Bump the nuget group with 2 updates - #1822
Conversation
Bumps ModelContextProtocol from 1.4.1 to 2.0.0 Bumps ModelContextProtocol.AspNetCore from 1.4.1 to 2.0.0 --- updated-dependencies: - dependency-name: ModelContextProtocol dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: ModelContextProtocol.AspNetCore dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
erikdarlingdata
left a comment
erikdarlingdata
left a comment
There was a problem hiding this comment.
Automated review — comments only, no approval or change request.
What this PR does
Dependabot bumps ModelContextProtocol and ModelContextProtocol.AspNetCore from 1.4.1 → 2.0.0 in the Darling.Service csproj, refreshes the two packages.lock.json files (Lite + deprecated/Dashboard), and also adds new direct <PackageReference> entries for ModelContextProtocol 2.0.0 in Darling.Analysis and PlanAnalysis — projects that don't consume the MCP SDK in code.
Blockers
-
Solution-wide version skew. After merge:
2.0.0—Darling.Service,Darling.Analysis(new direct ref),PlanAnalysis(new direct ref).1.4.1—PerformanceMonitor.Common:20,Lite/PerformanceMonitorLite.csproj:76-77,deprecated/Dashboard/Dashboard.csproj:50-51.
Commonis referenced by nearly everything and pins1.4.1.LitereferencesPlanAnalysis(now 2.0.0 direct) and also pins1.4.1directly. Expect NU1608 downgrade warnings at best, resolution failures at worst. The MCP bump has to happen everywhere in one PR or nowhere. -
Two spurious new PackageReferences.
Darling.Analysis.csproj:20andPlanAnalysis.csproj:25gained a new directModelContextProtocol 2.0.0dependency, but neither project has a singleusing ModelContextProtocolin its.cssources. Dependabot shouldn't be adding new package refs — this looks like a lockfile-resolution side effect that got serialized incorrectly. Either delete both lines or fold them into a coordinated solution-wide bump. -
Comment invariant broken.
Darling.Service.csproj:29explicitly says "Lite's exact MCP stack/version." That's no longer true. Update the comment or bump Lite to match.
Needs attention
-
1.4.1 → 2.0.0is a major version. Per the release notes: stateless-by-default HTTP transport, deprecated Roots/Sampling/Logging (MCP9005),Tasksmoved to a separateModelContextProtocol.Extensions.Taskspackage, discovery-first negotiation. The two hosts (Lite/Mcp/McpHostService.cs:75andDarling.Service/Mcp/DarlingMcpHostService.cs:399) already setStateless = true, so that flip is a no-op behaviorally, but the other breaks warrant a manual read of the migration guide before merging — this isn't a routine dependabot bump. -
Line endings flipped CRLF → LF on all three csproj files. The base copies are CRLF (
filereports "with CRLF line terminators"); the branch versions are LF, which is why the diff shows-42/+41onAnalysis.csproj(only one real content-line added) and-65/+65onService.csproj(only two version strings actually changed). No.gitattributeseol=lfrule is in place for*.csproj. If you accept the bump, restore the CRLF endings so blame stays legible for Windows contributors. -
PR base is
main. The routine guidance is that PRs targetdev. Dependabot doesn't havetarget-branch: "dev"set in.github/dependabot.yml, so it defaults tomain. If dependabot PRs should land ondevfirst, that config needs a change; ifmainis intentionally the target for dependency bumps, ignore this.
Other checks (all clean)
- No PlanAnalyzer changes →
Dashboard/Services/PlanAnalyzer.cs↔Lite/Services/PlanAnalyzer.cssync not relevant. - No schema / install / upgrade script touched → no upgrade-path concern.
- No
.github/workflows/build.ymltouched → SignPath posture unchanged. - No
.sqlchanges. - No new C# logic → no test-coverage delta expected.
Recommend closing this PR and either coordinating the MCP 2.0.0 bump as one solution-wide change with the migration notes reviewed, or bumping dependabot.yml to ignore ModelContextProtocol* majors and letting Dependabot do the minors.
Generated by Claude Code
| <!-- The plan fetcher connects to the MONITORED SQL Server (same client the Service uses); | ||
| Npgsql and Logging.Abstractions flow transitively from the Storage/Notifications references. --> | ||
| <PackageReference Include="Microsoft.Data.SqlClient" Version="7.0.2" /> | ||
| <PackageReference Include="ModelContextProtocol" Version="2.0.0" /> |
There was a problem hiding this comment.
Dependabot added a new direct PackageReference here — no version was pinned in this csproj before. Darling.Analysis has no using ModelContextProtocol anywhere in its .cs sources (grep confirms zero hits outside this csproj), so this reference is spurious.
Two consequences:
- It forces
ModelContextProtocol 2.0.0into every downstream that referencesDarling.Analysis(transitively, that includesDarling.Service,Darling.Viewer,Darling.Tests). - It creates version skew with
PerformanceMonitor.Common(still at1.4.1, csproj line 20) which this project also references. NuGet will resolve to the higher version but will emit an NU1608/downgrade warning, andCommon's comment "Brings ModelContextProtocol.Core… transitively" is now inconsistent.
If the intent is to bump the SDK across the solution, do it as one coordinated change to Common + Lite + deprecated Dashboard + the Darling projects. If not, just delete this line — the project doesn't consume the SDK directly.
Generated by Claude Code
| XML), so it needs the SqlClient runtime connection surface. Version matches Lite/Dashboard/the Darling | ||
| service (7.0.1) so there is no transitive version skew. --> | ||
| <PackageReference Include="Microsoft.Data.SqlClient" Version="7.0.2" /> | ||
| <PackageReference Include="ModelContextProtocol" Version="2.0.0" /> |
There was a problem hiding this comment.
Same issue as Darling.Analysis.csproj:20 — Dependabot has added a new direct PackageReference to a project that doesn't use MCP. PerformanceMonitor.PlanAnalysis has zero using ModelContextProtocol in its sources; the only occurrences of the string in this project tree are in this csproj.
More importantly: PlanAnalysis is referenced by Lite/PerformanceMonitorLite.csproj:76-77 which still pins ModelContextProtocol 1.4.1 (and ModelContextProtocol.AspNetCore 1.4.1). Adding 2.0.0 here forces Lite to consume the higher transitive version while its direct pin says otherwise → guaranteed NU1608 downgrade warning at build, or an actual resolution failure depending on how the AspNetCore metapackage resolves.
Please delete the line, or fold this into a solution-wide bump that also touches Common, Lite, and deprecated/Dashboard.
Generated by Claude Code
| <!-- AN4: the analysis MCP tools over Streamable HTTP — Lite's exact MCP stack/version. | ||
| The AspNetCore package brings the Microsoft.AspNetCore.App framework reference | ||
| (Kestrel/WebApplication) transitively, same as it does for Lite. --> | ||
| <PackageReference Include="ModelContextProtocol" Version="2.0.0" /> | ||
| <PackageReference Include="ModelContextProtocol.AspNetCore" Version="2.0.0" /> |
There was a problem hiding this comment.
Two things about this hunk:
1. The AN4 comment is now a lie. Line 29 says "Lite's exact MCP stack/version." After this PR: Service is 2.0.0, but Lite/PerformanceMonitorLite.csproj:76-77 and PerformanceMonitor.Common/PerformanceMonitor.Common.csproj:20 remain at 1.4.1. Either bump the whole set together, or drop the "exact match" invariant.
2. 1.4.1 → 2.0.0 is a real major-version review, not a routine bump. From the release notes:
HttpServerTransportOptions.Statelessnow defaults totrue. This code setsStateless = trueexplicitly atMcp/DarlingMcpHostService.cs:399, so the default flip is benign — but the AspNetCore surface is otherwisestateless by default; audit any code path that assumed session-scoped semantics (SSEGET/DELETE, unsolicited server→client requests).- Roots / Sampling / Logging APIs deprecated →
MCP9005warnings. The<NoWarn>list on line 15 doesn't includeMCP9005; if these APIs are hit anywhere, build will surface new warnings. Tasksmoved to a separateModelContextProtocol.Extensions.Taskspackage. Search for anyTasksuse before merge.- Discovery-first negotiation is now the default — verify Lite (which is still 1.4.1) can still connect if these two are ever run against each other.
Recommend the maintainer read the 2.0.0 migration guide before merging and coordinate the bump across Common, Lite, PlanAnalysis, both Darling csprojs, and deprecated/Dashboard in one PR.
Generated by Claude Code
1 participant
Updated ModelContextProtocol from 1.4.1 to 2.0.0.
Release notes
Sourced from ModelContextProtocol's releases.
2.0.0
Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.
This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.
HttpServerTransportOptions.Statelessnow defaults totrue. Stateless servers do not create transport sessions, expose the standalone SSEGET/DELETEendpoints, or support unsolicited server-to-client requests.Stateless = falsewhen an existing server requires legacy stateful behavior. Stateful-only options now produceMCP9006warnings and apply only to down-level initialize-handshake connections.server/discoverfirst and automatically fall back to the legacyinitializehandshake for down-level servers.MCP9005warnings because these features are deprecated by the 2026-07-28 specification.MCP9005temporarily if continued use is required while planning migration.ModelContextProtocol.Extensions.Tasks#1693ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks withWithTasks(...), and replace CoreRequestMethods.Tasks*constants withTasksProtocolmembers.AuthorizationRedirectDelegateandClientOAuthOptions.AuthorizationRedirectDelegatenow produceMCP9007warnings. Migrate toClientOAuthOptions.AuthorizationCallbackHandlerso callbacks can return the authorization code, state, and issuer.UseStructuredContent = trueand a non-object return type now emit the raw value and matching schema, such asstructuredContent: 72, instead of wrapping it as{ "result": 72 }.resultproperty.Tool.inputSchemaduring deserialization #1600Toolpayload withoutinputSchemanow throwsJsonExceptioninstead of silently defaulting the schema.inputSchema; an empty{}is sufficient.S256incode_challenge_methods_supported.application_typeduring dynamic client registration #1613application_type.DynamicClientRegistrationOptions.ApplicationTypeexplicitly when the inferred value is not appropriate.HttpRequestException,TimeoutException, or genuine I/O exception instead of always wrapping failures inIOException.IOException("Failed to connect transport.")wrapper. In AutoDetect mode, inspect the outerHttpRequestExceptionand its inner SSE failure.insufficient_scopechallenge that introduces no new scopes now throwsMcpExceptioninstead of retrying indefinitely.What's Changed
InheritEnvironmentVariablestoStdioClientTransportOptions#1563 by @halter73offline_accessto authorization scope when advertised (SEP-2207) #1479 by @stephentoub (co-authored by @Copilot)McpErrorCode.ResourceNotFoundper SEP-2164 #1558 by @jayaraman-venkatesanMcpClienttool cache #1590 by @tarekghScopeSelectorDelegateto OAuth options #1596 by @halllo... (truncated)
2.0.0-rc.2
This second 2.0 release candidate advances the SDK’s
2026-07-28protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.
DiscoverResult.ServerInfois removed; read and deserializeMeta[MetaKeys.ServerInfo]instead.2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods withserver/discover,_metalog level, andsubscriptions/listen.statethroughAuthorizationResult.State, and should returnCode,State, andIss.IOExceptionwrapper.What's Changed
Documentation Updates
Test Improvements
_meta.uiserialization round-trip tests #1698 by @yayayouyouRepository Infrastructure Updates
... (truncated)
2.0.0-rc.1
2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.
We remain on-track to release 2.0.0 stable on or before 2026-07-28.
We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.
Remove the preview task-scope helper #1722
McpTasksServerExtensions.CreateMcpTaskScope(...)was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.Harden OAuth issuer validation #1605
AuthorizationRedirectDelegatenow producesMCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.AuthorizationCallbackHandlerand returnAuthorizationResult.Require advertised PKCE S256 support #1700
code_challenge_methods_supported: ["S256"]now cause authentication to fail instead of receiving an inferred default.Send Dynamic Client Registration application types #1613
ApplicationTypenow sends an inferredapplication_typeinstead of omitting it.DynamicClientRegistrationOptions.ApplicationTypeexplicitly when the authorization server requires another value.What's Changed
application_typein Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)ClientOAuthProvider#1605 by @mikekistler (co-authored by @halter73 @Copilot)Documentation Updates
release/1.x(v1.4.1) andmain(v2 preview) content #1727 by @jeffhandley (co-authored by @Copilot)Test Improvements
... (truncated)
2.0.0-preview.3
This preview reorganizes the Tasks feature into its own
ModelContextProtocol.Extensions.Taskspackage, keepingModelContextProtocol.Corefocused on the base protocol while a new generic request-handler and alternate-result surface lets the Tasks package layer on top. It also delivers correctness fixes to the draft2026-07-28protocol -- per-request client capabilities, negotiation boundaries, and theresultTypediscriminator -- plus Streamable HTTP client improvements (an empty-JSON-response fix and a new standalone GET-stream opt-out) and conformance-test consolidation.Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.
ModelContextProtocol.Extensions.Taskspackage #1693McpTaskStatus,IMcpTaskStore/InMemoryMcpTaskStore, thetasks/*request methods, and the clientGetTaskAsync/UpdateTaskAsync/CancelTaskAsync/CallToolRawAsyncmethods -- is removed fromModelContextProtocol.Coreand relocated to the newModelContextProtocol.Extensions.Taskspackage under theModelContextProtocol.Extensions.Tasksnamespace.ResultOrAlternate<T>(replacingResultOrCreatedTask<T>) plus generic extension points --McpServerRequestHandler,McpServerOptions.RequestHandlers,McpServerHandlers.CallToolWithAlternateHandler,McpRequestFilters.CallToolWithAlternateFilters, andMcpServer.InterceptOutgoingRequests-- that the Tasks package builds on.PackageReferencetoModelContextProtocol.Extensions.Tasks; changeusing ModelContextProtocol.Protocol;tousing ModelContextProtocol.Extensions.Tasks;for task types; the task client/server APIs are now extension methods (McpTasksClientExtensions/McpTasksServerExtensions), and the task store is registered via the new builder extensions instead ofMcpServerOptions.TaskStore.Experimental APIs
To support extracting Tasks (#1693),
ModelContextProtocol.Coregained a generic server-extension surface --ResultOrAlternate<T>,McpServerRequestHandler,McpServerOptions.RequestHandlers,McpServerHandlers.CallToolWithAlternateHandler,McpRequestFilters.CallToolWithAlternateFilters, andMcpServer.InterceptOutgoingRequests-- that lets extension packages such asModelContextProtocol.Extensions.Taskslayer behavior onto the server pipeline. These APIs are annotated[Experimental]under diagnostic IDMCPEXP002.This surface is still being designed: #1704 tracks composing these seams with the normal filter and subscription pipeline (typed custom RPCs, filter composition, and extension-defined subscriptions). Expect these low-level extensibility APIs to change and potentially remain
[Experimental]through the 2.0.0 stable release.What's Changed
ModelContextProtocol.Extensions.Tasksextension package #1693 by @jeffhandley (co-authored by @Copilot)Test Improvements
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.2...v2.0.0-preview.3
2.0.0-preview.2
This second preview of the 2.0.0 series advances the SDK's alignment with the upcoming
2026-07-28MCP protocol revision: it adds client-side conformance diagnostics for the SEP-2549 caching hints, makes Streamable HTTP error responses echo the request id per the base protocol and SEP-2243, and fully stabilizes now-stable protocol properties so consumer-defined source generators serialize them correctly. Separately -- and unrelated to the protocol revision -- it introducesDeferChangedEvents()onMcpServerPrimitiveCollection<T>for batchinglist_changednotifications when registering primitives in bulk. There are no breaking changes relative tov2.0.0-preview.1.What's Changed
Documentation Updates
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.1...v2.0.0-preview.2
2.0.0-preview.1
This is the first preview of the C# MCP SDK 2.0.0, designed for alignment with the 2026-07-28 MCP specification release. The SDK implements the
2026-07-28protocol version which fundamentally changes how clients and servers interact -- removing theinitializehandshake (SEP-2575), eliminating server-side session state (SEP-2567), introducing Multi Round-Trip Requests (SEP-2322), and deprecating legacy capabilities in favor of the new extensions framework (SEP-2133).The 2.0.0 SDK is fully backward-compatible with servers and clients using the previous
2024-11-05protocol version. Clients automatically negotiate down to the legacyinitializehandshake when connecting to older servers, and servers continue to acceptinitializerequests from older clients. API breaking changes in 2.0.0 are limited to two categories: (1) APIs for capabilities deprecated by the new specification (Roots, Sampling, and Logging), which are now marked[Obsolete]with guidance toward their replacements, and (2) experimental APIs whose contracts changed as the specifications were finalized. Stable, non-deprecated APIs from 1.x continue to work without modification.Protocol Version Negotiation and Handshake Behavior
The 2.0.0 SDK introduces a fundamentally new connection lifecycle:
Default behavior (no configuration needed):
server/discoverrequest withMCP-Protocol-Version: 2026-07-282026-07-28protocol version, it responds with capabilities -- no handshake, no sessionMcpClientOptions.DiscoverProbeTimeout), the client automatically falls back to the legacyinitializehandshake with2025-11-25-32022UnsupportedProtocolVersion,-32021MissingRequiredClientCapability,-32020HeaderMismatch) are never treated as legacy indicators and are surfaced as errorsOpting out of the
2026-07-28protocol version:McpClientOptions.ProtocolVersion = "2025-11-25"to force the legacyinitializehandshake and disable the automatic fallback (a non-nullProtocolVersionnow acts as both the requested version and the minimum the client accepts)Per-request metadata (
2026-07-28protocol version):_metawithio.modelcontextprotocol/protocolVersion,io.modelcontextprotocol/clientInfo, andio.modelcontextprotocol/clientCapabilities2026-07-28 Spec Alignment: SEP Implementation Status
The 2026-07-28 specification release includes 22 SEPs. The table below summarizes C# SDK status. Remaining work is tracked in the 2026-07-28 Spec Compliance milestone.
Commits viewable in compare view.
Updated ModelContextProtocol.AspNetCore from 1.4.1 to 2.0.0.
Release notes
Sourced from ModelContextProtocol.AspNetCore's releases.
2.0.0
Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.
This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.
HttpServerTransportOptions.Statelessnow defaults totrue. Stateless servers do not create transport sessions, expose the standalone SSEGET/DELETEendpoints, or support unsolicited server-to-client requests.Stateless = falsewhen an existing server requires legacy stateful behavior. Stateful-only options now produceMCP9006warnings and apply only to down-level initialize-handshake connections.server/discoverfirst and automatically fall back to the legacyinitializehandshake for down-level servers.MCP9005warnings because these features are deprecated by the 2026-07-28 specification.MCP9005temporarily if continued use is required while planning migration.ModelContextProtocol.Extensions.Tasks#1693ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks withWithTasks(...), and replace CoreRequestMethods.Tasks*constants withTasksProtocolmembers.AuthorizationRedirectDelegateandClientOAuthOptions.AuthorizationRedirectDelegatenow produceMCP9007warnings. Migrate toClientOAuthOptions.AuthorizationCallbackHandlerso callbacks can return the authorization code, state, and issuer.UseStructuredContent = trueand a non-object return type now emit the raw value and matching schema, such asstructuredContent: 72, instead of wrapping it as{ "result": 72 }.resultproperty.Tool.inputSchemaduring deserialization #1600Toolpayload withoutinputSchemanow throwsJsonExceptioninstead of silently defaulting the schema.inputSchema; an empty{}is sufficient.S256incode_challenge_methods_supported.application_typeduring dynamic client registration #1613application_type.DynamicClientRegistrationOptions.ApplicationTypeexplicitly when the inferred value is not appropriate.HttpRequestException,TimeoutException, or genuine I/O exception instead of always wrapping failures inIOException.IOException("Failed to connect transport.")wrapper. In AutoDetect mode, inspect the outerHttpRequestExceptionand its inner SSE failure.insufficient_scopechallenge that introduces no new scopes now throwsMcpExceptioninstead of retrying indefinitely.What's Changed
InheritEnvironmentVariablestoStdioClientTransportOptions#1563 by @halter73offline_accessto authorization scope when advertised (SEP-2207) #1479 by @stephentoub (co-authored by @Copilot)McpErrorCode.ResourceNotFoundper SEP-2164 #1558 by @jayaraman-venkatesanMcpClienttool cache #1590 by @tarekghScopeSelectorDelegateto OAuth options #1596 by @halllo... (truncated)
2.0.0-rc.2
This second 2.0 release candidate advances the SDK’s
2026-07-28protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.
DiscoverResult.ServerInfois removed; read and deserializeMeta[MetaKeys.ServerInfo]instead.2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods withserver/discover,_metalog level, andsubscriptions/listen.statethroughAuthorizationResult.State, and should returnCode,State, andIss.IOExceptionwrapper.What's Changed
Documentation Updates
Test Improvements
_meta.uiserialization round-trip tests #1698 by @yayayouyouRepository Infrastructure Updates
... (truncated)
2.0.0-rc.1
2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.
We remain on-track to release 2.0.0 stable on or before 2026-07-28.
We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!
Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.
Remove the preview task-scope helper #1722
McpTasksServerExtensions.CreateMcpTaskScope(...)was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.Harden OAuth issuer validation #1605
AuthorizationRedirectDelegatenow producesMCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.AuthorizationCallbackHandlerand returnAuthorizationResult.Require advertised PKCE S256 support #1700
code_challenge_methods_supported: ["S256"]now cause authentication to fail instead of receiving an inferred default.Send Dynamic Client Registration application types #1613
ApplicationTypenow sends an inferredapplication_typeinstead of omitting it.DynamicClientRegistrationOptions.ApplicationTypeexplicitly when the authorization server requires another value.What's Changed
application_typein Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)ClientOAuthProvider#1605 by @mikekistler (co-authored by @halter73 @Copilot)Documentation Updates
release/1.x(v1.4.1) andmain(v2 preview) content #1727 by @jeffhandley (co-authored by @Copilot)Test Improvements
... (truncated)
2.0.0-preview.3
This preview reorganizes the Tasks feature into its own
ModelContextProtocol.Extensions.Taskspackage, keepingModelContextProtocol.Corefocused on the base protocol while a new generic request-handler and alternate-result surface lets the Tasks package layer on top. It also delivers correctness fixes to the draft2026-07-28protocol -- per-request client capabilities, negotiation boundaries, and theresultTypediscriminator -- plus Streamable HTTP client improvements (an empty-JSON-response fix and a new standalone GET-stream opt-out) and conformance-test consolidation.Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.
ModelContextProtocol.Extensions.Taskspackage #1693McpTaskStatus,IMcpTaskStore/InMemoryMcpTaskStore, thetasks/*request methods, and the clientGetTaskAsync/UpdateTaskAsync/CancelTaskAsync/CallToolRawAsyncmethods -- is removed fromModelContextProtocol.Coreand relocated to the newModelContextProtocol.Extensions.Taskspackage under theModelContextProtocol.Extensions.Tasksnamespace.ResultOrAlternate<T>(replacingResultOrCreatedTask<T>) plus generic extension points --McpServerRequestHandler,McpServerOptions.RequestHandlers,McpServerHandlers.CallToolWithAlternateHandler,McpRequestFilters.CallToolWithAlternateFilters, andMcpServer.InterceptOutgoingRequests-- that the Tasks package builds on.PackageReferencetoModelContextProtocol.Extensions.Tasks; changeusing ModelContextProtocol.Protocol;tousing ModelContextProtocol.Extensions.Tasks;for task types; the task client/server APIs are now extension methods (McpTasksClientExtensions/McpTasksServerExtensions), and the task store is registered via the new builder extensions instead ofMcpServerOptions.TaskStore.Experimental APIs
To support extracting Tasks (#1693),
ModelContextProtocol.Coregained a generic server-extension surface --ResultOrAlternate<T>,McpServerRequestHandler,McpServerOptions.RequestHandlers,McpServerHandlers.CallToolWithAlternateHandler,McpRequestFilters.CallToolWithAlternateFilters, andMcpServer.InterceptOutgoingRequests-- that lets extension packages such asModelContextProtocol.Extensions.Taskslayer behavior onto the server pipeline. These APIs are annotated[Experimental]under diagnostic IDMCPEXP002.This surface is still being designed: #1704 tracks composing these seams with the normal filter and subscription pipeline (typed custom RPCs, filter composition, and extension-defined subscriptions). Expect these low-level extensibility APIs to change and potentially remain
[Experimental]through the 2.0.0 stable release.What's Changed
ModelContextProtocol.Extensions.Tasksextension package #1693 by @jeffhandley (co-authored by @Copilot)Test Improvements
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.2...v2.0.0-preview.3
2.0.0-preview.2
This second preview of the 2.0.0 series advances the SDK's alignment with the upcoming
2026-07-28MCP protocol revision: it adds client-side conformance diagnostics for the SEP-2549 caching hints, makes Streamable HTTP error responses echo the request id per the base protocol and SEP-2243, and fully stabilizes now-stable protocol properties so consumer-defined source generators serialize them correctly. Separately -- and unrelated to the protocol revision -- it introducesDeferChangedEvents()onMcpServerPrimitiveCollection<T>for batchinglist_changednotifications when registering primitives in bulk. There are no breaking changes relative tov2.0.0-preview.1.What's Changed
Documentation Updates
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.1...v2.0.0-preview.2
2.0.0-preview.1
This is the first preview of the C# MCP SDK 2.0.0, designed for alignment with the 2026-07-28 MCP specification release. The SDK implements the
2026-07-28protocol version which fundamentally changes how clients and servers interact -- removing theinitializehandshake (SEP-2575), eliminating server-side session state (SEP-2567), introducing Multi Round-Trip Requests (SEP-2322), and deprecating legacy capabilities in favor of the new extensions framework (SEP-2133).The 2.0.0 SDK is fully backward-compatible with servers and clients using the previous
2024-11-05protocol version. Clients automatically negotiate down to the legacyinitializehandshake when connecting to older servers, and servers continue to acceptinitializerequests from older clients. API breaking changes in 2.0.0 are limited to two categories: (1) APIs for capabilities deprecated by the new specification (Roots, Sampling, and Logging), which are now marked[Obsolete]with guidance toward their replacements, and (2) experimental APIs whose contracts changed as the specifications were finalized. Stable, non-deprecated APIs from 1.x continue to work without modification.Protocol Version Negotiation and Handshake Behavior
The 2.0.0 SDK introduces a fundamentally new connection lifecycle:
Default behavior (no configuration needed):
server/discoverrequest withMCP-Protocol-Version: 2026-07-282026-07-28protocol version, it responds with capabilities -- no handshake, no sessionMcpClientOptions.DiscoverProbeTimeout), the client automatically falls back to the legacyinitializehandshake with2025-11-25-32022UnsupportedProtocolVersion,-32021MissingRequiredClientCapability,-32020HeaderMismatch) are never treated as legacy indicators and are surfaced as errorsOpting out of the
2026-07-28protocol version:McpClientOptions.ProtocolVersion = "2025-11-25"to force the legacyinitializehandshake and disable the automatic fallback (a non-nullProtocolVersionnow acts as both the requested version and the minimum the client accepts)Per-request metadata (
2026-07-28protocol version):_metawithio.modelcontextprotocol/protocolVersion,io.modelcontextprotocol/clientInfo, andio.modelcontextprotocol/clientCapabilities2026-07-28 Spec Alignment: SEP Implementation Status
The 2026-07-28 specification release includes 22 SEPs. The table below summarizes C# SDK status. Remaining work is tracked in the 2026-07-28 Spec Compliance milestone.
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions