String request ids are limited to letters, digits, "_" and "-" #603

String request ids are only accepted if they consist of letters, digits, _ and -. Anything else is refused as Invalid Request:

server = MCP::Server.new(name: "repro", version: "1.0.0", tools: [], capabilities: { tools: {} })

server.handle_json('{"jsonrpc":"2.0","id":"req.1","method":"tools/list"}')
# => {"jsonrpc":"2.0","id":null,"error":{"code":-32600,"message":"Invalid Request","data":"Request ID must match validation pattern, or be an integer or null"}}

server.handle_json('{"jsonrpc":"2.0","id":"req-1","method":"tools/list"}')
# => {"jsonrpc":"2.0","id":"req-1","result":{"tools":[]}}

The pattern comes from JsonRpcHandler::DEFAULT_ALLOWED_ID_CHARACTERS (/\A[a-zA-Z0-9_-]+\z/). Both JSON-RPC 2.0 and MCP allow any string here ("Requests MUST include a string or integer ID", Basic Protocol, Requests), so a client that uses ids like req.1, call:42 or a URN can't talk to a Ruby server. The error also drops the id, even though it was readable, so the client can't match the answer to its request.

JsonRpcHandler.handle takes an id_validation_pattern: keyword, but MCP::Server#handle and #handle_json don't pass one through, so a server can't loosen it without patching the SDK.

Is the restriction intentional, for example to keep odd characters out of logs? If so, an option on the server would already help. Otherwise accepting any string would match the spec.

Seen with 1.7.0; main at 9d12f51 has the same code.