Release v2.0.0

[jeffhandley]

Release v2.0.0

Version 2.0.0 is the first stable C# SDK release aligned with the MCP 2026-07-28 specification.

This major version release adds discovery-first negotiation with down-level fallback, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth support, and dedicated MCP Apps and Tasks extension packages, while retaining interoperability with peers that negotiate 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Default to stateless HTTP and discovery-first negotiation Default draft protocol support: sessionless + handshake-less (SEP-2575 + SEP-2567) #1610
   • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
   • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
   • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
2. Deprecate Roots, Sampling, and Logging APIs Obsolete Roots, Sampling, and Logging surface area per SEP-2577 #1651
   • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
   • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
3. Move Tasks into ModelContextProtocol.Extensions.Tasks Extract Tasks into the ModelContextProtocol.Extensions.Tasks extension package #1693
   • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
   • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
4. Strengthen OAuth callback and issuer validation Implement RFC 9207 issuer validation in ClientOAuthProvider #1605
   • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
   • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
5. Emit non-object structured tool results directly Relax outputSchema to any JSON Schema 2020-12 document per SEP-2106 #1568
   • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
   • Update clients to read the value according to the advertised output schema rather than assuming a result property.
6. Require Tool.inputSchema during deserialization Require Tool inputSchema during deserialization #1600
   • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
   • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
7. Require explicit PKCE S256 support in OAuth metadata Enforce PKCE metadata compliance in OAuth client (#730) #1700
   • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
   • Update the authorization server metadata to declare PKCE S256 support.
8. Send application_type during dynamic client registration Add application_type to the Dynamic Client Registration request #1613
   • Dynamic client registration requests now include an inferred application_type.
   • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
9. Propagate underlying SSE connection exceptions Fix: swallow _receiveTask exceptions in SseClientSessionTransport.CloseAsync #1432
   • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
   • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
10. Fail OAuth step-up when a challenge makes no progress Implementation for SEP-2350 Client-side scope accumulation in step-up authorization #1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

• Add InheritEnvironmentVariables to StdioClientTransportOptions Add InheritEnvironmentVariables to StdioClientTransportOptions #1563 by @halter73
• Stop logging stdio transport environment variables Stop logging stdio transport environment variables #1538 by @halter73 (co-authored by @copilot)
• Implement SEP-2243 HTTP header standardization Implementation for SEP-2243 Http Standardization #1553 by @mikekistler (co-authored by @tarekgh @copilot)
• Append offline_access to authorization scope when advertised (SEP-2207) Append offline_access to authorization scope when AS advertises it (SEP-2207) #1479 by @stephentoub (co-authored by @copilot)
• Deprecate McpErrorCode.ResourceNotFound per SEP-2164 Deprecate McpErrorCode.ResourceNotFound (-32002) and use McpErrorCode.InvalidParams (-32602) per SEP-2164 #1558 by @jayaraman-venkatesan
• Add APIs for pre-populating the McpClient tool cache Add RegisterTools API to McpClient for pre-populating tool cache #1590 by @tarekgh
• Add ScopeSelectorDelegate to OAuth options Add ScopeSelectorDelegate to enhance OAuth options for scope filtering #1596 by @halllo
• Validate the authenticated user on Streamable HTTP session deletion Validate user on Streamable HTTP session DELETE #1604 by @halter73
• Relax resource URI validation to accept a base URL Fix: Relax resource URI validation to accept base URL #1517 by @JBallan (co-authored by @tarekgh)
• Rename MinVersionForStandardHeaders to DraftProtocolVersion Rename MinVersionForStandardHeaders to DraftProtocolVersion #1603 by @halter73
• Add Enterprise Managed Authorization support (SEP-990) feat: Add Enterprise Managed Authorization (SEP-990) support #1305 by @aniket-okta
• Add multi-round-trip requests (MRTR) Multi Round-Trip Requests (MRTR) #1458 by @halter73
• Align x-mcp-header behavior with SEP-2243 clarifications Align x-mcp-header implementation with SEP-2243 spec clarifications #1619 by @tarekgh
• Skip the idle-tracking timer in stateless mode perf(server): skip IdleTrackingBackgroundService timer in stateless mode #1531 by @MukundaKatta
• Fix $ref pointer resolution after output-schema wrapping Fix $ref pointer resolution after output schema wrapping #1435 by @weinong
• Add McpClientOptions.InitializeMeta Add McpClientOptions.InitializeMeta to set _meta on the initialize request #1599 by @adityasingh2400
• Remove charset=utf-8 from HTTP application/json content types Fix: Remove charset=utf-8 from Content-Type: application/json in HTTP transport #1528 by @jayaraman-venkatesan
• Require Tool inputSchema during deserialization Require Tool inputSchema during deserialization #1600 by @DragonFSKY
• Release the SSE response stream reference when a GET request ends Release SSE response stream reference when GET request ends #1519 by @joelmforsyth
• Diagnose messages dropped from the GET SSE stream Add diagnostics for messages dropped on the GET SSE stream #1609 by @halter73
• Implement the SEP-2663 Tasks extension Implement SEP-2663 Tasks Extension #1579 by @PranavSenthilnathan (co-authored by @copilot)
• Add SEP-2549 caching hints to cacheable results Add SEP-2549 caching hints (ttlMs and cacheScope) to cacheable results #1623 by @tarekgh
• Accept any JSON Schema 2020-12 document as an output schema (SEP-2106) Relax outputSchema to any JSON Schema 2020-12 document per SEP-2106 #1568 by @jayaraman-venkatesan (co-authored by @mikekistler)
• Add MCP Apps extension support Add MCP Apps extension support (typed metadata, attribute, and helpers) #1484 by @mikekistler (co-authored by @copilot)
• Accumulate client scopes during step-up authorization (SEP-2350) Implementation for SEP-2350 Client-side scope accumulation in step-up authorization #1591 by @mikekistler (co-authored by @copilot @tarekgh)
• Obsolete Roots, Sampling, and Logging APIs per SEP-2577 Obsolete Roots, Sampling, and Logging surface area per SEP-2577 #1651 by @tarekgh
• Enable .NET Framework UI MCP clients Enable netfx UI MCP clients #1639 by @KirillOsenkov
• Use TimeToLive instead of TtlMs in public APIs Use TimeToLive (TimeSpan?) instead of TtlMs (long?) in public APIs #1644 by @PranavSenthilnathan (co-authored by @halter73 @copilot)
• Add sessionless and handshake-less draft protocol support Default draft protocol support: sessionless + handshake-less (SEP-2575 + SEP-2567) #1610 by @halter73
• Stabilize official Extensions, Tasks, and MRTR APIs Remove ExperimentalAttribute from official Extensions/Tasks/MRTR APIs and align MCPEXP001 usage #1642 by @PranavSenthilnathan (co-authored by @copilot)
• Finalize 2026-07-28 terminology, error codes, and protocol-version floors Follow-ups to #1610: de-draft 2026-07-28 terminology, renumber error codes, ProtocolVersion floor #1671 by @halter73
• Document caching behavior and warn on non-conformant cacheable results Document caching behavior and warn on non-conformant draft cacheable results (SEP-2549 follow-up) #1669 by @tarekgh
• Stabilize protocol properties Fully stabilize now-stable protocol properties #1686 by @eiriktsarpalis (co-authored by @copilot)
• Echo the request ID in post-parse Streamable HTTP errors Echo request id in post-parse Streamable HTTP error responses #1687 by @tarekgh
• Add DeferChangedEvents() for batched primitive-change notifications Add DeferChangedEvents() to McpServerPrimitiveCollection for batched change notifications #1689 by @jeffhandley (co-authored by @copilot)
• Fix request-scoped client capabilities Fix request-scoped draft client capabilities #1685 by @PranavSenthilnathan (co-authored by @copilot @tarekgh)
• Tighten protocol-negotiation boundaries Tighten draft protocol negotiation boundaries #1692 by @halter73 (co-authored by @copilot @tarekgh)
• Add the complete result discriminator Fix missing resultType on complete result responses #1684 by @PranavSenthilnathan (co-authored by @copilot @tarekgh)
• Ignore empty Streamable HTTP JSON responses fix: ignore empty Streamable HTTP JSON responses #1626 by @jstar0
• Extract Tasks into ModelContextProtocol.Extensions.Tasks Extract Tasks into the ModelContextProtocol.Extensions.Tasks extension package #1693 by @jeffhandley (co-authored by @copilot @tarekgh)
• Add an opt-out for the Streamable HTTP standalone GET stream Add opt-out for Streamable HTTP standalone GET stream #1699 by @jstar0 (co-authored by @jeffhandley @copilot)
• Enforce PKCE metadata compliance in the OAuth client Enforce PKCE metadata compliance in OAuth client (#730) #1700 by @PranavSenthilnathan
• Make authorization-provider token caches thread-safe Make auth provider token caches thread-safe (#1595) #1708 by @tarekgh
• Add application_type to dynamic client registration Add application_type to the Dynamic Client Registration request #1613 by @jayaraman-venkatesan
• Preserve the underlying status code in AutoDetect probes fix(client): preserve underlying status code in AutoDetect probe #1530 by @MukundaKatta
• Return a JSON-RPC parse error for over-nested stdio requests Reply with JSON-RPC parse error for over-nested stdio requests #1629 by @adityasingh2400 (co-authored by @tarekgh)
• Implement RFC 9207 issuer validation in ClientOAuthProvider Implement RFC 9207 issuer validation in ClientOAuthProvider #1605 by @mikekistler
• Reject mismatched initialize protocol versions Reject mismatched initialize protocol versions #1724 by @halter73 (co-authored by @copilot)
• Fix ClientOAuthProvider client ID availability on cold start Fix ClientOAuthProvider "Client ID is not available" on cold start #1705 by @halter73 (co-authored by @copilot)
• Fix HTTP Task filter composition Fix HTTP task filter composition #1722 by @PranavSenthilnathan
• Rename MCPEXP002 extensibility constants Rename MCPEXP002 Subclassing_* constants to Extensibility_* #1739 by @arimu1
• Propagate underlying SSE connection exceptions Fix: swallow _receiveTask exceptions in SseClientSessionTransport.CloseAsync #1432 by @xue-cai (co-authored by @copilot @jeffhandley)
• Validate OAuth authorization state Validate OAuth authorization state #1726 by @halter73 (co-authored by @copilot)
• Gate 2026-07-28 result fields on the negotiated protocol version Gate 2026-07-28 result fields on negotiated protocol version (#1721) #1753 by @tarekgh
• Align the 2026-07-28 wire with specification PR #3002 and SEP-2575 HTTP statuses Align the 2026-07-28 wire with spec PR #3002 and SEP-2575 HTTP statuses #1752 by @pcarleton (co-authored by @halter73 @copilot @tarekgh)
• Reauthorize tools changed by call-tool filters Reauthorize tools changed by call-tool filters #1737 by @PranavSenthilnathan

Documentation Updates

• Fix broken links to the MCP Tasks specification Fix broken links to MCP Tasks specification #1594 by @tarekgh
• Fix a broken Enterprise Managed Authorization specification link Fix broken link to Enterprise-Managed Authorization spec #1663 by @PranavSenthilnathan
• Update package READMEs as part of the release process Update package READMEs as part of the release process #1683 by @jeffhandley (co-authored by @copilot)
• Add Docker-based MCP server deployment guidance Augment conceptual docs with Docker-based MCP server deployment guidance #1423 by @john-mckillip
• Complete the v2 documentation edit pass V2 Edit pass #1728 by @gewarren
• Refine the 2.0.0 conceptual documentation Refine 2.0.0 concept documentation #1742 by @jeffhandley (co-authored by @copilot)

Test Improvements

• Fix the flaky AddIncomingMessageFilter_Multiple_Filters_Execute_In_Order test Fix flaky AddIncomingMessageFilter_Multiple_Filters_Execute_In_Order test #1627 by @tarekgh
• Add a synchronization point to ReadEventsAsync_InStreamingMode_YieldsNewlyWrittenEvents Fix flaky test: add sync point in ReadEventsAsync_InStreamingMode_YieldsNewlyWrittenEvents #1491 by @ericstj (co-authored by @copilot)
• Stabilize DiagnosticTests.Session_TracksActivities Fix flaky DiagnosticTests.Session_TracksActivities by waiting for full server activity predicate #1495 by @ericstj (co-authored by @copilot)
• Reduce absolute time dependencies in tests Reduce absolute time dependencies in tests #1649 by @PranavSenthilnathan
• Re-enable the http-custom-headers conformance scenario Re-enable http-custom-headers conformance scenario (#1655) #1691 by @tarekgh
• Run stateful and stateless conformance endpoints in one server process Run stateful and stateless conformance endpoints in a single server process #1672 by @halter73
• Expand npm conformance coverage Expand npm conformance coverage #1725 by @halter73
• Extend the in-memory server discovery timeout for Windows Debug CI Extend server/discover probe timeout in in-memory tests to fix flaky Windows Debug CI hang (#1701) #1702 by @PranavSenthilnathan (co-authored by @copilot @halter73)
• Add initial Tasks extension conformance coverage Add initial task extension conformance coverage #1734 by @PranavSenthilnathan (co-authored by @copilot)
• Resolve test-server paths deterministically Resolve test server paths deterministically #1735 by @PranavSenthilnathan
• Add MCP Apps to NativeAOT coverage Add MCP Apps to NativeAOT coverage #1711 by @lntutor (co-authored by @jeffhandley)
• Add MCP Apps _meta.ui serialization round-trip tests Add round-trip integration tests for MCP Apps _meta.ui serialization #1698 by @yayayouyou (co-authored by @jeffhandley)
• Enable complete Tasks extension conformance coverage Enable complete Tasks extension conformance coverage #1741 by @PranavSenthilnathan

Repository Infrastructure Updates

• Support release servicing branches in the release process Update release processes to support release servicing branches #1620 by @jeffhandley (co-authored by @copilot)
• Bump the version to 2.0.0-preview.1 Bump version to 2.0.0-preview.1 #1621 by @jeffhandley (co-authored by @copilot)
• Include release branches in CodeQL workflows Update CodeQL workflow to include release branches #1624 by @jeffhandley
• Remove a dangling Tool.Execution reference from the main build Fix main build: remove dangling Tool.Execution reference in BuildLegacyWireProtocolTool #1660 by @halter73
• Release v2.0.0-preview.2 Release v2.0.0-preview.2 #1695 by @jeffhandley (co-authored by @copilot)
• Release v2.0.0-preview.3 Release v2.0.0-preview.3 #1706 by @jeffhandley (co-authored by @copilot)
• Publish the multi-version documentation site Publish multi-version documentation site #1727 by @jeffhandley (co-authored by @copilot)
• Release v2.0.0-rc.1 Release v2.0.0-rc.1 #1738 by @jeffhandley (co-authored by @copilot)
• Bump actions/setup-node from 6.4.0 to 7.0.0 Bump actions/setup-node from 6.4.0 to 7.0.0 #1717
• Bump coverlet.collector from 10.0.0 to 10.0.1 Bump coverlet.collector from 10.0.0 to 10.0.1 #1582
• Bump qs from 6.14.2 to 6.15.2 Bump qs from 6.14.2 to 6.15.2 in the npm_and_yarn group across 1 directory #1597
• Bump actions/setup-dotnet from 5.2.0 to 6.0.0 Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #1716
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #1569
• Bump actions/checkout from 6 to 7 Bump actions/checkout from 6 to 7 #1665
• Bump the testing-frameworks dependency group Bump the testing-frameworks group with 1 update #1746
• Bump the serilog-testing dependency group Bump the serilog-testing group with 1 update #1748
• Bump actions/checkout from 7.0.0 to 7.0.1 Bump actions/checkout from 7.0.0 to 7.0.1 #1745
• Bump Anthropic from 12.17.0 to 12.39.0 Bump Anthropic from 12.17.0 to 12.39.0 #1750
• Bump OpenTelemetry and five other dependencies Bump OpenTelemetry and 5 others #1747
• Bump JsonSchema.Net and System.Linq.AsyncEnumerable Bump JsonSchema.Net and System.Linq.AsyncEnumerable #1749
• Update Microsoft.Extensions.AI dependencies Update Microsoft.Extensions.AI dependencies #1755 by @jeffhandley
• Release v2.0.0-rc.2 Release v2.0.0-rc.2 #1757 by @jeffhandley (co-authored by @copilot)
• Add AI disclosure guidance Add AI disclosure guidance #1756 by @PranavSenthilnathan

Acknowledgements

Community Stability Contributions

• @cclabadmin conducted detailed 2026-07-28 conformance testing against preview builds, reporting five issues with wire captures, exact repros, specification citations, and root-cause analysis: Streamable HTTP server accepts mismatched header/body protocol versions on initialize #1580, Stdio requests with deeply nested params can remain pending while the server remains healthy #1614, Draft protocol: complete result responses omit required resultType #1676, Draft protocol: HTTP header-validation errors return id: null after parsing the request id #1677, and Draft protocol: initialize can negotiate a modern protocol version #1680. The resulting fixes landed in Reject mismatched initialize protocol versions #1724, Reply with JSON-RPC parse error for over-nested stdio requests #1629, Fix missing resultType on complete result responses #1684, Echo request id in post-parse Streamable HTTP error responses #1687, and Tighten draft protocol negotiation boundaries #1692.
• @KirillOsenkov reported and helped diagnose three v2 stability issues with deterministic repros and source-level analysis: console-less .NET Framework clients failing over stdio (Unable to connect to MCP servers from netfx UI apps (e.g. WPF) #1638, fixed by Enable netfx UI MCP clients #1639), standalone SSE GET deadlocks under connection-pool pressure (Streamable HTTP: no opt-out for standalone SSE GET — handshake deadlocks under connection-pool pressure #1637, fixed by Add opt-out for Streamable HTTP standalone GET stream #1699), and OAuth client ID availability on cold start (ClientOAuthProvider throws "Client ID is not available" on cold start when a refresh token is persisted but client ID is not #1658, fixed by Fix ClientOAuthProvider "Client ID is not available" on cold start #1705).
• @KubaZ2 found the preview.3 regression that broke servers combining Tasks with HTTP transport (Exception when using Tasks with HTTP transport #1720), then validated the Fix HTTP task filter composition #1722 fix against rc.1 before release.
• @p-ob found and documented the preview.3 wire-compatibility regression that emitted 2026-07-28 result fields to down-level clients (bug(2.0.0-preview.3): resultType, ttlMs, and cacheScope emitted on all responses regardless of negotiated protocol version (breaks 2025-11-25 clients) #1721), directly enabling the release-blocking fix in Gate 2026-07-28 result fields on negotiated protocol version (#1721) #1753.
• @shmed reported both the AutoDetect status-code issue (AutoDetect transport hides the real error: surfaces 405 to the user when the server actually returned 415 #1526, fixed by fix(client): preserve underlying status code in AutoDetect probe #1530) and a production interoperability failure where the SDK's HTTP content type was rejected by GitHub Copilot's MCP endpoint (HttpClientTransport sends Content-Type: application/json; charset=utf-8`, which is rejected by spec-strict MCP servers (e.g. GitHub Copilot returns 415) #1527, fixed by Fix: Remove charset=utf-8 from Content-Type: application/json in HTTP transport #1528).
• @jwoo-msft provided a minimal repro and root-cause analysis showing that Tool.InputSchema silently masked malformed payloads (Tool.InputSchema silently defaults to {"type":"object"} when absent from JSON, masking missing required field #1575), leading to the required-field fix in Require Tool inputSchema during deserialization #1600.
• @mirusser pinpointed the missing path for setting _meta on initialize requests (McpClientOptions has no way to inject _meta into the initialize request #1593), leading to McpClientOptions.InitializeMeta in Add McpClientOptions.InitializeMeta to set _meta on the initialize request #1599.
• @DmitryLukyanov, with independent confirmation from @dimable, documented the empty HTTP response deserialization failure (Streamable HTTP transport doesn't correctly handle empty response #1132), fixed by fix: ignore empty Streamable HTTP JSON responses #1626.
• @mllab-nl identified the OAuth client's non-compliant PKCE metadata fallback (SDK Implementation of Authorization is not compatible with the specification. code_challenge_methods_supported is handled incorrectly #730), ultimately resolved by the strict S256 validation in Enforce PKCE metadata compliance in OAuth client (#730) #1700.
• @k8x10 supplied a self-contained repro and source-level root-cause analysis for double-wrapped Task results (Tool returning McpTask is double-wrapped when client sends task-augmented request #1480), informing the v2 Tasks redesign.
• @aaronpk corrected Enterprise Managed Authorization terminology in feat: Add Enterprise Managed Authorization (SEP-990) support #1305 to keep the SDK aligned with the authoritative OAuth specification work.

New Contributors

• @JBallan made their first contribution in Fix: Relax resource URI validation to accept base URL #1517.
• @aniket-okta made their first contribution in feat: Add Enterprise Managed Authorization (SEP-990) support #1305.
• @MukundaKatta made their first contribution in perf(server): skip IdleTrackingBackgroundService timer in stateless mode #1531.
• @weinong made their first contribution in Fix $ref pointer resolution after output schema wrapping #1435.
• @adityasingh2400 made their first contribution in Add McpClientOptions.InitializeMeta to set _meta on the initialize request #1599.
• @DragonFSKY made their first contribution in Require Tool inputSchema during deserialization #1600.
• @joelmforsyth made their first contribution in Release SSE response stream reference when GET request ends #1519.
• @KirillOsenkov made their first contribution in Enable netfx UI MCP clients #1639.
• @jstar0 made their first contribution in fix: ignore empty Streamable HTTP JSON responses #1626.
• @john-mckillip made their first contribution in Augment conceptual docs with Docker-based MCP server deployment guidance #1423.
• @lntutor made their first contribution in Add MCP Apps to NativeAOT coverage #1711.
• @arimu1 made their first contribution in Rename MCPEXP002 Subclassing_* constants to Extensibility_* #1739.
• @yayayouyou made their first contribution in Add round-trip integration tests for MCP Apps _meta.ui serialization #1698.
• @xue-cai made their first contribution in Fix: swallow _receiveTask exceptions in SseClientSessionTransport.CloseAsync #1432.
• @pcarleton made their first contribution in Align the 2026-07-28 wire with spec PR #3002 and SEP-2575 HTTP statuses #1752.

Additional Issue Reporters

• @hans1512 submitted issue OAuth Resource URI Validation Too Strict - Fails When MCP Server Uses Subpath #1119 (resolved by Fix: Relax resource URI validation to accept base URL #1517).
• @felixweinberger submitted issue Implement SEP-990: Enterprise Managed Authorization (Extension) #949 (resolved by feat: Add Enterprise Managed Authorization (SEP-990) support #1305).
• @chrisdoopboop submitted issue Invalid Content-Encoding: identity header in SSE responses (RFC 9110 violation) #1574 (resolved by Require Tool inputSchema during deserialization #1600).

Reviewers

• @halter73 @jeffhandley @tarekgh @PranavSenthilnathan @mikekistler @eiriktsarpalis @ericstj @jozkee @stephentoub @gewarren @jstar0 @luisquintanilla reviewed pull requests.

Full Changelog: v1.4.1...v2.0.0

---

Validation

• dotnet build succeeds with 0 warnings and 0 errors.
• dotnet test --no-build passes 10,835 tests across eight target-framework runs; 389 tests are skipped and 0 fail.
• dotnet pack --no-build creates all five stable 2.0.0 packages.

API Compatibility Report

Package validation against the 1.4.1 stable baseline succeeds with no compatibility diagnostics and no new suppressions. Existing intentional compatibility suppressions are unchanged.

API Diff Report

• ModelContextProtocol.Core: 237 added and 214 removed API lines. The stable-visible changes primarily cover discovery-first negotiation, multi-round-trip requests, caching and standard-header support, OAuth enhancements, and moving the experimental Tasks surface out of Core.
• ModelContextProtocol: no public API differences reported.
• ModelContextProtocol.AspNetCore: no public API differences reported.
• ModelContextProtocol.Extensions.Apps: new package with 61 added API lines.
• ModelContextProtocol.Extensions.Tasks: new package with 245 added API lines, replacing the experimental Tasks APIs shipped in Core in 1.4.1.

This pull request description was generated with GitHub Copilot.

[tarekgh]

Two minor points on the release notes, both non-blocking:

1. #1568 is listed under Breaking Changes (structured-content wire change), but the PR itself is not tagged with the breaking-change label. The note is correct; this is just label hygiene if you want the label set to match the section.

2. #1722, #1726, and #1752 carry the breaking-change label and appeared under Breaking Changes in the rc.2 notes, but they are not in the GA Breaking Changes section here. I believe this is intentional and correct: they are breaking only relative to intermediate previews/RCs, not to the 1.4.1 stable baseline (the Tasks, DiscoverResult, and OAuth callback APIs they touch are all new in v2). Just flagging that a reader upgrading from an RC would not see them called out, in case an "changed since rc.2" note is desired.

Everything else checks out: all 98 PRs merged between v1.4.1 and the release HEAD are listed, no fabricated entries, and the version/badge/baseline diff is correct.