This PR addresses issue modelcontextprotocol#714 by implementing a complete sample demonstrating how to vary the list of available tools/resources per user in an ASP.NET Core MCP server.

Problem

Users needed a way to provide different sets of MCP tools to different users based on their authentication and permissions, rather than having a static list of tools available to all users.

Solution

The sample showcases the technique described by @halter73 in issue modelcontextprotocol#714, using the ConfigureSessionOptions callback to dynamically modify the ToolCollection based on user permissions for each MCP session.

Key Features

Per-User Tool Filtering

• Anonymous users: 2 tools (echo, get_time)
• Regular users: 4 tools (adds calculate, get_user_info)
• Admin users: 7 tools (adds get_system_status, manage_config, view_audit_logs)

Implementation Highlights

The core technique uses ConfigureSessionOptions to filter tools per session:

builder.Services.AddMcpServer()
    .WithHttpTransport(options =>
    {
        options.ConfigureSessionOptions = async (httpContext, mcpOptions, cancellationToken) =>
        {
            var userRole = GetUserRole(httpContext);
            var toolCollection = mcpOptions.Capabilities?.Tools?.ToolCollection;
            
            if (toolCollection != null)
            {
                toolCollection.Clear();
                
                switch (userRole)
                {
                    case "admin":
                        AddToolsForType<PublicTool>(toolCollection);
                        AddToolsForType<UserTool>(toolCollection);  
                        AddToolsForType<AdminTool>(toolCollection);
                        break;
                    case "user":
                        AddToolsForType<PublicTool>(toolCollection);
                        AddToolsForType<UserTool>(toolCollection);
                        break;
                    default:
                        AddToolsForType<PublicTool>(toolCollection);
                        break;
                }
            }
        };
    })

Sample Structure

samples/AspNetCoreMcpServerPerUserTools/
├── Program.cs                 # Main server with per-user filtering logic
├── Tools/
│   ├── PublicTool.cs         # Tools available to all users
│   ├── UserTool.cs           # Tools for authenticated users
│   └── AdminTool.cs          # Admin-only tools
├── README.md                 # Comprehensive documentation
└── demo.sh                   # Interactive demonstration script

Authentication

Uses a simple header-based authentication system for easy testing:

# Admin user
curl -H "X-User-Role: admin" -H "X-User-Id: admin-john" \
     http://localhost:3001/

# Regular user  
curl -H "X-User-Role: user" -H "X-User-Id: user-alice" \
     http://localhost:3001/

Benefits

1. Security: Users only see tools they're authorized to use
2. Scalability: Per-session filtering doesn't affect other users
3. Flexibility: Easy to add new roles and permission levels
4. Maintainability: Clear separation between authentication and tool logic
5. Performance: Tools are filtered at session start, not per request

Testing

The sample includes comprehensive testing:

• Build verification with AOT compatibility
• Authentication endpoint testing
• MCP protocol tool listing verification
• Tool execution validation
• Interactive demo script

Production Guidance

The README includes detailed guidance for adapting the sample for production use, including:

• Replacing header-based auth with proper authentication (JWT, OAuth2, etc.)
• Adding authorization policies using ASP.NET Core's authorization framework
• Storing permissions in database instead of hardcoded role checks
• Adding caching, rate limiting, and other security measures

This sample provides a complete, working foundation for implementing per-user MCP tool/resource filtering in production applications.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.