Merge branch 'main' of https://github.com/modelcontextprotocol/csharp-sdk into copilot/fix-binary-data-encoding

Author: ericstj

.github/workflows/ci-build-test.yml

@@ -16,6 +16,8 @@ on:
       - "*.props"
       - "Makefile"
       - "global.json"
+      - "package.json"
+      - "package-lock.json"
       - "src/**"
       - "tests/**"
       - "samples/**"
@@ -47,36 +49,24 @@ jobs:
           10.0.x
           9.0.x
 
-    # NetFX testing on non-Windows requires mono
-    - name: 🔧 Setup Mono
-      if: runner.os == 'Linux'
-      run: sudo apt-get install -y mono-devel
-
-    - name: 🔧 Setup Mono on macOS
-      if: runner.os == 'macOS'
-      run: brew install mono
-
     - name: 🔧 Set up Node.js
       uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
       with:
         node-version: '20'
 
-    - name: 📦 Install dependencies for tests
-      run: npm install @modelcontextprotocol/server-everything@2025.12.18
-
-    - name: 📦 Install dependencies for tests
-      run: npm install @modelcontextprotocol/server-memory
-
-    # Keep version in sync with McpConformanceVersion in Directory.Packages.props
-    - name: 📦 Install conformance test runner
-      run: npm install @modelcontextprotocol/conformance@0.1.10
+    - name: 📦 Install pinned npm dependencies for tests
+      run: npm ci
 
     - name: 🏗️ Build
       run: make build CONFIGURATION=${{ matrix.configuration }}
 
     - name: 🧪 Test
       run: make test CONFIGURATION=${{ matrix.configuration }}
 
+    - name: 🧪 AOT Compatibility
+      if: matrix.configuration == 'Release'
+      run: make test-aot CONFIGURATION=${{ matrix.configuration }}
+
     - name: 📦 Pack
       if: matrix.configuration == 'Release'
       run: make pack CONFIGURATION=${{ matrix.configuration }}

.gitignore

@@ -34,6 +34,9 @@ _ReSharper*/
 **/packages/*
 !**/packages/build/
 
+# npm
+node_modules/
+
 # MSTest test Results
 [Tt]est[Rr]esult*/
 [Bb]uild[Ll]og.*

Directory.Build.props

@@ -45,4 +45,10 @@
     <!-- Don't use x64 when running netfx test procs on Windows ARM -->
     <PreferNativeArm64>true</PreferNativeArm64>
   </PropertyGroup>
+
+  <PropertyGroup>
+    <!-- Shared target frameworks for test projects and test support projects. net472 is only included on Windows. -->
+    <DefaultTestTargetFrameworks>net10.0;net9.0;net8.0</DefaultTestTargetFrameworks>
+    <DefaultTestTargetFrameworks Condition="$([MSBuild]::IsOSPlatform('Windows'))">$(DefaultTestTargetFrameworks);net472</DefaultTestTargetFrameworks>
+  </PropertyGroup>
 </Project>

Directory.Packages.props

@@ -3,17 +3,16 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <System8Version>8.0.22</System8Version>
     <System9Version>9.0.11</System9Version>
-    <System10Version>10.0.2</System10Version>
-    <MicrosoftExtensionsVersion>10.2.0</MicrosoftExtensionsVersion>
-    <!-- Pin the conformance tester Node package version for CI stability.
-         Keep in sync npm install step at ci-build-test.yml -->
-    <McpConformanceVersion>0.1.10</McpConformanceVersion>
+    <System10Version>10.0.3</System10Version>
+    <MicrosoftExtensionsVersion>10.3.0</MicrosoftExtensionsVersion>
   </PropertyGroup>
 
   <!-- Product dependencies shared -->
   <ItemGroup>
     <PackageVersion Include="Microsoft.Extensions.AI" Version="$(MicrosoftExtensionsVersion)" />
     <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="$(MicrosoftExtensionsVersion)" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="$(System10Version)" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(System10Version)" />
   </ItemGroup>
@@ -63,8 +62,8 @@
 
   <!-- Testing dependencies -->
   <ItemGroup>
-    <PackageVersion Include="Anthropic" Version="12.2.0" />
-    <PackageVersion Include="coverlet.collector" Version="6.0.4">
+    <PackageVersion Include="Anthropic" Version="12.5.0" />
+    <PackageVersion Include="coverlet.collector" Version="8.0.0">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageVersion>
@@ -88,11 +87,11 @@
     <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageVersion Include="Serilog.Sinks.Debug" Version="3.0.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
-    <PackageVersion Include="Serilog" Version="4.3.0" />
+    <PackageVersion Include="Serilog" Version="4.3.1" />
     <PackageVersion Include="System.Linq.AsyncEnumerable" Version="$(System10Version)" />
     <PackageVersion Include="xunit.v3" Version="3.2.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
-    <PackageVersion Include="JsonSchema.Net" Version="8.0.5" />
+    <PackageVersion Include="JsonSchema.Net" Version="9.1.0" />
   </ItemGroup>
 </Project>

Makefile

@@ -30,6 +30,10 @@ test: build
 		-- \
 		RunConfiguration.CollectSourceInformation=true
 
+test-aot:
+	dotnet publish tests/ModelContextProtocol.AotCompatibility.TestApp/ModelContextProtocol.AotCompatibility.TestApp.csproj --configuration $(CONFIGURATION) -o $(ARTIFACT_PATH)/aot-publish
+	$(ARTIFACT_PATH)/aot-publish/ModelContextProtocol.AotCompatibility.TestApp
+
 pack: restore
 	dotnet pack --no-restore --configuration $(CONFIGURATION)
 

ModelContextProtocol.slnx

@@ -70,12 +70,14 @@
   </Folder>
   <Folder Name="/tests/">
     <Project Path="tests/ModelContextProtocol.Analyzers.Tests/ModelContextProtocol.Analyzers.Tests.csproj" />
+    <Project Path="tests/ModelContextProtocol.AotCompatibility.TestApp/ModelContextProtocol.AotCompatibility.TestApp.csproj" />
     <Project Path="tests/ModelContextProtocol.AspNetCore.Tests/ModelContextProtocol.AspNetCore.Tests.csproj" />
     <Project Path="tests/ModelContextProtocol.ConformanceClient/ModelContextProtocol.ConformanceClient.csproj" />
     <Project Path="tests/ModelContextProtocol.ConformanceServer/ModelContextProtocol.ConformanceServer.csproj" />
     <Project Path="tests/ModelContextProtocol.TestOAuthServer/ModelContextProtocol.TestOAuthServer.csproj" />
     <Project Path="tests/ModelContextProtocol.Tests/ModelContextProtocol.Tests.csproj" />
     <Project Path="tests/ModelContextProtocol.TestServer/ModelContextProtocol.TestServer.csproj" />
     <Project Path="tests/ModelContextProtocol.TestSseServer/ModelContextProtocol.TestSseServer.csproj" />
+    <Project Path="tests/ModelContextProtocol.ExperimentalApiRegressionTest/ModelContextProtocol.ExperimentalApiRegressionTest.csproj" />
   </Folder>
 </Solution>

SECURITY.md

@@ -1,14 +1,21 @@
 # Security Policy
-Thank you for helping us keep the SDKs and systems they interact with secure.
+
+Thank you for helping keep the Model Context Protocol and its ecosystem secure.
 
 ## Reporting Security Issues
 
-This SDK is maintained by [Anthropic](https://www.anthropic.com/) as part of the Model Context Protocol project.
+If you discover a security vulnerability in this repository, please report it through
+the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
+for this repository.
 
-The security of our systems and user data is Anthropic’s top priority. We appreciate the work of security researchers acting in good faith in identifying and reporting potential vulnerabilities.
+Please **do not** report security vulnerabilities through public GitHub issues, discussions,
+or pull requests.
 
-Our security program is managed on HackerOne and we ask that any validated vulnerability in this functionality be reported through their [submission form](https://hackerone.com/anthropic-vdp/reports/new?type=team&report_type=vulnerability).
+## What to Include
 
-## Vulnerability Disclosure Program
+To help us triage and respond quickly, please include:
 
-Our Vulnerability Program Guidelines are defined on our [HackerOne program page](https://hackerone.com/anthropic-vdp).
+- A description of the vulnerability
+- Steps to reproduce the issue
+- The potential impact
+- Any suggested fixes (optional)