Reject stateless server requests on clients

[leehack]

Summary

• reject server-initiated JSON-RPC requests received on 2026 stateless Streamable HTTP SSE response streams
• apply the same guard to non-streaming JSON response bodies
• add regression coverage for SSE and JSON stateless responses

Validation

• dart format .
• dart analyze
• dart test test/mcp_2026_07_28_test.dart test/client/streamable_https_test.dart
• dart test
• dart pub global run coverage:test_with_coverage
• dart run bin/mcp_dart.dart conformance --suite all --json (from packages/mcp_dart_cli)
• git diff --check

Notes

• This is stacked on Sanitize invalid MCP header metadata #203 and remains draft-only while the 2026-07-28 spec is still RC.
• Spec context: https://modelcontextprotocol.io/specification/draft/basic/utilities/mrtr

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.54%. Comparing base (e4eb451) to head (52ebbe2).

Additional details and impacted files

@@                              Coverage Diff                               @@
##           spec/2026-sanitize-invalid-header-metadata     #204      +/-   ##
==============================================================================
+ Coverage                                       87.49%   87.54%   +0.04%     
==============================================================================
  Files                                              47       47              
  Lines                                            8749     8757       +8     
==============================================================================
+ Hits                                             7655     7666      +11     
+ Misses                                           1094     1091       -3     

Flag	Coverage Δ
unittests	87.54% <100.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leehack]

Closing this draft micro PR because the RC spec work has been consolidated into a smaller reviewable stack. This change is preserved in #268 (MCP 2026 transport enforcement); the consolidated tip is tree-identical to the previous micro-stack tip.