MCP-488 reproduction: /mcp (nullable arrays), /mcp-control (object wrapper). No authentication.