Unknown methods return -32601 Method not found

When a client sends a request for an unrecognized method, the JSON-RPC 2.0 spec requires a -32601 Method not found error response. A custom server without a fallback case silently drops the request — the client hangs indefinitely waiting for a response that never arrives. This is CWE-703: the unhandled case is a real input condition in production (a newer client calling a method the server hasn't implemented yet). Returning the wrong error code, like -32603 Internal error, misleads the client into treating a known gap as an unexpected server failure.

Add a default case to every message router that returns -32601. The MCP SDK handles this automatically — only custom implementations need explicit treatment.

// src/transport/router.ts
function handleRequest(request: JsonRpcRequest) {
  switch (request.method) {
    case 'initialize': return handleInitialize(request)
    case 'tools/list':  return handleToolsList(request)
    case 'tools/call':  return handleToolsCall(request)
    default:
      return {
        jsonrpc: '2.0',
        id: request.id,
        error: { code: -32601, message: `Method not found: ${request.method}` }
      }
  }
}