Release v2.0.0-rc.1

[jeffhandley]

Release v2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!

Release Notes

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Remove the preview task-scope helper Fix HTTP task filter composition #1722

   • McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
   • There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.

2. Harden OAuth issuer validation Implement RFC 9207 issuer validation in ClientOAuthProvider #1605

   • AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
   • Migrate to AuthorizationCallbackHandler and return AuthorizationResult.

3. Require advertised PKCE S256 support Enforce PKCE metadata compliance in OAuth client (#730) #1700

   • Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
   • Correct the authorization-server metadata or use a compliant discovery document.

4. Send Dynamic Client Registration application types Add application_type to the Dynamic Client Registration request #1613

   • Unset ApplicationType now sends an inferred application_type instead of omitting it.
   • Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

• Require advertised PKCE S256 support Enforce PKCE metadata compliance in OAuth client (#730) #1700 by @PranavSenthilnathan (co-authored by @copilot)
• Make authorization-provider token caches thread-safe Make auth provider token caches thread-safe (#1595) #1708 by @tarekgh
• Send application_type in Dynamic Client Registration requests Add application_type to the Dynamic Client Registration request #1613 by @jayaraman-venkatesan (co-authored by @copilot)
• Preserve the original AutoDetect probe status code fix(client): preserve underlying status code in AutoDetect probe #1530 by @MukundaKatta
• Return JSON-RPC parse errors for over-nested stdio requests Reply with JSON-RPC parse error for over-nested stdio requests #1629 by @adityasingh2400
• Implement RFC 9207 issuer validation in ClientOAuthProvider Implement RFC 9207 issuer validation in ClientOAuthProvider #1605 by @mikekistler (co-authored by @halter73 @copilot)
• Reject mismatched initialize protocol versions Reject mismatched initialize protocol versions #1724 by @halter73 (co-authored by @copilot)
• Fix OAuth client-ID initialization on cold start Fix ClientOAuthProvider "Client ID is not available" on cold start #1705 by @halter73 (co-authored by @copilot)
• Fix HTTP task-filter composition Fix HTTP task filter composition #1722 by @PranavSenthilnathan (co-authored by @copilot)
• Add initial Tasks extension conformance coverage Add initial task extension conformance coverage #1734 by @PranavSenthilnathan (co-authored by @copilot)

Documentation Updates

• Publish a side-by-side, multi-version documentation site with selectable release/1.x (v1.4.1) and main (v2 preview) content Publish multi-version documentation site #1727 by @jeffhandley (co-authored by @copilot)
• Add Docker-based MCP server deployment guidance Augment conceptual docs with Docker-based MCP server deployment guidance #1423 by @john-mckillip (co-authored by @copilot)
• Improve v2 conceptual documentation clarity and consistency V2 Edit pass #1728 by @gewarren
• Improve v1 documentation clarity and consistency, and versioning updates Sanitize 1.x documentation #1729 by @jeffhandley (co-authored by @copilot)

Test Improvements

• Expand npm conformance coverage Expand npm conformance coverage #1725 by @halter73 (co-authored by @copilot)
• Extend the in-memory server/discover probe timeout to prevent flaky Windows Debug CI hangs Extend server/discover probe timeout in in-memory tests to fix flaky Windows Debug CI hang (#1701) #1702 by @PranavSenthilnathan (co-authored by @halter73 @copilot)

Acknowledgements

• @john-mckillip made their first contribution in Augment conceptual docs with Docker-based MCP server deployment guidance #1423
• @buvinghausen submitted issue Add client sample w/ guidance on wiring up dependency injection #147 (resolved by Augment conceptual docs with Docker-based MCP server deployment guidance #1423)
• @mllab-nl submitted issue SDK Implementation of Authorization is not compatible with the specification. code_challenge_methods_supported is handled incorrectly #730 (resolved by Enforce PKCE metadata compliance in OAuth client (#730) #1700)
• @shmed submitted issue AutoDetect transport hides the real error: surfaces 405 to the user when the server actually returned 415 #1526 (resolved by fix(client): preserve underlying status code in AutoDetect probe #1530)
• @cclabadmin submitted issues Streamable HTTP server accepts mismatched header/body protocol versions on initialize #1580 and Stdio requests with deeply nested params can remain pending while the server remains healthy #1614 (resolved by Reject mismatched initialize protocol versions #1724 and Reply with JSON-RPC parse error for over-nested stdio requests #1629)
• @KirillOsenkov submitted issue ClientOAuthProvider throws "Client ID is not available" on cold start when a refresh token is persisted but client ID is not #1658 (resolved by Fix ClientOAuthProvider "Client ID is not available" on cold start #1705)
• @KubaZ2 reported the critical, ship-stopping P0 Tasks/HTTP defect in Exception when using Tasks with HTTP transport #1720 (resolved by Fix HTTP task filter composition #1722)
• @gewarren submitted Edit pass on MCP docs dotnet/docs#54713 (resolved by V2 Edit pass #1728)
• @halter73 @jeffhandley @tarekgh @PranavSenthilnathan @luisquintanilla @mikekistler reviewed pull requests

Full Changelog: v2.0.0-preview.3...v2.0.0-rc.1

---

API Compatibility Report

dotnet pack --no-restore completed without ApiCompat warnings or errors against 1.3.0; no compatibility suppressions were added.

API Diff Report

ModelContextProtocol.Core

namespace ModelContextProtocol.Authentication
{
    public sealed class ClientOAuthOptions
    {
+       public Func<AuthorizationCallbackContext, CancellationToken, Task<AuthorizationResult>> AuthorizationCallbackHandler { get; set; }
    }
    public sealed class DynamicClientRegistrationOptions
    {
+       public string? ApplicationType { get; set; }
    }
    public sealed class TokenContainer
    {
-       public Nullable<int> ExpiresIn { get; set; }
+       public Nullable<int?>? ExpiresIn { get; set; }
-       public required DateTimeOffset ObtainedAt { get; set; }
+       public required DateTimeOffset? ObtainedAt { get; set; }
+       public string? ClientId { get; set; }
+       public string? ClientSecret { get; set; }
+       public string? TokenEndpointAuthMethod { get; set; }
    }
+   public sealed class AuthorizationCallbackContext
+   {
+       public AuthorizationCallbackContext();
+       public required Uri AuthorizationUri { get; init; }
+       public required Uri RedirectUri { get; init; }
+   }
+   public sealed class AuthorizationResult
+   {
+       public AuthorizationResult();
+       public string? Code { get; init; }
+       public string? Iss { get; init; }
+   }
}
namespace ModelContextProtocol.Protocol
{
    public sealed class JsonRpcMessageContext
    {
+       public string? RoutingName { get; set; }
    }
}
namespace ModelContextProtocol.Server
{
    public sealed class McpRequestFilters
    {
-       public IList<McpRequestFilter<CallToolRequestParams, ResultOrAlternate<CallToolResult>>> CallToolWithAlternateFilters { get; set; }
+       public IList<McpRequestInvocationFilter<CallToolRequestParams, ResultOrAlternate<CallToolResult>>> CallToolWithAlternateFilters { get; set; }
    }
    public abstract class McpServer : McpSession
    {
-       public IDisposable InterceptOutgoingRequests(Func<string, JsonNode, CancellationToken, ValueTask<JsonNode>> interceptor);
+       public McpServer WithOutgoingRequestInterceptor(Func<string, JsonNode, CancellationToken, ValueTask<JsonNode>> interceptor);
    }
    public sealed class McpServerRequestHandler
    {
+       public string? RoutingNameParameter { get; init; }
    }
+   public sealed class McpRequestInvocationFilter<TParams, TResult> { ... }
}

ModelContextProtocol

No direct public-surface changes.

ModelContextProtocol.AspNetCore

No direct public-surface changes.