v2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Remove the preview task-scope helper #1722

   • McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
   • There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.

2. Harden OAuth issuer validation #1605

   • AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
   • Migrate to AuthorizationCallbackHandler and return AuthorizationResult.

3. Require advertised PKCE S256 support #1700

   • Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
   • Correct the authorization-server metadata or use a compliant discovery document.

4. Send Dynamic Client Registration application types #1613

   • Unset ApplicationType now sends an inferred application_type instead of omitting it.
   • Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

• Require advertised PKCE S256 support #1700 by @PranavSenthilnathan (co-authored by @Copilot)
• Make authorization-provider token caches thread-safe #1708 by @tarekgh
• Send application_type in Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)
• Preserve the original AutoDetect probe status code #1530 by @MukundaKatta
• Return JSON-RPC parse errors for over-nested stdio requests #1629 by @adityasingh2400
• Implement RFC 9207 issuer validation in ClientOAuthProvider #1605 by @mikekistler (co-authored by @halter73 @Copilot)
• Reject mismatched initialize protocol versions #1724 by @halter73 (co-authored by @Copilot)
• Fix OAuth client-ID initialization on cold start #1705 by @halter73 (co-authored by @Copilot)
• Fix HTTP task-filter composition #1722 by @PranavSenthilnathan (co-authored by @Copilot)
• Add initial Tasks extension conformance coverage #1734 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

• Publish a side-by-side, multi-version documentation site with selectable release/1.x (v1.4.1) and main (v2 preview) content #1727 by @jeffhandley (co-authored by @Copilot)
• Add Docker-based MCP server deployment guidance #1423 by @john-mckillip (co-authored by @Copilot)
• Improve v2 conceptual documentation clarity and consistency #1728 by @gewarren
• Improve v1 documentation clarity and consistency, and versioning updates #1729 by @jeffhandley (co-authored by @Copilot)

Test Improvements

• Expand npm conformance coverage #1725 by @halter73 (co-authored by @Copilot)
• Extend the in-memory server/discover probe timeout to prevent flaky Windows Debug CI hangs #1702 by @PranavSenthilnathan (co-authored by @halter73 @Copilot)

Acknowledgements

• @john-mckillip made their first contribution in #1423
• @buvinghausen submitted issue #147 (resolved by #1423)
• @mllab-nl submitted issue #730 (resolved by #1700)
• @shmed submitted issue #1526 (resolved by #1530)
• @cclabadmin submitted issues #1580 and #1614 (resolved by #1724 and #1629)
• @KirillOsenkov submitted issue #1658 (resolved by #1705)
• @KubaZ2 reported the critical, ship-stopping P0 Tasks/HTTP defect in #1720 (resolved by #1722)
• @gewarren submitted dotnet/docs#54713 (resolved by #1728)
• @halter73 @jeffhandley @tarekgh @PranavSenthilnathan @luisquintanilla @mikekistler reviewed pull requests

Full Changelog: v2.0.0-preview.3...v2.0.0-rc.1