csharp-sdk

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

• Harden authenticated stateful MCP sessions (commit bfbd893) by @halter73 (co-authored by @Copilot @jeffhandley @tarekgh)

Repository Infrastructure Updates

• Align docs publishing with shared orchestration #1981 by @jeffhandley (co-authored by @Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #1979 by @jeffhandley (co-authored by @Copilot)

Full Changelog: https://github.com/modelcontextprotocol/csharp-sdk/compare/v2.3.0...v2.3.1

[!NOTE] These release notes were drafted with GitHub Copilot.

This patch release includes security fixes for OAuth authentication and authenticated HTTP sessions.

What's Changed

• Validate OAuth PKCE support and metadata issuer #1949 by @halter73 (co-authored by @PranavSenthilnathan @Copilot)

Deployments using metadata-free 2025-03-26 OAuth discovery may explicitly enable the legacy endpoint fallback only after independently verifying PKCE enforcement; otherwise, update metadata to advertise S256. The process-wide opt-in is ModelContextProtocol.Authentication.AllowLegacyOAuthMetadataFallback; it does not bypass validation of discovered metadata.

• Harden authenticated HTTP session handling (7c5d15e) by @halter73 (co-authored by @jeffhandley @PranavSenthilnathan @Copilot)

Documentation Updates

• Sanitize 1.x documentation #1729 by @jeffhandley
• Document standing support for new MCP revisions #1827 by @jeffhandley (co-authored by @halter73 @Copilot)

Repository Infrastructure Updates

• Update SourceLink for 1.x documentation builds #1944 by @jeffhandley (co-authored by @Copilot)
• Enable CodeQL for release branches #1947 by @halter73 (co-authored by @Copilot)
• Add versioned docs publishing infrastructure #1980 by @jeffhandley (co-authored by @Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #1978 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

• @halter73 @jeffhandley @PranavSenthilnathan @tarekgh reviewed pull requests

Full Changelog: https://github.com/modelcontextprotocol/csharp-sdk/compare/v1.4.1...v1.4.2

[!NOTE] These release notes were drafted with GitHub Copilot.

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. McpClient.ServerInfo is nullable — #1903
   • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
   • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
   • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
   • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

• Correct protocol-version telemetry for stateless server spans #1810 by @luisangelrod
• Preserve HTTP errors and correct discovery fallback handling #1791 by @PranavSenthilnathan (co-authored by @Copilot)
• Make modern Streamable HTTP status mapping deterministic #1837 by @jstar0
  • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
• Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #1852 by @halter73 (co-authored by @Copilot)
• Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #1855 by @scottt732
• Close server stdin before waiting for graceful stdio process exit #1838 by @luisangelrod
• Preserve insertion order when listing server tools, prompts, and resources #1924 by @PederHP (co-authored by Claude Opus 5.5)
• Allow missing optional server identity in discovery and make ServerInfo nullable #1903 by @Coding-Professional
• Include JSON parse details in Streamable HTTP 400 responses #1844 by @ump45nose
• Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)
  • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
  • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
• Preserve numeric progress tokens in RequestOptions serialization #1832 by @dfedoryshchev
• Dispose legacy SSE POST responses to release connections deterministically #1841 by @yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

• Document standing support for new MCP specification revisions #1826 by @halter73 (co-authored by @Copilot)

Test Improvements

• Stabilize discovery-capable test connections while retaining initialization deadlines #1943 by @tarekgh

Repository Infrastructure Updates

• Add a source selector for manual documentation publishes #1828 by @jeffhandley (co-authored by @Copilot)
• Update SourceLink's private build dependency to resolve a vulnerable Git dependency #1873 by @halter73 (co-authored by @Copilot)
• Correct obsolete McpServerFactory references in Copilot instructions #1892 by @Zir0-93
• Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #1940

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

• Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #1796 by @saicharanpardhu (co-authored by @Copilot @jeffhandley)
• Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #1805 by @latent-9

Test Improvements

• Fix duplicated word in test comment #1809 by @latent-9

Repository Infrastructure Updates

• Enable package validation for the MCP extension packages #1793 by @jeffhandley (co-authored by @Copilot)
• Add a release-manager agent that orchestrates the release skills #1794 by @jeffhandley (co-authored by @Copilot)
• Bump Anthropic from 12.39.0 to 12.40.0 #1808
• Bump @hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #1812
• Fix dead relative link to versioning docs in bump-version skill #1807 by @latent-9

Acknowledgements

• @latent-9 made their first contribution in #1807
• @saicharanpardhu made their first contribution in #1796
• @saicharanpardhu submitted issue #1777 (resolved by #1796)
• @jeffhandley @tarekgh @halter73 reviewed pull requests

Full Changelog: https://github.com/modelcontextprotocol/csharp-sdk/compare/v2.1.0...v2.2.0

[!NOTE] These release notes were drafted with GitHub Copilot and reviewed before publishing.