Keep the outer request's input_responses out of nested resource reads

ctx.read_resource passed the handler's own Context into the nested resource
template, so on the outer request's retry the template saw input_responses
and request_state addressed to the outer handler — with a colliding key a
write-once template would silently consume an answer to a different
question. The continuation payload belongs to the wire request's target
dispatch only, so nested invocations now use Context._nested_invocation():
same request infrastructure, no input_responses/request_state — a nested
template always behaves as round one, making ctx.read_resource's
raise-on-input-required contract deterministic across rounds. The explicit
forwarding path (MCPServer.read_resource(uri, context)) is unchanged: there
the caller deliberately re-addresses the payload.

Author: maxisbey

src/mcp/server/mcpserver/context.py

@@ -89,6 +89,16 @@ def request_context(self) -> ServerRequestContext[LifespanContextT, RequestT]:
             raise ValueError("Context is not available outside of a request")
         return self._request_context
 
+    def _nested_invocation(self) -> Context[LifespanContextT, RequestT]:
+        """A Context for invoking another handler's function from inside this request.
+
+        Shares the request infrastructure (session, request metadata, lifespan) but
+        carries no `input_responses`/`request_state`: those are addressed to the wire
+        request's own target — their keys are ones that handler minted — so a nested
+        invocation always starts on round one.
+        """
+        return Context(request_context=self._request_context, mcp_server=self._mcp_server)
+
     async def report_progress(self, progress: float, total: float | None = None, message: str | None = None) -> None:
         """Report progress for the current operation.
 
@@ -104,11 +114,14 @@ async def read_resource(self, uri: str | AnyUrl) -> Iterable[ReadResourceContent
 
         This is a content reader: an `InputRequiredResult` returned by a
         resource template function (the 2026-07-28 multi-round-trip flow)
-        raises here. A handler that wants to receive and forward one as its
-        own result calls `MCPServer.read_resource(uri, context)` instead —
-        but not from a tool whose dependencies elicit via `Resolve(...)`:
-        the resolver owns that tool's `request_state` channel, and a
-        forwarded result's state would clobber it.
+        raises here, and the nested template never sees this request's
+        `input_responses`/`request_state` — those answer the outer handler's
+        own questions, so the template always behaves as round one. A handler
+        that wants to receive and forward an `InputRequiredResult` as its own
+        result calls `MCPServer.read_resource(uri, context)` instead — but
+        not from a tool whose dependencies elicit via `Resolve(...)`: the
+        resolver owns that tool's `request_state` channel, and a forwarded
+        result's state would clobber it.
 
         Args:
             uri: Resource URI to read
@@ -122,7 +135,7 @@ async def read_resource(self, uri: str | AnyUrl) -> Iterable[ReadResourceContent
             RuntimeError: If the resource returned an `InputRequiredResult`.
         """
         assert self._mcp_server is not None, "Context is not available outside of a request"
-        result = await self._mcp_server.read_resource(uri, self)
+        result = await self._mcp_server.read_resource(uri, self._nested_invocation())
         if isinstance(result, InputRequiredResult):
             raise RuntimeError(
                 "Resource returned InputRequiredResult; ctx.read_resource() only returns "

tests/server/mcpserver/test_server.py

@@ -27,6 +27,7 @@
     Icon,
     ImageContent,
     InputRequiredResult,
+    InputResponses,
     ListPromptsResult,
     ListRootsRequest,
     Prompt,
@@ -2105,6 +2106,41 @@ async def ask(topic: str, ctx: Context) -> str | InputRequiredResult:
     assert result is sentinel
 
 
+async def test_context_read_resource_keeps_outer_input_responses_from_the_nested_template():
+    """ctx.read_resource never participates in the multi-round-trip flow, so the nested
+    template must not see the outer request's input_responses/request_state — a colliding
+    key would otherwise consume an answer meant for the outer handler's own question."""
+    mcp = MCPServer()
+    seen_responses: list[InputResponses | None] = []
+    seen_state: list[str | None] = []
+
+    @mcp.resource("ask://{topic}")
+    async def ask(topic: str, ctx: Context) -> str:
+        seen_responses.append(ctx.input_responses)
+        seen_state.append(ctx.request_state)
+        return f"{topic} content"
+
+    @mcp.tool()
+    async def outer(ctx: Context) -> str:
+        contents = list(await ctx.read_resource("ask://databases"))
+        assert isinstance(contents[0].content, str)
+        return contents[0].content
+
+    with anyio.fail_after(5):
+        async with Client(mcp, mode="2026-07-28") as client:
+            result = await client.session.call_tool(
+                "outer",
+                input_responses={"who": ElicitResult(action="accept", content={"name": "Alice"})},
+                request_state="outer-state",
+            )
+    assert isinstance(result, CallToolResult)
+    block = result.content[0]
+    assert isinstance(block, TextContent)
+    assert block.text == "databases content"
+    assert seen_responses == [None]
+    assert seen_state == [None]
+
+
 async def test_prompt_raising_mcp_error_surfaces_code_and_data_to_client():
     """A handler-raised MCPError keeps its code and data through the prompt pipeline —
     the same parity tools/call has, needed for self-service capability rejection."""