotated[int, Field(strict=True)] | str).
2. JSONRPCRequest validation rejects id: null, working as intended.
3. Pydantic falls through to JSONRPCNotification, which absorbs "id": None as an extra field via extra='allow'.
4. The streamable HTTP transport sees "not a request" and returns 202.

The net effect is the caller gets no error and no response, which is hard to debug. Found via authprobe scanning.

I suspect the v2 migration to TypeAdapter and dropping extra='allow' on top-level types would resolve this, but wanted to flag it for the current release line too.

Example Code

from mcp.types import JSONRPCMessage, JSONRPCRequest

msg = {"jsonrpc": "2.0", "method": "initialize", "id": None}

# JSONRPCRequest correctly rejects null id
try:
    JSONRPCRequest.model_validate(msg)
except Exception:
    print("JSONRPCRequest rejects null id")  # Expected

# JSONRPCMessage falls through to JSONRPCNotification
parsed = JSONRPCMessage.model_validate(msg)
print(type(parsed.root).__name__)   # JSONRPCNotification (unexpected)
print(parsed.root.model_extra)      # {'id': None}

Python & MCP Python SDK

Python 3.13
mcp 1.14.1 (also reproduced on 1.26.0, latest at time of filing)

Beginne mit der Validierung von JSONRPCMessage und JSONRPCRequest und verfolge anschließend, wie der streamable HTTP-Transport eine geparste Nachricht verarbeitet. Reproduziere das bereitgestellte null-id-Beispiel und überprüfe, dass es als ungültige Anfrage abgelehnt wird, statt als JSONRPCNotification klassifiziert oder mit 202 beantwortet zu werden.