ECS2026 MCP Server

Conference demo repository for ECS 2026.

This repository contains a .NET 10 solution that demonstrates two MCP server security models:

• API key authentication
• Microsoft Entra ID (OAuth/JWT) authentication with policy-based authorization

The solution is optimized for conference demos: small, focused, and easy to inspect end-to-end.

Repository status

This repository is documentation/demo-only and is not intended for active feature development.

What Is Implemented In The Solution

The solution contains two .NET Aspire infrastructure projects and two MCP server projects. Only the MCP servers are described in detail below.

ECS2026.MCP.AppHost

.NET Aspire AppHost that orchestrates both MCP servers locally and exposes each through its own Dev Tunnel. See the Aspire AppHost docs and Aspire Dev Tunnels integration.

ECS2026.MCP.ServiceDefaults

Standard Aspire service-defaults project providing shared OpenTelemetry, health checks, service discovery, and resilient HttpClient configuration consumed by both MCP servers. See the Aspire service defaults docs.

ECS2026.MCP.ApiKey

Purpose: MCP server secured by custom API key authentication.

Implemented:

• Custom authentication handler reading X-Api-Key header
• Constant-time API key comparison to reduce timing attack leakage
• MCP endpoint protected with RequireAuthorization() using the default authenticated-user policy
• MCP server with one tool:
  • echo (returns a greeting that echoes the caller's input)
• Stateless MCP HTTP transport enabled
• CORS policy for development testing (AllowAnyOrigin/Header/Method)
• HTTPS redirection enforced in all environments
• OpenAPI endpoint available in Development

Why attendees care:

• Shows the simplest way to protect MCP tools for internal scenarios.
• Easy first step before implementing OAuth-based auth.

ECS2026.MCP.EntraID

Purpose: MCP server secured by Entra ID access tokens with scope/role policies.

Implemented:

• Authentication stack:
  • MCP challenge scheme (default challenge)
  • JWT bearer token validation via Microsoft.Identity.Web (default authenticate)
  • Token acquisition for downstream APIs with in-memory token cache
• Authorization policies (each binds the MCP and JwtBearer schemes and requires an authenticated user):
  • UseMCP (scope mcp.tools + role Default or Admin) — applied to the MCP endpoint
  • TellJokes (scope joke.tell)
  • AzureDevOps (scope devops.read)
  • AdminOnly (role Admin)
• Tools (registered on the MCP server):
  • who_am_i — returns greeting using the authenticated user's name (governed by UseMCP at the endpoint level)
  • who_am_i_as_admin — requires AdminOnly policy
  • do_blocked_action — used to demonstrate the governance deny rule
  • tell_joke — class-level [Authorize(Policy = "TellJokes")]; calls https://api.chucknorris.io via a named HttpClient ("JokeClient")
  • list_projects — requires AzureDevOps policy; calls Azure DevOps /{org}/_apis/projects on behalf of the user via Microsoft.Identity.Web DownstreamApi
• Agent governance integration (Microsoft.AgentGovernance + Microsoft.AgentGovernance.Extensions.ModelContextProtocol):
  • Policy file at Policies/mcp.yaml (loaded as policies/mcp.yaml)
  • Server name: mcp-server
  • Tool scanning on startup with fail-fast on unsafe tools
  • Response sanitization, fallback handler governance, prompt-injection detection, metrics, and audit all enabled
  • MCP authorization filters integrated via AddAuthorizationFilters()
• Adds optional agent-id request header as an agent_id claim formatted as did:mesh:{header-value} for governance decisions
• Stateless MCP HTTP transport enabled
• CORS policy for development testing (AllowAnyOrigin/Header/Method)
• HTTPS redirection enforc

... View full README on GitHub