Fold only the canonical decimal form in coerce_request_id

coerce_request_id() coerced any string int() accepts back to an integer,
so non-canonical numeric strings that are distinct ids on the JSON-RPC wire
-- "007", "+7", "1_000", " 7 ", non-ASCII digit strings -- collapsed onto
the same integer correlation key as the value they happen to parse to. That
conflates ids the peer sent as genuinely different values in the shared
_pending / _in_flight / progress-token correlation domain.

Fold only when the string equals str(int(s)), the canonical form a JSON
serializer emits for an int, preserving the intended "peer stringified an
int id" correlation while leaving every other string a distinct id.

Author: 2sumtech

src/mcp/shared/dispatcher.py

@@ -58,12 +58,20 @@ def coerce_request_id(request_id: RequestId) -> RequestId:
 
     This is the collision/correlation domain dispatchers share: "7" and 7 are one
     id for correlation purposes, even where the wire carries the verbatim value.
+
+    Only the canonical decimal form a JSON serializer emits for an int (``str(n)``)
+    folds. Non-canonical numeric strings — ``"007"``, ``"+7"``, ``"1_000"``,
+    ``" 7 "``, non-ASCII digit strings — are distinct ids on the JSON-RPC wire, not
+    the same id as the integer they happen to parse to, so they pass through
+    unchanged rather than collapsing wire-distinct ids into one correlation key.
     """
     if isinstance(request_id, str):
         try:
-            return int(request_id)
+            value = int(request_id)
         except ValueError:
-            pass
+            return request_id
+        if str(value) == request_id:
+            return value
     return request_id
 
 

tests/shared/test_jsonrpc_dispatcher.py

@@ -2011,6 +2011,26 @@ def test_coerce_request_id_passes_through_non_numeric_string_and_int():
     assert coerce_request_id(42) == 42
 
 
+def test_coerce_request_id_folds_only_the_canonical_decimal_form():
+    """Only a string equal to `str(int)` folds; non-canonical numeric strings stay distinct wire ids.
+
+    "007", "+7", "1_000", " 7 " and non-ASCII digit strings are distinct JSON-RPC
+    ids, not the same id as the integer, so folding them would let the correlation
+    domain conflate ids the peer sent as genuinely different values.
+    """
+    # Canonical decimal (including negative) still folds, preserving the intended
+    # "peer stringified an int id" correlation.
+    assert coerce_request_id("7") == 7
+    assert coerce_request_id("-3") == -3
+    assert coerce_request_id("0") == 0
+    # Non-canonical numeric strings are left as-is: they are not str(int) of any int.
+    for wire_id in ("007", "+7", " 7 ", "1_000", "\t42\n", "٧", "7.0"):
+        assert coerce_request_id(wire_id) == wire_id, wire_id
+    # A non-canonical numeric string does not collide with the integer it parses to.
+    assert coerce_request_id("1_000") != coerce_request_id(1000)
+    assert coerce_request_id("+7") != coerce_request_id(7)
+
+
 @pytest.mark.anyio
 async def test_jsonrpc_error_response_with_null_id_is_dropped():
     """Parse-error responses (id=null) have no waiter; they're dropped and the read loop stays healthy."""