Several request handlers accept `params` objects with missing required fields

[cclabadmin]

Describe the bug

Multiple MCP request handlers accept params objects in which fields required by the 2025-11-25 schema are absent. A present object such as "params":{} is decoded into a non-nil Go params value, while omitted fields are represented by their Go zero values, such as "" for string fields or nil for pointer fields.

The request then proceeds unless the individual handler performs its own field-level validation.

The schema marks the following fields as required in the cases covered below:

InitializeRequestParams:   required = [capabilities, clientInfo, protocolVersion]
CompleteRequestParams:     required = [argument, ref]
SetLevelRequestParams:     required = [level]
SubscribeRequestParams:    required = [uri]
UnsubscribeRequestParams:  required = [uri]

Environment tested:

• Stable release: v1.6.1 (d454bba)
• Prerelease: v1.7.0-pre.2 (b426fbf)
• Server used: conformance/everything-server
• Transports: stdio, stateful/stateless HTTP

To Reproduce

1. Start the Go SDK server and initialize a session using protocol version 2025-11-25.
2. Send requests with required fields omitted:

// Missing required `argument` field.
{"jsonrpc":"2.0","id":1001,"method":"completion/complete","params":{"ref":{"type":"ref/prompt","name":"test_prompt_with_arguments"}}}

// Missing required `uri` field.
{"jsonrpc":"2.0","id":1001,"method":"resources/subscribe","params":{}}

3. Observe that the server returns a successful result in both cases.

Expected behavior

Requests with a required field missing from params should be rejected with -32602 Invalid params. For example, an omitted argument should not be processed as its zero value, and an omitted uri should not be processed as "".

Observed behavior

Method	Missing field	Decoded value	Server result
initialize	capabilities	nil	Success
initialize	clientInfo	nil	Success
initialize	protocolVersion	""	Success; a server-supported version is selected
completion/complete	argument	zero-value argument struct	Success
completion/complete	ref	nil	Success
logging/setLevel	level	""	Success
resources/subscribe	uri	""	Success; a subscription for "" is recorded
resources/unsubscribe	uri	""	Success

Additional context

// mcp/server.go
func (ss *ServerSession) initialize(ctx context.Context, params *InitializeParams) (*InitializeResult, error) {
    if params == nil {
        return nil, fmt.Errorf("%w: \"params\" must be be provided", jsonrpc2.ErrInvalidParams)
    }

For methods that require params, the request dispatcher rejects the request when params itself is absent or null. However, a present object such as "params":{} decodes into a non-nil params value, and the dispatcher does not validate whether fields marked as required by the schema were present.

The omitted fields are therefore passed to handlers as their Go zero values. The affected handlers do not consistently reject those values before processing the request.

This is related to #1037, which addressed the same missing-required-field pattern for subscriptions/listen.notifications by changing the field to a pointer and adding an explicit nil check.

This issue covers the remaining 2025-11-25 request fields listed above. For logging/setLevel, it concerns only omission of the required level field; validation of non-empty values outside the LoggingLevel enum is a separate issue.