fix(mcp): consume self-cancelling JSON-RPC batches

[fahreddinozcan]

Summary

• detect request/cancellation pairs contained in the same JSON-RPC batch before SDK dispatch
• consume both elements so cancelled tools never start and the SDK transport has no orphaned request ID
• return HTTP 202 with an empty body when the entire batch is cancelled
• preserve responses for uncancelled requests in mixed batches and preserve cancellation notifications targeting IDs outside the batch

Root cause

@modelcontextprotocol/server@2.0.0 correctly suppresses a response after notifications/cancelled, but its legacy stateless HTTP transport closes a batch stream only after its response map contains every request ID registered for that stream. Cancellation does not remove or settle the mapped ID, so a self-cancelling batch stays open indefinitely.

The application-side filter preserves MCP cancellation semantics: cancelled requests produce no response, do no tool/backend work, and do not enter the SDK transport response accounting.

This closes Cobalt finding PT38659_18 (CWE-400).

Linear: CTX7-2472

Verification

• SDK-only reproducer: ordinary request closed with 100 bytes; self-cancelling batch remained open with zero bytes after 500 ms
• patched Context7 localhost retest: time=0.008391s http=202 bytes=0 exit=0
• pnpm --dir packages/mcp typecheck
• pnpm --dir packages/mcp lint:check
• pnpm --dir packages/mcp exec vitest run --exclude "dist/**" (82 tests)
• Prettier and git diff --check

[linear-code]

CTX7-2472

[context7]

Docs7 preview for context7.com

Status	Commit	Updated (UTC)
✅ Ready (visit preview)	2b8f727	2026-08-25 09:18