MCP C# SDK 2.0 Makes HTTP Stateless by Default

Microsoft released version 2.0 of the official MCP C# SDK, implementing the 2026-07-28 Model Context Protocol revision. Streamable HTTP servers are now stateless by default, and Multi Round-Trip Requests (MRTR) let interactive tools ask clients for input. Releases 2.1 to 2.3 added hybrid session serving, a subscriptions/listen handler and several OAuth and discovery fixes.

Key points

• HttpServerTransportOptions.Stateless now defaults to true; servers that need sessions must set it to false
• The initialize handshake and Mcp-Session-Id are gone; protocol version and capabilities travel with each request
• tools/call requests carry Mcp-Method and Mcp-Name headers; [McpHeader] promotes parameters to Mcp-Param-* headers
• Tools needing user input throw InputRequiredException (MRTR); roots, sampling and logging APIs are deprecated under MCP9005
• Tasks moved to the opt-in ModelContextProtocol.Extensions.Tasks package and conflicts with the experimental 1.3 and 1.4 versions
• Since 2.3, McpClient.ServerInfo is nullable, a source-breaking change to check when upgrading

Microsoft has shipped version 2.0 of the official MCP C# SDK as stable. It implements the 2026-07-28 revision of the Model Context Protocol and changes how MCP behaves over HTTP. The initialize handshake and the Mcp-Session-Id header are removed, and protocol version and capabilities now accompany each request, so any server instance can serve any call without sticky routing. HttpServerTransportOptions.Stateless defaults to true, and servers that need sessions must opt out.

Tool calls now carry routing headers, and parameters marked with an attribute can be copied into headers, letting load balancers route without parsing bodies. Because the server can no longer hold a channel open, a tool that needs user input throws an exception describing the requests it needs, and the client answers and retries the call. Stable 1.x APIs still work, though Tasks moved to a separate opt-in package. Later 2.x releases add session modes, OAuth tightening and fixes; check the release notes before upgrading.

Real-world use

• An MCP server running behind several instances and load balancers without sticky sessions
• An interactive ASP.NET Core tool that asks the user for confirmation or extra input mid-call
• A gateway that routes MCP traffic by Mcp-Method or Mcp-Param headers without reading request bodies

Why it matters

If your MCP server keeps state in sessions, the new stateless default changes behaviour and needs an explicit opt-out. Review session usage, OAuth settings and any dependence on ServerInfo before upgrading.

Related stories

• Faking a Yes: 6 Attacks on the Human Confirmation in a .NET 10 MCP ServerDVDEV Community: #dotnet2 d ago
• A secure enterprise chat with React, .NET 10 and Microsoft FoundryDVDEV Community: #dotnet1 d ago
• A reusable Claude Code skill for reviewing ASP.NET Core endpoint changesDLNick Cosentino (Dev Leader)3 d ago