@design-ai/cli 4.55.0 → 4.56.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "design-ai",
-  "version": "4.55.0",
+  "version": "4.56.0",
   "description": "Senior product designer for any AI coding agent. 20 skills, 17 commands, 4 review agents covering UI/UX, website improvement, design systems, motion, illustration, print, video, game UI, conversational, and spatial design. Korean market depth.",
   "author": {
     "name": "Sungjin Park",

package/CHANGELOG.md

@@ -2,11 +2,50 @@
 
 User-facing release notes for design-ai. Versions follow semver.
 
+## v4.56.0 — MCP Protocol Hardening and Published Client Evidence (2026-07)
+
+Hardened the local stdio MCP server that Claude Code, Codex, and other MCP clients use to call design-ai. This release turns malformed JSON-RPC envelopes, request ids, notifications, initialize params, and tool arguments into deterministic protocol errors before CLI execution, then refreshes evidence that the published npm MCP entrypoint and local Claude/Codex registrations work.
+
+### Added
+- MCP tool argument validation now rejects unsupported fields, wrong JSON types, non-integer integer fields, out-of-range values, and blank required strings before invoking CLI commands.
+- Public npm `design-ai-mcp` evidence now records initialize and tools/list protocol smoke from a clean one-shot `npm exec --package @design-ai/cli@4.55.0 -- design-ai-mcp` path.
+- Local Claude Code and Codex client evidence now records the clone-backed `design-ai` MCP server as configured and connected.
+
+### Changed
+- Website Improvement runbook helpers were split into clearer, smaller modules and named predicates while preserving the existing handoff JSON and Markdown contracts.
+- MCP subprocess tests now use a shared stdio response helper, making negative protocol scenarios easier to read and extend.
+- MCP setup docs now explain why one-shot public npm verification should run outside the source checkout.
+
+### Fixed
+- MCP initialize now rejects malformed `protocolVersion` values, including non-string and blank-only protocol versions.
+- MCP notifications now reject request ids across the whole `notifications/` namespace while preserving silent handling for valid id-less notifications.
+- MCP response-producing methods now require ids, and malformed JSON-RPC request ids, methods, params, and tool-call containers return deterministic JSON-RPC errors.
+
+### Verified
+- All 8 audits passed.
+- `npm run release:check`.
+- `npm run release:metadata`.
+- `npm run audit:strict`.
+- `git diff --check`.
+- Public npm MCP protocol smoke returned server version `4.55.0` and 10 tools before the release bump.
+- Main-branch GitHub Actions passed for `Design-AI audit` and `Deploy doc site` after the MCP client evidence refresh.
+
+### Versions
+- `package.json` + `.claude-plugin/plugin.json`: 4.55.0 → 4.56.0.
+- `vscode-extension/package.json`: remains 0.4.1.
+
+### What this enables
+- Claude Code and Codex users get stricter, more predictable MCP error behavior without changing the design-ai tool surface.
+- Maintainers can verify the published MCP entrypoint and local client registrations from concrete evidence before and after publishing.
+
 ## Unreleased — Agent Eval, Learning Signals, Skill Proposals, MCP Probes, Workflow Graphs, and Handoff Evidence
 
 Added deterministic route, prompt-plan, prompt-pack eval surfaces, a read-only learning signal registry with deterministic agent development backlog actions and structured readiness summaries, focused backlog readiness pass-through for local AI/agent handoffs with packed-tarball smoke coverage and release metadata guard coverage, preview-only skill evolution proposals, optional Website Console MCP probes with output-file smoke persistence and executable embedded follow-up commands, shared MCP probe output-file smoke assertions, release metadata guard coverage for shared MCP probe output-file smoke assertions, embedded MCP check probe next-step commands, executable embedded MCP check probe command smoke coverage, human-readable MCP check probe command guidance, packed/public smoke coverage for that human guidance, human report output-file persistence smoke coverage, embedded human report output commands, release metadata guard coverage for embedded human report output commands, MCP action plan JSON parity for embedded human report output commands, release metadata guard coverage for that action-plan parity, and packed/public smoke execution for action-plan emitted human report commands, structured Website Console MCP action plan JSON export with output-file persistence and embedded probe output-file commands, release metadata guard coverage for embedded MCP action plan probe output-file commands, next-action operator checklist output-file smoke persistence, portable Website Console workflow graph export, static Website Console graph rendering, browser-local Website Console handoff evidence tracking, CLI/bundle handoff evidence export, verified bundle evidence metadata, generated bundle contract verification with per-file diagnostics, repair guidance, repair preview/apply, repair report output-file persistence, repair report command guidance, executable repair guidance smoke coverage, shared repair guidance smoke helpers, shared repair report assertion helpers, release metadata guard coverage for shared repair guidance smoke helpers and shared repair report assertion helpers, public registry Website Console MCP probe smoke coverage, MCP probe action plan smoke coverage, shared Website Console site help topic example smoke assertions, release metadata guard coverage for shared Website Console site help topic example smoke assertions, release metadata guard coverage and packed-tarball smoke coverage for optional refresh-only agent backlog runbook selection semantics, post-commit release evidence for that refresh-only backlog smoke contract, full `release:check` evidence after the refresh-only backlog closeout, and packed-tarball evidence preservation smoke coverage for local AI/agent development drift review.
 
 ### Added
+- Added MCP tool argument validation, so Claude Code and Codex receive clear typed errors for malformed tool calls before `design-ai` invokes any CLI command.
+- Added packed-tarball smoke coverage for the standalone `design-ai-mcp` binary, covering both installed `node_modules/.bin/design-ai-mcp` and one-shot `npm exec --package <tarball> -- design-ai-mcp` setup paths.
+- Added public registry smoke coverage for `npm exec --package @design-ai/cli@<version> -- design-ai-mcp`, so post-publish verification checks the same MCP stdio entrypoint that users install from npm.
 - Improved Website Console revalidation gate action labels, so compact gate copy/export buttons identify their JSON artifact type directly.
 - Improved Website Console Source Bundle action labels, so Markdown and provenance JSON copy/export buttons identify their artifact type directly.
 - Added Website Console Source Bundle detail source copy action, so operators can copy the current runbook source marker directly from the provenance table.

package/README.ko.md

@@ -3,7 +3,7 @@
 [![Audit](https://img.shields.io/badge/audit-passing-brightgreen)](https://github.com/sungjin9288/design-ai/actions/workflows/audit.yml)
 [![Docs](https://img.shields.io/badge/docs-live-indigo)](https://sungjin9288.github.io/design-ai/ko/)
 [![Knowledge files](https://img.shields.io/badge/knowledge-92-blue)](knowledge/PRINCIPLES.md)
-[![Examples](https://img.shields.io/badge/examples-223-blue)](examples/README.md)
+[![Examples](https://img.shields.io/badge/examples-221-blue)](examples/README.md)
 [![Skills](https://img.shields.io/badge/skills-20-blue)](skills/README.md)
 
 > 🇰🇷 한국어 / [🇺🇸 English](https://github.com/sungjin9288/design-ai/blob/main/README.md)
@@ -12,14 +12,14 @@
 
 > **모델이 아니에요. 파인튜닝도 아니에요.** 디자인 전문 지식을 구조화한 코퍼스 + 에이전트가 바로 실행할 수 있는 지시문이에요. 범용 LLM을 이번 세션에서만큼은 시니어 디자이너로 바꿔주는 셈이에요.
 
-> **배포 상태, 2026-06-23 확인:** 로컬 `npm run release:check`는 통과했고 GitHub Pages 문서는 공개 URL에서 확인됐어요. public npm과 VS Code Marketplace 배포는 아직 확인되지 않았으므로 package publish가 끝나기 전까지는 Git clone/local install 경로를 사용하세요. 자세한 내용은 [`docs/external-status.md`](docs/external-status.md)를 확인하세요.
+> **배포 상태, 2026-06-30 확인:** 로컬 `npm run release:check`는 통과했고 GitHub Pages 문서는 공개 URL에서 확인됐으며, GitHub Release `v4.55.0`, npm `@design-ai/cli@4.55.0`, VS Code Marketplace `sungjin.design-ai-vscode` publish가 확인됐어요. 자세한 내용은 [`docs/external-status.md`](docs/external-status.md)를 확인하세요.
 
 ## 한눈에 보는 커버리지
 
 | 영역 | 지식 | 워크드 예제 | 스킬 |
 |---|---|---|---|
 | 디자인 토큰 (W3C DTCG, OKLCH) | ✓ | ✓ | `color-palette` |
-| 컴포넌트 (Ant + MUI + shadcn 합성) | ✓ | 72 specs | `component-spec-writer` |
+| 컴포넌트 (Ant + MUI + shadcn 합성) | ✓ | 210 component specs | `component-spec-writer` |
 | UX 패턴 (인증, 가격, 히어로, 폼 등) | ✓ | ✓ | `ux-audit`, `design-critique` |
 | 웹사이트 개선 컨트롤 타워 | ✓ | ✓ | `website-improvement` |
 | 한국어 i18n (한글, 결제, 앱스토어, 핀테크) | ✓ | ✓ | (전 영역 적용) |
@@ -34,7 +34,7 @@
 
 ## 설치 (Claude Code)
 
-### A. Git clone / local install (현재 추천)
+### A. Git clone / local install
 
 ```bash
 git clone https://github.com/sungjin9288/design-ai.git
@@ -42,9 +42,9 @@ cd design-ai
 ./install.sh
 ```
 
-### B. NPM (public publish 이후)
+### B. NPM
 
-`@design-ai/cli`가 publish되고 `npm run registry:smoke`가 통과한 뒤에만 이 경로를 사용하세요.
+public npm package 설치 경로예요.
 
 ```bash
 npx @design-ai/cli install
@@ -120,7 +120,7 @@ design-ai/
 │   ├── spatial/             # VR / AR / 패널 / 편안함
 │   └── i18n/                # 한국어 타이포그래피, 결제, 앱스토어 등
 │
-├── examples/                # 223개 워크드 예제 ("good"이 어떻게 생겼는지)
+├── examples/                # 221개 워크드 예제 ("good"이 어떻게 생겼는지)
 │
 ├── skills/                  # 20개 재사용 가능한 플레이북 (작업 중심)
 ├── agents/                  # 4개 서브 에이전트 (병렬 리뷰)

package/README.md

@@ -3,7 +3,7 @@
 [![Audit](https://img.shields.io/badge/audit-passing-brightgreen)](https://github.com/sungjin9288/design-ai/actions/workflows/audit.yml)
 [![Docs](https://img.shields.io/badge/docs-live-indigo)](https://sungjin9288.github.io/design-ai/)
 [![Knowledge files](https://img.shields.io/badge/knowledge-92-blue)](knowledge/PRINCIPLES.md)
-[![Examples](https://img.shields.io/badge/examples-223-blue)](examples/README.md)
+[![Examples](https://img.shields.io/badge/examples-221-blue)](examples/README.md)
 [![Skills](https://img.shields.io/badge/skills-20-blue)](skills/README.md)
 
 > 🇺🇸 English / [🇰🇷 한국어](https://github.com/sungjin9288/design-ai/blob/main/README.ko.md)
@@ -12,14 +12,14 @@ A model-agnostic design knowledge base + skill system. Drop it in front of any A
 
 > **Not a model. Not a fine-tune.** A structured corpus of design expertise + agent-ready instructions that turn a general-purpose LLM into an expert.
 
-> **Distribution status, checked 2026-06-23:** local `npm run release:check` passes and GitHub Pages docs are live. Public npm and VS Code Marketplace distribution are not currently confirmed, so use the Git clone/local install path until package publishing is completed. See [`docs/external-status.md`](docs/external-status.md).
+> **Distribution status, checked 2026-06-30:** local `npm run release:check` passes, GitHub Pages docs are live, GitHub Release `v4.55.0` is published, `@design-ai/cli@4.55.0` is public on npm with registry smoke coverage, and `sungjin.design-ai-vscode` is public on the VS Code Marketplace. See [`docs/external-status.md`](docs/external-status.md).
 
 ## Coverage at a glance
 
 | Domain | Knowledge | Worked examples | Skill |
 |---|---|---|---|
 | Design tokens (W3C DTCG, OKLCH) | ✓ | ✓ | `color-palette` |
-| Components (Ant + MUI + shadcn synthesis) | ✓ | 47 specs | `component-spec-writer` |
+| Components (Ant + MUI + shadcn synthesis) | ✓ | 210 component specs | `component-spec-writer` |
 | UX patterns (auth, pricing, hero, forms, etc.) | ✓ | ✓ | `ux-audit`, `design-critique` |
 | Website improvement control tower | ✓ | ✓ | `website-improvement` |
 | Korean i18n (Hangul, payments, app store, fintech) | ✓ | ✓ | (cross-cutting) |
@@ -34,7 +34,7 @@ A model-agnostic design knowledge base + skill system. Drop it in front of any A
 
 ## Install (Claude Code)
 
-### Option A: Git clone / local install (currently recommended)
+### Option A: Git clone / local install
 
 ```bash
 git clone https://github.com/sungjin9288/design-ai.git
@@ -42,9 +42,9 @@ cd design-ai
 ./install.sh
 ```
 
-### Option B: NPM (after public publish)
+### Option B: NPM
 
-Use this path only after `@design-ai/cli` is published and `npm run registry:smoke` passes.
+Use this path for the public npm package.
 
 ```bash
 npx @design-ai/cli install
@@ -57,7 +57,7 @@ npm install -g @design-ai/cli
 design-ai install
 ```
 
-### Option C: Homebrew (after release tap verification)
+### Option C: Homebrew tap
 
 ```bash
 brew tap sungjin9288/design-ai https://github.com/sungjin9288/design-ai.git
@@ -88,7 +88,7 @@ See [`docs/DISTRIBUTION.md`](docs/DISTRIBUTION.md) for the full distribution gui
 | **Cursor** | Open this dir; symlink or copy `AGENTS.md` to `.cursorrules`. [Walkthrough](docs/integrations/cursor-walkthrough.md). |
 | **Aider** | Pass `AGENTS.md` as system prompt. [Walkthrough](docs/integrations/aider-walkthrough.md). |
 | **Anthropic / OpenAI SDK** | Embed relevant skill `PLAYBOOK.md` files in your prompt. [Walkthrough](docs/integrations/sdk-walkthrough.md). |
-| **VS Code** | Use the local extension workspace for sidebar tree + quick-pick commands until Marketplace publish is complete. [Walkthrough](docs/integrations/vscode-walkthrough.md). |
+| **VS Code** | Install the public Marketplace extension for sidebar trees + quick-pick commands. [Walkthrough](docs/integrations/vscode-walkthrough.md). |
 | **Plain prompt** | Paste any `skills/*/PLAYBOOK.md` body — each is self-contained. |
 
 See [`docs/USING.md`](docs/USING.md) for per-agent setup details, or the linked walkthroughs for concrete example sessions.
@@ -125,7 +125,7 @@ design-ai/
 │   ├── spatial/             # VR / AR / panels / comfort
 │   └── i18n/                # Korean typography, payments, app store, ...
 │
-├── examples/                # 223 worked outputs (what "good" looks like)
+├── examples/                # 221 worked outputs (what "good" looks like)
 │
 ├── skills/                  # 20 reusable playbooks (task-focused)
 │   ├── design-system-builder/   illustration-designer/

package/cli/lib/mcp-server.mjs

@@ -10,6 +10,14 @@ import { DESIGN_AI_HOME, PACKAGE_ROOT } from "./paths.mjs";
 const PROTOCOL_VERSION = "2025-11-25";
 const MAX_TOOL_OUTPUT_BYTES = 220_000;
 const DESIGN_AI_BIN = path.join(PACKAGE_ROOT, "cli", "bin", "design-ai.mjs");
+const MCP_RESPONSE_METHODS = new Set([
+  "initialize",
+  "ping",
+  "tools/list",
+  "tools/call",
+  "resources/list",
+  "prompts/list",
+]);
 
 function optionalString(description = "") {
   return { type: "string", description };
@@ -196,6 +204,51 @@ function assertString(value, name) {
   return value;
 }
 
+function assertMcpInputValue(name, value, schema) {
+  if (schema.type === "string") {
+    if (typeof value !== "string") throw new Error(`${name} must be a string`);
+    if (schema.minLength && value.trim() === "") {
+      throw new Error(`${name} must be a non-empty string`);
+    }
+    if (schema.minLength && value.length < schema.minLength) {
+      throw new Error(`${name} must be at least ${schema.minLength} characters`);
+    }
+    return;
+  }
+
+  if (schema.type === "boolean") {
+    if (typeof value !== "boolean") throw new Error(`${name} must be a boolean`);
+    return;
+  }
+
+  if (schema.type === "integer") {
+    if (!Number.isInteger(value)) throw new Error(`${name} must be an integer`);
+    if (schema.minimum !== undefined && value < schema.minimum) {
+      throw new Error(`${name} must be at least ${schema.minimum}`);
+    }
+    if (schema.maximum !== undefined && value > schema.maximum) {
+      throw new Error(`${name} must be at most ${schema.maximum}`);
+    }
+  }
+}
+
+function assertMcpToolInput(tool, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error(`${tool.name} arguments must be an object`);
+  }
+
+  const properties = tool.inputSchema.properties || {};
+  for (const name of tool.inputSchema.required || []) {
+    if (!Object.hasOwn(input, name)) throw new Error(`${tool.name}.${name} is required`);
+  }
+
+  for (const [name, value] of Object.entries(input)) {
+    const schema = properties[name];
+    if (!schema) throw new Error(`Unknown argument for ${tool.name}: ${name}`);
+    assertMcpInputValue(`${tool.name}.${name}`, value, schema);
+  }
+}
+
 function maybePush(args, flag, value) {
   if (value !== undefined && value !== null && value !== "") args.push(flag, String(value));
 }
@@ -328,6 +381,9 @@ export function runDesignAiCli(args, { stdin = "" } = {}) {
 }
 
 export async function callMcpTool(name, input = {}, runCli = runDesignAiCli) {
+  const tool = MCP_TOOLS.find((item) => item.name === name);
+  if (tool) assertMcpToolInput(tool, input || {});
+
   const invocation = buildCliInvocation(name, input || {});
   const result = await runCli(invocation.args, { stdin: invocation.stdin });
   const text = [
@@ -349,14 +405,131 @@ function errorResponse(id, code, message) {
   return { jsonrpc: "2.0", id: id ?? null, error: { code, message } };
 }
 
+function chooseProtocolVersion(requestedVersion) {
+  return requestedVersion === PROTOCOL_VERSION ? requestedVersion : PROTOCOL_VERSION;
+}
+
+function isObjectRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateMcpRequestEnvelope(message) {
+  if (!isObjectRecord(message)) {
+    return "Invalid MCP request: request must be an object";
+  }
+  if (message.jsonrpc !== "2.0") {
+    return 'Invalid MCP request: jsonrpc must be "2.0"';
+  }
+  if (hasRequestId(message) && !isValidMcpRequestId(message.id)) {
+    return "Invalid MCP request: id must be a string, number, or null";
+  }
+  return "";
+}
+
+function validateMcpRequestMethod(message) {
+  if (!Object.hasOwn(message, "method")) {
+    return "Invalid MCP request: missing method";
+  }
+  if (typeof message.method !== "string" || message.method.trim() === "") {
+    return "Invalid MCP request: method must be a non-empty string";
+  }
+  return "";
+}
+
+function isMcpNotificationMethod(method) {
+  return typeof method === "string" && method.startsWith("notifications/");
+}
+
+function validateMcpNotificationRequest(message) {
+  if (isMcpNotificationMethod(message.method) && hasRequestId(message)) {
+    return `Invalid MCP request: ${message.method} must not include id`;
+  }
+  return "";
+}
+
+function validateMcpRequestIdRequirement(message) {
+  if (MCP_RESPONSE_METHODS.has(message.method) && !hasRequestId(message)) {
+    return `Invalid MCP request: ${message.method} must include id`;
+  }
+  return "";
+}
+
+function validateOptionalObjectParams(method, params) {
+  if (params === undefined || isObjectRecord(params)) return "";
+  return `${method} params must be an object when provided`;
+}
+
+function validateToolCallParams(params) {
+  if (!isObjectRecord(params)) {
+    return "tools/call params must be an object";
+  }
+  if (typeof params.name !== "string" || params.name.trim() === "") {
+    return "tools/call params.name must be a non-empty string";
+  }
+  if (Object.hasOwn(params, "arguments") && params.arguments !== undefined && !isObjectRecord(params.arguments)) {
+    return "tools/call params.arguments must be an object when provided";
+  }
+  return "";
+}
+
+function validateInitializeParams(params) {
+  if (!isObjectRecord(params)) {
+    return "initialize params must be an object";
+  }
+  if (Object.hasOwn(params, "protocolVersion") && typeof params.protocolVersion !== "string") {
+    return "initialize params.protocolVersion must be a string";
+  }
+  if (typeof params.protocolVersion === "string" && params.protocolVersion.trim() === "") {
+    return "initialize params.protocolVersion must be a non-empty string";
+  }
+  return "";
+}
+
+function hasRequestId(message) {
+  return isObjectRecord(message) && Object.hasOwn(message, "id");
+}
+
+function isValidMcpRequestId(id) {
+  return id === null || typeof id === "string" || (typeof id === "number" && Number.isFinite(id));
+}
+
+function responseIdForMessage(message) {
+  if (!hasRequestId(message)) return undefined;
+  return isValidMcpRequestId(message.id) ? message.id : undefined;
+}
+
+function isInvalidRequestResponse(response) {
+  return response?.error?.code === -32600;
+}
+
+function shouldWriteMcpResponse(message, response) {
+  if (!response) return false;
+  return hasRequestId(message) || isInvalidRequestResponse(response);
+}
+
 export async function handleMcpRequest(message, { runCli = runDesignAiCli } = {}) {
-  const { id, method, params = {} } = message || {};
+  const id = responseIdForMessage(message);
+  const envelopeError = validateMcpRequestEnvelope(message);
+  if (envelopeError) return errorResponse(id, -32600, envelopeError);
+
+  const methodError = validateMcpRequestMethod(message);
+  if (methodError) return errorResponse(id, -32600, methodError);
+
+  const notificationError = validateMcpNotificationRequest(message);
+  if (notificationError) return errorResponse(id, -32600, notificationError);
+
+  const requestIdError = validateMcpRequestIdRequirement(message);
+  if (requestIdError) return errorResponse(id, -32600, requestIdError);
 
-  if (!method) return errorResponse(id, -32600, "Invalid MCP request: missing method");
+  const { method, params } = message;
 
   if (method === "initialize") {
+    const initializeParams = params === undefined ? {} : params;
+    const paramsError = validateInitializeParams(initializeParams);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
+
     return successResponse(id, {
-      protocolVersion: params.protocolVersion || PROTOCOL_VERSION,
+      protocolVersion: chooseProtocolVersion(initializeParams.protocolVersion),
       capabilities: {
         tools: { listChanged: false },
       },
@@ -368,19 +541,36 @@ export async function handleMcpRequest(message, { runCli = runDesignAiCli } = {}
     });
   }
 
-  if (method === "notifications/initialized") return null;
-  if (method === "ping") return successResponse(id, {});
+  if (isMcpNotificationMethod(method)) return null;
+  if (method === "ping") {
+    const paramsError = validateOptionalObjectParams(method, params);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
+    return successResponse(id, {});
+  }
 
   if (method === "tools/list") {
+    const paramsError = validateOptionalObjectParams(method, params);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
     return successResponse(id, { tools: MCP_TOOLS });
   }
 
   if (method === "tools/call") {
+    const paramsError = validateToolCallParams(params);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
+
     const name = params.name;
     const tool = MCP_TOOLS.find((item) => item.name === name);
     if (!tool) return errorResponse(id, -32602, `Unknown tool: ${name}`);
+
+    const toolArguments = params.arguments === undefined ? {} : params.arguments;
     try {
-      const result = await callMcpTool(name, params.arguments || {}, runCli);
+      assertMcpToolInput(tool, toolArguments);
+    } catch (validationError) {
+      return errorResponse(id, -32602, validationError.message || String(validationError));
+    }
+
+    try {
+      const result = await callMcpTool(name, toolArguments, runCli);
       return successResponse(id, result);
     } catch (error) {
       return successResponse(id, {
@@ -390,8 +580,16 @@ export async function handleMcpRequest(message, { runCli = runDesignAiCli } = {}
     }
   }
 
-  if (method === "resources/list") return successResponse(id, { resources: [] });
-  if (method === "prompts/list") return successResponse(id, { prompts: [] });
+  if (method === "resources/list") {
+    const paramsError = validateOptionalObjectParams(method, params);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
+    return successResponse(id, { resources: [] });
+  }
+  if (method === "prompts/list") {
+    const paramsError = validateOptionalObjectParams(method, params);
+    if (paramsError) return errorResponse(id, -32602, paramsError);
+    return successResponse(id, { prompts: [] });
+  }
 
   return errorResponse(id, -32601, `Method not found: ${method}`);
 }
@@ -411,11 +609,11 @@ export function startMcpStdioServer({ input = process.stdin, output = process.st
 
     try {
       const response = await handleMcpRequest(message);
-      if (response && message.id !== undefined) {
+      if (shouldWriteMcpResponse(message, response)) {
         output.write(`${JSON.stringify(response)}\n`);
       }
     } catch (requestError) {
-      const id = message && message.id !== undefined ? message.id : null;
+      const id = responseIdForMessage(message) ?? null;
       output.write(`${JSON.stringify(errorResponse(id, -32603, requestError.message || String(requestError)))}\n`);
     }
   });