Migrate to ModelContextProtocol SDK 2.0 (MCP 2026-07-28 spec): stateless-by-default HTTP, deprecated-API audit, discovery-first negotiation

[erikdarlingdata]

Dependabot's weekly group (#1822) tried to take ModelContextProtocol + ModelContextProtocol.AspNetCore 1.4.1 -> 2.0.0 and demonstrated exactly why this major cannot ride a routine bump: the grouped update half-applied (bumped 3 csproj files while Lite and deprecated/Dashboard still pin 1.4.1 -> NU1605 downgrade conflicts, NU1004 lockfile inconsistencies across Darling.Tests/Viewer), and even a mechanically-clean bump would change runtime behavior on both MCP hosts. Filing this so the migration happens on purpose, on dev, with tests.

What 2.0.0 changes that touches this codebase

Both apps host MCP over ModelContextProtocol.AspNetCore (Darling: DarlingMcpHostService on :5152, LAN-exposable behind bearer token + in-app CIDR + HostHeaderGuard; Lite: loopback host with the same shared guard). Per the SDK 2.0.0 release notes:

1. Stateless HTTP is now the default (HttpServerTransportOptions.Stateless = true). Stateless servers create no transport sessions, do not expose the standalone SSE GET/DELETE endpoints, and cannot send unsolicited server-to-client requests. Decision needed: accept stateless (and verify every exposed tool works without session state), or explicitly set Stateless = false and accept the MCP9006 warnings on stateful-only options.
2. Discovery-first negotiation: clients probe server/discover before falling back to the legacy initialize handshake. The HostHeaderGuard and bearer middleware are installed FIRST in the pipeline (Security: MCP hosts lack a Host-header allowlist (DNS rebinding) - Darling + Lite #1648) - verify the new endpoint surface routes through the same guards, none of the new endpoints bypass them, and down-level clients still connect (release notes claim interop with 2025-11-25 and earlier peers).
3. Deprecated APIs (Roots, Sampling, Logging): audit both hosts and the shared tool plumbing for usage; migrate before the APIs disappear in a later major.
4. Caching hints / standardized headers / OAuth + token-cache changes: likely inert for bearer-token hosts, but confirm rather than assume.

Mechanical requirements for the bump itself

• ModelContextProtocol version must move in EVERY project that references it (Darling.Analysis, Darling.Service, PlanAnalysis, Lite, deprecated/Dashboard) in one commit - the half-bump is what broke Bump the nuget group with 2 updates #1822's restore.
• All packages.lock.json files regenerated together (locked-mode restore is the CI gate that caught it).
• The MCP surface pins (DarlingMcpServerAdminToolsTests, the get_alert_settings key-parity tests, HostHeaderGuard install-order pins) run green, plus a live connect from a real MCP client against both a stateless and (if we keep it) stateful configuration.

Sequencing

Deferred from routine bumps via the dependabot ignore rule (see the config PR referencing this issue). When this lands, remove the ignore rule so patch/minor SDK updates resume flowing through the weekly group.

[erikdarlingdata]

Shipped in #2004 (merged to dev) and dogfood-verified end-to-end on the production monitor:

• Nightly rebuilt on the SDK 2.0 packages; box upgraded (SHA verified, service back in 750ms, schema v48, 0 migrations, no errors).
• Live connect from a real MCP client (the issue's final checklist item): an agent session's existing darling-monitor connection reconnected against the upgraded stateless 2.0 host and reads normally — 52 servers listed, collections current to within two minutes of the restart.
• Pre-merge validation details in the PR: the real service ran on the 2.0 packages locally (initialize with no session header, all 89 tools listed sessionlessly, tools/call against the store, and the Security: MCP hosts lack a Host-header allowlist (DNS rebinding) - Darling + Lite #1648 DNS-rebinding guard rejecting a foreign Host with 400 ahead of the 2.0 discovery endpoints), plus the same hosting surface validated independently on Performance Studio (deps: Bump ModelContextProtocol and ModelContextProtocol.AspNetCore PerformanceStudio#422).
• The stateless "decision" turned out to be pre-decided: both hosts have run Stateless = true explicitly since MCP server doesn't expose tools in Google Antigravity #1074, so 2.0's default is a no-op here. No deprecated Roots/Sampling/Logging usage anywhere.
• The dependabot ignore rule deferring ModelContextProtocol* majors is removed per Dependabot: target dev, defer ModelContextProtocol majors to #1990 #1991 — SDK minors/patches resume flowing through the weekly group.