SEP-2260: Require Server requests to be associated with a Client request

[mikekistler]

Feature Request

Implement SDK support for SEP-2260: Require Server requests to be associated with a Client request.

Summary

SEP-2260 mandates that server-to-client requests (roots/list, sampling/createMessage, elicitation/create) MUST only be sent within the scope of an originating client-to-server request. Standalone server-initiated requests of these types are prohibited. ping is exempted.

Current SDK Behavior

The C# SDK exposes McpServer.RequestRootsAsync(), McpServer.ElicitAsync(), and sampling methods as public APIs that can be called from anywhere — not just within a request handler. There is no guard ensuring these are invoked only in the context of a client-initiated request.

SDK Changes Needed

• Add a runtime check or warning when RequestRootsAsync, ElicitAsync, or CreateMessageAsync are called outside a client request scope
• Consider restricting the API surface so these methods are only accessible from within request handlers (e.g. via RequestContext)
• Update documentation to reflect the constraint