Skip to content

Update dependency ModelContextProtocol to v2 - #35

Merged
ChrisPulman merged 1 commit into
mainfrom
renovate/modelcontextprotocol-2.x
Jul 29, 2026
Merged

Update dependency ModelContextProtocol to v2#35
ChrisPulman merged 1 commit into
mainfrom
renovate/modelcontextprotocol-2.x

Conversation

@renovate

@renovate renovate Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
ModelContextProtocol (source) 1.4.0 → 2.0.0 age adoption passing confidence

Release Notes

modelcontextprotocol/csharp-sdk (ModelContextProtocol)

v2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

  1. Default to stateless HTTP and discovery-first negotiation #​1610
    • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
    • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
    • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
  2. Deprecate Roots, Sampling, and Logging APIs #​1651
    • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
    • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
  3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
    • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
    • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
  4. Strengthen OAuth callback and issuer validation #​1605
    • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
    • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
  5. Emit non-object structured tool results directly #​1568
    • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
    • Update clients to read the value according to the advertised output schema rather than assuming a result property.
  6. Require Tool.inputSchema during deserialization #​1600
    • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
    • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
  7. Require explicit PKCE S256 support in OAuth metadata #​1700
    • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
    • Update the authorization server metadata to declare PKCE S256 support.
  8. Send application_type during dynamic client registration #​1613
    • Dynamic client registration requests now include an inferred application_type.
    • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
  9. Propagate underlying SSE connection exceptions #​1432
    • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
    • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
  10. Fail OAuth step-up when a challenge makes no progress #​1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

Community Stability Contributions
  • @​cclabadmin conducted detailed 2026-07-28 conformance testing against preview builds, reporting five issues with wire captures, exact repros, specification citations, and root-cause analysis: #​1580, #​1614, #​1676, #​1677, and #​1680. The resulting fixes landed in #​1724, #​1629, #​1684, #​1687, and #​1692.
  • @​KirillOsenkov reported and helped diagnose three v2 stability issues with deterministic repros and source-level analysis: console-less .NET Framework clients failing over stdio (#​1638, fixed by #​1639), standalone SSE GET deadlocks under connection-pool pressure (#​1637, fixed by #​1699), and OAuth client ID availability on cold start (#​1658, fixed by #​1705).
  • @​KubaZ2 found the preview.3 regression that broke servers combining Tasks with HTTP transport (#​1720), then validated the #​1722 fix against rc.1 before release.
  • @​p-ob found and documented the preview.3 wire-compatibility regression that emitted 2026-07-28 result fields to down-level clients (#​1721), directly enabling the release-blocking fix in #​1753.
  • @​shmed reported both the AutoDetect status-code issue (#​1526, fixed by #​1530) and a production interoperability failure where the SDK's HTTP content type was rejected by GitHub Copilot's MCP endpoint (#​1527, fixed by #​1528).
  • @​jwoo-msft provided a minimal repro and root-cause analysis showing that Tool.InputSchema silently masked malformed payloads (#​1575), leading to the required-field fix in #​1600.
  • @​mirusser pinpointed the missing path for setting _meta on initialize requests (#​1593), leading to McpClientOptions.InitializeMeta in #​1599.
  • @​DmitryLukyanov, with independent confirmation from @​dimable, documented the empty HTTP response deserialization failure (#​1132), fixed by #​1626.
  • @​mllab-nl identified the OAuth client's non-compliant PKCE metadata fallback (#​730), ultimately resolved by the strict S256 validation in #​1700.
  • @​k8x10 supplied a self-contained repro and source-level root-cause analysis for double-wrapped Task results (#​1480), informing the v2 Tasks redesign.
  • @​aaronpk corrected Enterprise Managed Authorization terminology in #​1305 to keep the SDK aligned with the authoritative OAuth specification work.
New Contributors
Additional Issue Reporters
Reviewers

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.1...v2.0.0

v1.4.1

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

Acknowledgements

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@ChrisPulman
ChrisPulman merged commit 7074382 into main Jul 29, 2026
4 checks passed
@ChrisPulman
ChrisPulman deleted the renovate/modelcontextprotocol-2.x branch July 29, 2026 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChrisPulman ChrisPulman ChrisPulman approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ChrisPulman