Update MCP packages to 1.0.0 and bump all .NET 10.0 packages to 10.0.3

[Copilot]

Description

Updates ModelContextProtocol and ModelContextProtocol.AspNetCore from 0.8.0-preview.1 to 1.0.0, and bumps all .NET 10.0 package versions from 10.0.2 to 10.0.3.

Package & dependency changes:

• Bump MCP packages to 1.0.0 in Directory.Packages.props
• Bump all .NET 10.0 package versions from 10.0.2 → 10.0.3 in eng/Versions.props, including EF Core, ASP.NET Core, Runtime, and other .NET 10.0 packages (Microsoft.Extensions.FileSystemGlobbing, Microsoft.EntityFrameworkCore.*, Microsoft.AspNetCore.*, Microsoft.Extensions.*, System.Text.Json, System.Formats.Asn1)

Breaking API migration:

• AddListToolsFilter/AddCallToolFilter removed from IMcpServerBuilder — migrated to WithRequestFilters(filters => ...) pattern in McpExtensions.cs:

// Before (0.8.0)
builder.AddListToolsFilter((next) => async (request, ct) => { ... })
       .AddCallToolFilter((next) => async (request, ct) => { ... });

// After (1.0.0)
builder.WithRequestFilters(filters => filters
    .AddListToolsFilter((next) => async (request, ct) => { ... })
    .AddCallToolFilter((next) => async (request, ct) => { ... }));

Test updates:

• MCP 1.0.0 Streamable HTTP transport rejects non-initialize requests without a session ID (returns 400). Updated Dashboard integration tests to perform the initialize → notifications/initialized handshake before sending tools/list requests.
• Refactored InitializeSessionAsync to accept an optional Action<HttpRequestMessage>? configureRequest callback, and updated CallService_McpEndPoint_RequiredApiKeySent_Success to use it instead of duplicating the handshake code inline.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
  • No
• Does the change require an update in our Aspire docs?
  • Yes
  • No

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[JamesNK]

@copilot Update all the .NET 10.0 Package Versions from 10.0.2 to 10.0.3

[Copilot]

@copilot Update all the .NET 10.0 Package Versions from 10.0.2 to 10.0.3

Done in caaa395. Updated all 21 remaining .NET 10.0 package versions from 10.0.2 to 10.0.3 in eng/Versions.props — covering EF Core, ASP.NET Core, Runtime, and MicrosoftExtensionsFileSystemGlobbingVersion. Full repo build passes with 0 warnings/errors.

[JamesNK]

@copilot Why doesn't CallService_McpEndPoint_RequiredApiKeySent_Success use InitializeSessionAsync to reduce code duplicaiton?

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14786

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14786"

[Copilot]

Pull request overview

This PR updates the ModelContextProtocol and ModelContextProtocol.AspNetCore packages from 0.8.0-preview.1 to the stable 1.0.0, and bumps all .NET 10.0 preview package versions from 10.0.2 to 10.0.3. It adapts the dashboard MCP integration to MCP 1.0.0's breaking API changes (filter registration pattern change, new Streamable HTTP session handshake requirement).

Changes:

• Package bumps: MCP packages to 1.0.0, .NET 10.0 packages to 10.0.3 in eng/Versions.props and Directory.Packages.props.
• MCP filter API migration: Migrate from builder.AddListToolsFilter(...).AddCallToolFilter(...) to builder.WithRequestFilters(filters => filters.AddListToolsFilter(...).AddCallToolFilter(...)) in McpExtensions.cs.
• Test updates: Add InitializeSessionAsync / CreateInitializeRequest helpers and update all integration tests to perform the initialize → notifications/initialized handshake before sending tools/list, as required by MCP 1.0.0 Streamable HTTP.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Directory.Packages.props	Bumps ModelContextProtocol and ModelContextProtocol.AspNetCore to 1.0.0
eng/Versions.props	Bumps MicrosoftExtensionsFileSystemGlobbingVersion and all .NET 10.0 package versions from 10.0.2 to 10.0.3
src/Aspire.Dashboard/Mcp/McpExtensions.cs	Migrates filter registration from direct builder.AddListToolsFilter/AddCallToolFilter to builder.WithRequestFilters(...) per MCP 1.0.0 API
tests/Aspire.Dashboard.Tests/Integration/McpServiceTests.cs	Adds CreateInitializeRequest / InitializeSessionAsync helpers; updates all success-path tests to initialize a session before tools/list; CreateListToolsRequest now accepts an optional session ID
tests/Aspire.Dashboard.Tests/Integration/StartupTests.cs	Updates the shared-endpoint test to use InitializeSessionAsync before calling CreateListToolsRequest

[Copilot]

@copilot Why doesn't CallService_McpEndPoint_RequiredApiKeySent_Success use InitializeSessionAsync to reduce code duplicaiton?

Good catch — it should. Fixed in f4b1c7c. Added an optional Action<HttpRequestMessage>? configureRequest parameter to InitializeSessionAsync and refactored CallService_McpEndPoint_RequiredApiKeySent_Success to use it, removing ~30 lines of duplicated handshake code.