fix(mcp): keep stdio server alive on invalid input

[Sonai124]

Summary

• raise the MCP Python SDK floor to the release that fixed malformed-request session crashes, while excluding the incompatible v2 API
• add an end-to-end STDIO regression test for malformed requests, invalid IDs, oversized input, and post-error recovery
• run the markitdown-mcp tests in the repository CI workflow

Root cause

markitdown-mcp constrained mcp to 1.8.x. In that SDK line, a syntactically valid JSON-RPC request with invalid MCP parameters could terminate the session receive loop. The process then stopped answering, so later oversized-input, cancellation, and recovery probes encountered a closed or non-responsive STDIO connection.

The malformed-request denial-of-service path was fixed upstream in MCP Python SDK 1.9.4.

Fixes #2146

Testing

• hatch test in packages/markitdown-mcp (1 passed)
• regression test with minimum supported mcp==1.9.4 (1 passed)
• regression test with current mcp==1.28.1 (1 passed)
• pre-commit run --all-files
• mypy on markitdown_mcp and its tests
• broader MarkItDown suite on Python 3.13: 301 passed, 34 skipped (one pre-existing POSIX-only URI assertion deselected on Windows)

[Sonai124]

@microsoft-github-policy-service agree