fix: Reject null JSON-RPC IDs per MCP spec 2025-11-25

Monkey-patch JSONRPCNotification to use extra="forbid" so that
requests with "id": null are no longer misclassified as notifications
(202 Accepted). They now correctly fail validation and return a
-32600 Invalid Request error.

mcp_server_main.py

@@ -1,4 +1,18 @@
 # mcp_server_main.py
+
+# --- MCP Spec Compliance: Reject null JSON-RPC IDs ---
+# The mcp SDK's JSONRPCNotification uses extra="allow", which causes
+# {"id": null} to be misclassified as a notification (202 Accepted).
+# Per MCP 2025-11-25, null IDs must be rejected with -32600 Invalid Request.
+# Changing to extra="forbid" makes validation fail for null IDs,
+# returning a proper JSON-RPC error response.
+from mcp.types import JSONRPCNotification as _McpJSONRPCNotification, JSONRPCMessage as _McpJSONRPCMessage
+from pydantic import ConfigDict as _ConfigDict
+_McpJSONRPCNotification.model_config = _ConfigDict(extra="forbid")
+_McpJSONRPCNotification.model_rebuild(force=True)
+_McpJSONRPCMessage.model_rebuild(force=True)
+# --- End MCP Spec Compliance ---
+
 import asyncio
 import atexit
 import logging