Bump the nuget group with 14 updates by dependabot[bot] · Pull Request #14 · nccurry/mtg-mcp

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #1796 by @saicharanpardhu (co-authored by @Copilot @jeffhandley)
Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #1805 by @latent-9

Test Improvements

Fix duplicated word in test comment #1809 by @latent-9

Repository Infrastructure Updates

Enable package validation for the MCP extension packages #1793 by @jeffhandley (co-authored by @Copilot)
Add a release-manager agent that orchestrates the release skills #1794 by @jeffhandley (co-authored by @Copilot)
Bump Anthropic from 12.39.0 to 12.40.0 #1808
Bump @hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #1812
Fix dead relative link to versioning docs in bump-version skill #1807 by @latent-9

Acknowledgements

@latent-9 made their first contribution in #1807
@saicharanpardhu made their first contribution in #1796
@saicharanpardhu submitted issue #1777 (resolved by #1796)
@jeffhandley @tarekgh @halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

Keep AutoDetect channel open after provisional SSE failure #1768 by @PranavSenthilnathan
Preserve HTTP status codes across target frameworks #1767 by @PranavSenthilnathan
Fall back to initialize when server/discover fails at the HTTP layer #1766 by @rbstp
Add public subscriptions/listen server handler (SEP-2575) #1775 by @tarekgh

Documentation Updates

Add README for the InMemoryTransport sample #1769 by @AkbarDizaji
Add Application Insights telemetry example #1778 by @lntutor
Clarify client handling of embedded binary tool resources #1762 by @luisangelrod

Test Improvements

Speed up CLI argument escaping tests #1773 by @PranavSenthilnathan

Repository Infrastructure Updates

Clarify AI disclosure format with a > [!NOTE] alert example #1771 by @PranavSenthilnathan (co-authored by @Copilot)
Bump the npm_and_yarn group across 1 directory with 6 updates #1787
Avoid reading Configuration in Directory.Build.props #1776 by @lntutor
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #1784

Acknowledgements

@AkbarDizaji made their first contribution in #1769
@luisangelrod made their first contribution in #1762
@rbstp submitted issue #1765 (resolved by #1766)
@TomasHubelbauer submitted issue #1026 (resolved by #1778)
@Youssef1313 submitted issue #995 (resolved by #1766)
@eng-marani submitted issue #1261 (resolved by #1762)
@jeffhandley @tarekgh @halter73 @PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Default to stateless HTTP and discovery-first negotiation #1610
- HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
- Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
- Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
Deprecate Roots, Sampling, and Logging APIs #1651
- The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
- Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
Move Tasks into ModelContextProtocol.Extensions.Tasks #1693
- The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
- Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
Strengthen OAuth callback and issuer validation #1605
- AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
- OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
Emit non-object structured tool results directly #1568
- Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
- Update clients to read the value according to the advertised output schema rather than assuming a result property.
Require Tool.inputSchema during deserialization #1600
- Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
- Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
Require explicit PKCE S256 support in OAuth metadata #1700
- OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
- Update the authorization server metadata to declare PKCE S256 support.
Send application_type during dynamic client registration #1613
- Dynamic client registration requests now include an inferred application_type.
- Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
Propagate underlying SSE connection exceptions #1432
- Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
- Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
Fail OAuth step-up when a challenge makes no progress #1591
- A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
- Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

Add InheritEnvironmentVariables to StdioClientTransportOptions #1563 by @halter73
Stop logging stdio transport environment variables #1538 by @halter73 (co-authored by @Copilot)
Implement SEP-2243 HTTP header standardization #1553 by @mikekistler (co-authored by @tarekgh @Copilot)
Append offline_access to authorization scope when advertised (SEP-2207) #1479 by @stephentoub (co-authored by @Copilot)
Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #1558 by @jayaraman-venkatesan
Add APIs for pre-populating the McpClient tool cache #1590 by @tarekgh
Add ScopeSelectorDelegate to OAuth options #1596 by @halllo
Validate the authenticated user on Streamable HTTP session deletion #1604 by @halter73
... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752
- Aligns with protocol adjustment #3002.
- DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
- On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
Validate OAuth authorization state #1726
- Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
Fix SSE session transport shutdown behavior #1432
- Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

Fix SSE session transport shutdown behavior #1432 by @xue-cai (co-authored by @Copilot)
Validate OAuth authorization state #1726 by @halter73 (co-authored by @Copilot)
Add configurable Tasks execution modes and complete conformance support #1741 by @PranavSenthilnathan (co-authored by @Copilot)
Gate 2026-07-28 result fields by negotiated protocol version #1753 by @tarekgh
Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752 by @pcarleton (co-authored by @tarekgh @Copilot)
Reauthorize tools changed by call-tool filters #1737 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

Refine 2.0.0 concept documentation #1742 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Resolve test-server paths deterministically #1735 by @PranavSenthilnathan (co-authored by @Copilot)
Add MCP Apps NativeAOT coverage #1711 by @lntutor
Add MCP Apps _meta.ui serialization round-trip tests #1698 by @yayayouyou

Repository Infrastructure Updates

Bump actions/setup-node from 6.4.0 to 7.0.0 #1717
Bump coverlet.collector from 10.0.0 to 10.0.1 #1582
Bump qs from 6.14.2 to 6.15.2 #1597
Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #1716
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #1569
Bump actions/checkout from 6 to 7 #1665
Rename MCPEXP002 extensibility constants #1739 by @arimu1
Bump the testing-frameworks group #1746
Bump the serilog-testing group #1748
Bump actions/checkout from 7.0.0 to 7.0.1 #1745
Bump Anthropic from 12.17.0 to 12.39.0 #1750
Bump OpenTelemetry and five other dependencies #1747
... (truncated)

2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

Remove the preview task-scope helper #1722
- McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
- There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.
Harden OAuth issuer validation #1605
- AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
- Migrate to AuthorizationCallbackHandler and return AuthorizationResult.
Require advertised PKCE S256 support #1700
- Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
- Correct the authorization-server metadata or use a compliant discovery document.
Send Dynamic Client Registration application types #1613
- Unset ApplicationType now sends an inferred application_type instead of omitting it.
- Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

Require advertised PKCE S256 support #1700 by @PranavSenthilnathan (co-authored by @Copilot)
Make authorization-provider token caches thread-safe #1708 by @tarekgh
Send application_type in Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)
Preserve the original AutoDetect probe status code #1530 by @MukundaKatta
Return JSON-RPC parse errors for over-nested stdio requests #1629 by @adityasingh2400
Implement RFC 9207 issuer validation in ClientOAuthProvider #1605 by @mikekistler (co-authored by @halter73 @Copilot)
Reject mismatched initialize protocol versions #1724 by @halter73 (co-authored by @Copilot)
Fix OAuth client-ID initialization on cold start #1705 by @halter73 (co-authored by @Copilot)
Fix HTTP task-filter composition #1722 by @PranavSenthilnathan (co-authored by @Copilot)
Add initial Tasks extension conformance coverage #1734 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

Publish a side-by-side, multi-version documentation site with selectable release/1.x (v1.4.1) and main (v2 preview) content #1727 by @jeffhandley (co-authored by @Copilot)
Add Docker-based MCP server deployment guidance #1423 by @john-mckillip (co-authored by @Copilot)
Improve v2 conceptual documentation clarity and consistency #1728 by @gewarren
Improve v1 documentation clarity and consistency, and versioning updates #1729 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Expand npm conformance coverage #1725 by @halter73 (co-authored by @Copilot)
Extend the in-memory server/discover probe timeout to prevent flaky Windows Debug CI hangs #1702 by @PranavSenthilnathan (co-authored by @halter73 @Copilot)
... (truncated)

2.0.0-preview.3

This preview reorganizes the Tasks feature into its own ModelContextProtocol.Extensions.Tasks package, keeping ModelContextProtocol.Core focused on the base protocol while a new generic request-handler and alternate-result surface lets the Tasks package layer on top. It also delivers correctness fixes to the draft 2026-07-28 protocol -- per-request client capabilities, negotiation boundaries, and the resultType discriminator -- plus Streamable HTTP client improvements (an empty-JSON-response fix and a new standalone GET-stream opt-out) and conformance-test consolidation.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

Tasks extracted into the new ModelContextProtocol.Extensions.Tasks package #1693
- The Tasks API -- task result/notification types, McpTaskStatus, IMcpTaskStore/InMemoryMcpTaskStore, the tasks/* request methods, and the client GetTaskAsync/UpdateTaskAsync/CancelTaskAsync/CallToolRawAsync methods -- is removed from ModelContextProtocol.Core and relocated to the new ModelContextProtocol.Extensions.Tasks package under the ModelContextProtocol.Extensions.Tasks namespace.
- Core now exposes a task-agnostic ResultOrAlternate<T> (replacing ResultOrCreatedTask<T>) plus generic extension points -- McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that the Tasks package builds on.
- Migration: add a PackageReference to ModelContextProtocol.Extensions.Tasks; change using ModelContextProtocol.Protocol; to using ModelContextProtocol.Extensions.Tasks; for task types; the task client/server APIs are now extension methods (McpTasksClientExtensions/McpTasksServerExtensions), and the task store is registered via the new builder extensions instead of McpServerOptions.TaskStore.

Experimental APIs

To support extracting Tasks (#1693), ModelContextProtocol.Core gained a generic server-extension surface -- ResultOrAlternate<T>, McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that lets extension packages such as ModelContextProtocol.Extensions.Tasks layer behavior onto the server pipeline. These APIs are annotated [Experimental] under diagnostic ID MCPEXP002.

This surface is still being designed: #1704 tracks composing these seams with the normal filter and subscription pipeline (typed custom RPCs, filter composition, and extension-defined subscriptions). Expect these low-level extensibility APIs to change and potentially remain [Experimental] through the 2.0.0 stable release.

What's Changed

Fix request-scoped draft client capabilities #1685 by @PranavSenthilnathan (co-authored by @Copilot)
Tighten draft protocol negotiation boundaries #1692 by @halter73 (co-authored by @Copilot)
Fix missing resultType on complete result responses #1684 by @PranavSenthilnathan (co-authored by @Copilot)
Ignore empty Streamable HTTP JSON responses #1626 by @jstar0
Extract Tasks into the ModelContextProtocol.Extensions.Tasks extension package #1693 by @jeffhandley (co-authored by @Copilot)
Add opt-out for Streamable HTTP standalone GET stream #1699 by @jstar0 (co-authored by @Copilot)

Test Improvements

Re-enable http-custom-headers conformance scenario #1691 by @tarekgh
Run stateful and stateless conformance endpoints in a single server process #1672 by @halter73 (co-authored by @Copilot)

Acknowledgements

@jstar0 made their first contribution in #1626
@cclabadmin submitted #1676 (resolved by #1684)
@cclabadmin submitted #1680 (resolved by #1692)
@DmitryLukyanov submitted #1132 (resolved by #1626)
@KirillOsenkov submitted #1637 (resolved by #1699)
@halter73 @tarekgh @PranavSenthilnathan @jeffhandley reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.2...v2.0.0-preview.3

2.0.0-preview.2

This second preview of the 2.0.0 series advances the SDK's alignment with the upcoming 2026-07-28 MCP protocol revision: it adds client-side conformance diagnostics for the SEP-2549 caching hints, makes Streamable HTTP error responses echo the request id per the base protocol and SEP-2243, and fully stabilizes now-stable protocol properties so consumer-defined source generators serialize them correctly. Separately -- and unrelated to the protocol revision -- it introduces DeferChangedEvents() on McpServerPrimitiveCollection<T> for batching list_changed notifications when registering primitives in bulk. There are no breaking changes relative to v2.0.0-preview.1.

What's Changed

Document caching behavior and warn on non-conformant draft cacheable results (SEP-2549 follow-up) #1669 by @tarekgh
Fully stabilize now-stable protocol properties #1686 by @eiriktsarpalis (co-authored by @Copilot)
Echo request id in post-parse Streamable HTTP error responses #1687 by @tarekgh
Add DeferChangedEvents() to McpServerPrimitiveCollection for batched change notifications #1689 by @jeffhandley (co-authored by @Copilot)

Documentation Updates

Update package READMEs as part of the release process #1683 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

@cclabadmin submitted issue #1677 (resolved by #1687)
@lewing submitted issue #1688 (resolved by #1689)
@PranavSenthilnathan @halter73 @davidortinau @jeffhandley @lewing @tarekgh reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.1...v2.0.0-preview.2

2.0.0-preview.1

This is the first preview of the C# MCP SDK 2.0.0, designed for alignment with the 2026-07-28 MCP specification release. The SDK implements the 2026-07-28 protocol version which fundamentally changes how clients and servers interact -- removing the initialize handshake (SEP-2575), eliminating server-side session state (SEP-2567), introducing Multi Round-Trip Requests (SEP-2322), and deprecating legacy capabilities in favor of the new extensions framework (SEP-2133).

The 2.0.0 SDK is fully backward-compatible with servers and clients using the previous 2024-11-05 protocol version. Clients automatically negotiate down to the legacy initialize handshake when connecting to older servers, and servers continue to accept initialize requests from older clients. API breaking changes in 2.0.0 are limited to two categories: (1) APIs for capabilities deprecated by the new specification (Roots, Sampling, and Logging), which are now marked [Obsolete] with guidance toward their replacements, and (2) experimental APIs whose contracts changed as the specifications were finalized. Stable, non-deprecated APIs from 1.x continue to work without modification.

Protocol Version Negotiation and Handshake Behavior

The 2.0.0 SDK introduces a fundamentally new connection lifecycle:

Default behavior (no configuration needed):

Client sends a server/discover request with MCP-Protocol-Version: 2026-07-28
If the server supports the 2026-07-28 protocol version, it responds with capabilities -- no handshake, no session
If the server returns an error (MethodNotFound, InvalidParams, etc.) or times out (5s default via McpClientOptions.DiscoverProbeTimeout), the client automatically falls back to the legacy initialize handshake with 2025-11-25
Three "modern server" error codes (-32022 UnsupportedProtocolVersion, -32021 MissingRequiredClientCapability, -32020 HeaderMismatch) are never treated as legacy indicators and are surfaced as errors

Opting out of the 2026-07-28 protocol version:

Set McpClientOptions.ProtocolVersion = "2025-11-25" to force the legacy initialize handshake and disable the automatic fallback (a non-null ProtocolVersion now acts as both the requested version and the minimum the client accepts)

Per-request metadata (2026-07-28 protocol version):

Every request carries _meta with io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientInfo, and io.modelcontextprotocol/clientCapabilities
Servers MUST NOT infer capabilities from previous requests -- each request is self-describing

2026-07-28 Spec Alignment: SEP Implementation Status

The 2026-07-28 specification release includes 22 SEPs. The table below summarizes C# SDK status. Remaining work is tracked in the 2026-07-28 Spec Compliance milestone.

SEP	Title	Status	Closed	Open
SEP-2596	Feature Lifecycle and Deprecation Policy	✅ Aligned	--	--
SEP-2484	Require Conformance Tests	🚧 Partial	--	#1653
SEP-1730	SDK Tiers Definition	✅ Aligned	--	--
SEP-2575	Make MCP Stateless	🚧 Partial	#1610, #1671	#1670
SEP-2567	Sessionless MCP via Explicit State Handles	✅ Complete	#1610, #1671	--
SEP-2577	Deprecate Roots, Sampling, and Logging	✅ Complete	#1651	--
SEP-2133	Extensions Framework	✅ Complete	#1642	--
SEP-2663	Tasks Extension	✅ Complete	#1579, #1642	--
SEP-1865	MCP Apps Extension	✅ Complete	#1484	--
SEP-2322	Multi Round-Trip Requests (MRTR)	✅ Complete	#1458, #1642	--
SEP-2260	Require Server Requests Associated with Client Request	✅ Complete	#1458, #1610, #1671	--
SEP-2549	TTL for List Results	🚧 Partial	#1623, #1644	#1645, #1650
SEP-2243	HTTP Standardization	🚧 Partial	#1553, #1603, #1619	#1655
SEP-2106	JSON Schema 2020-12 for inputSchema/outputSchema	✅ Complete	#1568, #1600	--
SEP-2164	Standardize Resource Not Found Error Code	✅ Complete	#1558	--
SEP-2207	OIDC-Flavored Refresh Token Guidance	✅ Complete	#1479	--
SEP-2350	Client-Side Scope Accumulation	✅ Complete	#1591	--
SEP-2351	RFC 8414 Well-Known URI Suffix	✅ Complete	(built-in)	--
SEP-2352	Authorization Server Binding and Migration	🚧 Partial	(built-in)	#1474
... (truncated)

1.4.1

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

Release SSE response stream reference when GET request ends #1628 by @halter73 (co-authored by @joelmforsyth @Copilot)

Acknowledgements

@slomangino123 submitted issue #766 (resolved by #1628)

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

Commits viewable in compare view.

Updated ModelContextProtocol.Core from 1.4.0 to 2.2.0.

Release notes

Sourced from ModelContextProtocol.Core's releases.

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #1796 by @saicharanpardhu (co-authored by @Copilot @jeffhandley)
Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #1805 by @latent-9

Test Improvements

Fix duplicated word in test comment #1809 by @latent-9

Repository Infrastructure Updates

Enable package validation for the MCP extension packages #1793 by @jeffhandley (co-authored by @Copilot)
Add a release-manager agent that orchestrates the release skills #1794 by @jeffhandley (co-authored by @Copilot)
Bump Anthropic from 12.39.0 to 12.40.0 #1808
Bump @hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #1812
Fix dead relative link to versioning docs in bump-version skill #1807 by @latent-9

Acknowledgements

@latent-9 made their first contribution in #1807
@saicharanpardhu made their first contribution in #1796
@saicharanpardhu submitted issue #1777 (resolved by #1796)
@jeffhandley @tarekgh @halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

Keep AutoDetect channel open after provisional SSE failure #1768 by @PranavSenthilnathan
Preserve HTTP status codes across target frameworks #1767 by @PranavSenthilnathan
Fall back to initialize when server/discover fails at the HTTP layer #1766 by @rbstp
Add public subscriptions/listen server handler (SEP-2575) #1775 by @tarekgh

Documentation Updates

Add README for the InMemoryTransport sample #1769 by @AkbarDizaji
Add Application Insights telemetry example #1778 by @lntutor
Clarify client handling of embedded binary tool resources #1762 by @luisangelrod

Test Improvements

Speed up CLI argument escaping tests #1773 by @PranavSenthilnathan

Repository Infrastructure Updates

Clarify AI disclosure format with a > [!NOTE] alert example #1771 by @PranavSenthilnathan (co-authored by @Copilot)
Bump the npm_and_yarn group across 1 directory with 6 updates #1787
Avoid reading Configuration in Directory.Build.props #1776 by @lntutor
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #1784

Acknowledgements

@AkbarDizaji made their first contribution in #1769
@luisangelrod made their first contribution in #1762
@rbstp submitted issue #1765 (resolved by #1766)
@TomasHubelbauer submitted issue #1026 (resolved by #1778)
@Youssef1313 submitted issue #995 (resolved by #1766)
@eng-marani submitted issue #1261 (resolved by #1762)
@jeffhandley @tarekgh @halter73 @PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Default to stateless HTTP and discovery-first negotiation #1610
- HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
- Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
- Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
Deprecate Roots, Sampling, and Logging APIs #1651
- The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
- Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
Move Tasks into ModelContextProtocol.Extensions.Tasks #1693
- The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
- Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
Strengthen OAuth callback and issuer validation #1605
- AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
- OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
Emit non-object structured tool results directly #1568
- Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
- Update clients to read the value according to the advertised output schema rather than assuming a result property.
Require Tool.inputSchema during deserialization #1600
- Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
- Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
Require explicit PKCE S256 support in OAuth metadata #1700
- OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
- Update the authorization server metadata to declare PKCE S256 support.
Send application_type during dynamic client registration #1613
- Dynamic client registration requests now include an inferred application_type.
- Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
Propagate underlying SSE connection exceptions #1432
- Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
- Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
Fail OAuth step-up when a challenge makes no progress #1591
- A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
- Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

Add InheritEnvironmentVariables to StdioClientTransportOptions #1563 by @halter73
Stop logging stdio transport environment variables #1538 by @halter73 (co-authored by @Copilot)
Implement SEP-2243 HTTP header standardization #1553 by @mikekistler (co-authored by @tarekgh @Copilot)
Append offline_access to authorization scope when advertised (SEP-2207) #1479 by @stephentoub (co-authored by @Copilot)
Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #1558 by @jayaraman-venkatesan
Add APIs for pre-populating the McpClient tool cache #1590 by @tarekgh
Add ScopeSelectorDelegate to OAuth options #1596 by @halllo
Validate the authenticated user on Streamable HTTP session deletion #1604 by @halter73
... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752
- Aligns with protocol adjustment #3002.
- DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
- On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
Validate OAuth authorization state #1726
- Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
Fix SSE session transport shutdown behavior #1432
- Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

Fix SSE session transport shutdown behavior #1432 by @xue-cai (co-authored by @Copilot)
Validate OAuth authorization state #1726 by @halter73 (co-authored by @Copilot)
Add configurable Tasks execution modes and complete conformance support #1741 by @PranavSenthilnathan (co-authored by @Copilot)
Gate 2026-07-28 result fields by negotiated protocol version #1753 by @tarekgh
Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752 by @pcarleton (co-authored by @tarekgh @Copilot)
Reauthorize tools changed by call-tool filters #1737 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

Refine 2.0.0 concept documentation #1742 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Resolve test-server paths deterministically #1735 by @PranavSenthilnathan (co-authored by @Copilot)
Add MCP Apps NativeAOT coverage #1711 by @lntutor
Add MCP Apps _meta.ui serialization round-trip tests #1698 by @yayayouyou

Repository Infrastructure Updates

Bump actions/setup-node from 6.4.0 to 7.0.0 #1717
Bump coverlet.collector from 10.0.0 to 10.0.1 #1582
Bump qs from 6.14.2 to 6.15.2 #1597
Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #1716
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #1569
Bump actions/checkout from 6 to 7 #1665
Rename MCPEXP002 extensibility constants #1739 by @arimu1
Bump the testing-frameworks group #1746
Bump the serilog-testing group #1748
Bump actions/checkout from 7.0.0 to 7.0.1 #1745
Bump Anthropic from 12.17.0 to 12.39.0 #1750
Bump OpenTelemetry and five other dependencies #1747
... (truncated)

2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

Remove the preview task-scope helper #1722
- McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
- There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.
Harden OAuth issuer validation #1605
- AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
- Migrate to AuthorizationCallbackHandler and return AuthorizationResult.
Require advertised PKCE S256 support #1700
- Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
- Correct the authorization-server metadata or use a compliant discovery document.
Send Dynamic Client Registration application types #1613
- Unset ApplicationType now sends an inferred application_type instead of omitting it.
- Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

Require advertised PKCE S256 support #1700 by @PranavSenthilnathan (co-authored by @Copilot)
Make authorization-provider token caches thread-safe #1708 by @tarekgh
Send application_type in Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)
Preserve the original AutoDetect probe status code #1530 by @MukundaKatta
Return JSON-RPC parse errors for over-nested stdio requests #1629 by @adityasingh2400
Implement RFC 920...

Description has been truncated

Bumps Meziantou.Analyzer from 3.0.121 to 3.0.159 Bumps Microsoft.Data.Sqlite from 10.0.9 to 10.0.11 Bumps Microsoft.Extensions.Configuration.CommandLine from 11.0.0-preview.5.26302.115 to 11.0.0-preview.7.26381.103 Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 11.0.0-preview.5.26302.115 to 11.0.0-preview.7.26381.103 Bumps Microsoft.Extensions.Configuration.Json from 11.0.0-preview.5.26302.115 to 11.0.0-preview.7.26381.103 Bumps Microsoft.Extensions.Hosting from 11.0.0-preview.5.26302.115 to 11.0.0-preview.7.26381.103 Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.9.0 Bumps ModelContextProtocol from 1.4.0 to 2.2.0 Bumps ModelContextProtocol.Core from 1.4.0 to 2.2.0 Bumps Roslynator.Analyzers from 4.15.0 to 4.16.1 Bumps SonarAnalyzer.CSharp from 10.28.0.143324 to 10.32.0.713 Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.3 to 3.0.5 Bumps xunit.runner.visualstudio from 3.1.5 to 4.0.0 Bumps xunit.v3 from 3.2.2 to 4.0.0 --- updated-dependencies: - dependency-name: Meziantou.Analyzer dependency-version: 3.0.159 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.Data.Sqlite dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.Extensions.Configuration.CommandLine dependency-version: 11.0.0-preview.7.26381.103 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables dependency-version: 11.0.0-preview.7.26381.103 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 11.0.0-preview.7.26381.103 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.Extensions.Hosting dependency-version: 11.0.0-preview.7.26381.103 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: ModelContextProtocol dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: ModelContextProtocol.Core dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Roslynator.Analyzers dependency-version: 4.16.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.32.0.713 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: SQLitePCLRaw.bundle_e_sqlite3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: xunit.v3 dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-21T00:14:28Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 16, 2026

dependabot Bot mentioned this pull request Aug 16, 2026

Bump the nuget group with 12 updates #13

Closed

nccurry closed this Aug 21, 2026

nccurry deleted the dependabot/nuget/nuget-c07d905e05 branch August 21, 2026 00:14

Navigation Menu

Bump the nuget group with 14 updates - #14

Bump the nuget group with 14 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-c07d905e05

dependabot Bot commented on behalf of github Aug 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 16, 2026

3.0.159

What's Changed

3.0.158

What's Changed

3.0.157

What's Changed

3.0.156

What's Changed

3.0.155

What's Changed

3.0.154

What's Changed

3.0.153

What's Changed

3.0.152

What's Changed

3.0.151

What's Changed

3.0.150

What's Changed

3.0.149

What's Changed

3.0.148

What's Changed

3.0.147

What's Changed

3.0.146

What's Changed

3.0.145

What's Changed

3.0.144

What's Changed

3.0.143

What's Changed

3.0.142

What's Changed

3.0.141

What's Changed

3.0.140

What's Changed

3.0.139

What's Changed

3.0.138

What's Changed

3.0.137

What's Changed

3.0.136

What's Changed

3.0.135

What's Changed

3.0.134

What's Changed

3.0.133

What's Changed

3.0.132

What's Changed

3.0.131

What's Changed

3.0.130

What's Changed

3.0.129

What's Changed

3.0.128

What's Changed

3.0.127

What's Changed

3.0.126

What's Changed

3.0.125

What's Changed

3.0.124

What's Changed

3.0.123

What's Changed

3.0.122

What's Changed

18.9.0

What's Changed