Extensions and middleware for ModelContextProtocol in ASP.NET Core.
$ dotnet add package MCP.ExtensionsExtensions and middleware for ModelContextProtocol in ASP.NET Core.
This package provides useful middleware and extension methods for working with the ModelContextProtocol in ASP.NET Core applications. It is designed to help with request/response logging, audience filtering, and other common tasks when using ModelContextProtocol.
Key Feature: Audience-Based Segmentation - The McpAudienceAttribute and its streaming implementation allow you to efficiently segment your MCP server resources (tools, resources, prompts) by audience type. This enables a single MCP server to serve multiple client types with different permission levels, maximizing resource utilization while maintaining strict security boundaries.
📖 Read the Complete Guide for detailed information on audience segmentation, streaming implementation, benefits, and best practices.
This package is built against ModelContextProtocol SDK v0.4.0-preview.3.
[McpAudience] for declarative securityInstall via NuGet Package Manager:
dotnet add package MCP.Extensions
Or via the NuGet UI in Visual Studio.
Add the desired middleware to your ASP.NET Core pipeline in Startup.cs or Program.cs:
// Recommended: Use the unified audience filtering (includes tools, resources, and prompts)
builder.Services.AddMcpAudienceFiltering(Assembly.GetExecutingAssembly());
app.UseMcpAudienceFiltering();
// Optional: Debugging and logging middleware
app.UseMiddleware<HeaderLoggingMiddleware>();
app.UseMiddleware<RequestBodyLoggingMiddleware>();
app.UseMiddleware<ResponseBodyLoggingMiddleware>();
Use the [McpAudience] attribute to restrict tools, resources, or prompts to specific audiences:
[McpServerTool("admin_tool")]
[McpAudience("ADMIN")]
public async Task<Result> AdminOnlyTool()
{
// Only accessible to clients with X-AGENT-MODE: ADMIN
}
[McpServerResource("sensitive-data", UriTemplate = "data://sensitive/{id}")]
[McpAudience("FINANCE", "ADMIN")]
public async Task<Data> GetSensitiveData(string id)
{
// Only accessible to FINANCE and ADMIN audiences
}
For comprehensive guidance, examples, and best practices, see the Complete Guide.
MIT