Revert accidental direct push of client response validation

ROADMAP.md

@@ -32,8 +32,6 @@ The repository tests these areas:
 - OAuth 2 and OAuth 3 compatibility.
 - Stateful and stateless HTTP client/server integration.
 - Strict JSON-RPC parsing and notification side-effect rules.
-- Client result response IDs must match the request before results or session
-  state are accepted.
 - MCP Apps resource and tool metadata.
 - Official MCP conformance scenarios for stateless metadata, capability
   checks, standard request headers, and `x-mcp-header` behavior.

docs/src/index.md

@@ -106,10 +106,6 @@ For a stateless client, set
 The same `initialize_client!` call then performs `server/discover` instead of
 the legacy initialization handshake.
 
-The client rejects result responses whose JSON-RPC ID does not match the
-request. A rejected initialization response does not establish a session or
-send an initialized notification.
-
 ## OAuth
 
 For OAuth-protected MCP servers, use `OAuth.jl` to acquire a token and attach it

src/jsonrpc.jl

@@ -108,20 +108,18 @@ function jsonrpc_call(
         push!(header_pairs, normalize_pair("Mcp-Timeout-Ms", string(timeout_value)))
     end
     response = submit_jsonrpc_request(client, body; headers=header_pairs, timeout=timeout)
+    if String(method) == JSONRPC_METHOD_INITIALIZE
+        session_header = http_header_value(response.headers, "MCP-Session-Id")
+        if session_header !== nothing && !isempty(strip(String(session_header)))
+            client.session_id = String(session_header)
+        end
+    end
     notification && return nothing
     isempty(response.body) && throw(mcp_error(:jsonrpc_error, "JSON-RPC response from $(client.transport.url) was empty"))
     if is_event_stream_response(response)
         data = extract_streamed_jsonrpc_response(client, response, payload["id"])
     else
         data = parse_jsonrpc_response(response.body)
-        get(data, "id", nothing) == payload["id"] ||
-            throw(mcp_error(:jsonrpc_error, "JSON-RPC response did not match request $(payload["id"])"))
-    end
-    if method_str == JSONRPC_METHOD_INITIALIZE
-        session_header = http_header_value(response.headers, "MCP-Session-Id")
-        if session_header !== nothing && !isempty(strip(String(session_header)))
-            client.session_id = String(session_header)
-        end
     end
     return get(data, "result", nothing)
 end

test/runtests.jl

@@ -5,8 +5,6 @@ using OAuth
 using Sockets
 using ModelContextProtocol
 
-include("response_ids.jl")
-
 @testset "Authentication parameter whitespace" begin
     for whitespace in (" ", "\t", " \t "), quoted in (false, true)
         metadata = "https://example.com/meta"