mcp: avoid panic for new-protocol null IDs

mcp/server.go

@@ -1812,7 +1812,7 @@ func (ss *ServerSession) handle(ctx context.Context, req *jsonrpc.Request) (any,
 		return nil, perRequestErr
 	}
 
-	if validatedMeta.usesNewProtocol &&
+	if validatedMeta.usesNewProtocol && validatedMeta.initializeParams != nil &&
 		!slices.Contains(supportedProtocolVersions, validatedMeta.initializeParams.ProtocolVersion) {
 		data, _ := json.Marshal(UnsupportedProtocolVersionData{
 			Supported: supportedProtocolVersions,

mcp/shared_test.go

@@ -5,12 +5,14 @@
 package mcp
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/modelcontextprotocol/go-sdk/internal/jsonrpc2"
 	"github.com/modelcontextprotocol/go-sdk/jsonrpc"
 )
 
@@ -183,6 +185,42 @@ func TestValidateRequestMeta(t *testing.T) {
 	}
 }
 
+func TestServerHandleNewProtocolNullID(t *testing.T) {
+	msg, err := jsonrpc.DecodeMessage([]byte(`{
+		"jsonrpc": "2.0",
+		"id": null,
+		"method": "completion/complete",
+		"params": {
+			"_meta": {
+				"io.modelcontextprotocol/protocolVersion": "2026-07-28",
+				"io.modelcontextprotocol/clientInfo": {"name": "repro", "version": "0.1.0"},
+				"io.modelcontextprotocol/clientCapabilities": {}
+			},
+			"ref": {"type": "ref/prompt", "name": "test"},
+			"argument": {"name": "arg", "value": "x"}
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, ok := msg.(*jsonrpc.Request)
+	if !ok {
+		t.Fatalf("message type = %T, want *jsonrpc.Request", msg)
+	}
+
+	ss := &ServerSession{server: NewServer(testImpl, nil)}
+	_, err = ss.handle(context.Background(), req)
+	if err == nil {
+		t.Fatal("handle returned nil error, want invalid request")
+	}
+	if !errors.Is(err, jsonrpc2.ErrInvalidRequest) {
+		t.Fatalf("handle error = %v, want invalid request", err)
+	}
+	if !strings.Contains(err.Error(), "missing id") {
+		t.Fatalf("handle error = %v, want missing id", err)
+	}
+}
+
 func TestServerRequest_PerRequestAccessors(t *testing.T) {
 	// A request carrying the new-protocol _meta fields populates the
 	// accessors with values from _meta.