[Server][Protocol] SEP-2260: Scope server-to-client requests to in-flight client requests #343

Implements SEP-2260 for the MCP Spec 2026-07-28 release.

Tracked by umbrella #334.

Spec summary

Servers can only send requests to clients (sampling, elicitation, roots/list) as a child of an in-flight client request. Unsolicited server-to-client requests are removed in preparation for stateless transports.

PHP SDK changes

• src/Server/Protocol.php — Fiber-based server-initiated requests must validate they are running inside a client request's Fiber context. Block/error on unsolicited dispatch.
• src/Schema/Request/CreateSamplingMessageRequest.php, ElicitRequest.php, ListRootsRequest.php — require/encode the originating client request ID in _meta (verify final spec field name).
• src/Client/Protocol.php — client must reject server-initiated requests with no associated client request ID.
• Update Fiber suspension docs in CLAUDE.md and docs/server-client-communication.md.

Notifications remain unaffected (this is requests-only).

Breaking change. Touches public Fiber suspension behavior used by tool authors.

Related

• SEP-2575 / SEP-2567 / SEP-2322 (umbrella [2026-07-28] Stateless Core overhaul #334)
• SEP-2663 Tasks (umbrella [2026-07-28] Extensions framework + Tasks + MCP Apps #335) — task progress relies on this scoping