This PR addresses the feedback from @halter73 in modelcontextprotocol#724 by refactoring the sample to avoid pseudo-authentication patterns and instead demonstrate route-based tool filtering using the MCP SDK's ConfigureSessionOptions capability.

Key Changes

Sample Renamed

• From: AspNetCoreMcpServerPerUserTools
• To: AspNetCoreMcpPerSessionTools

Authentication Approach Replaced

The sample previously used header-based pseudo-authentication which could be confusing and fragile. Following @halter73's suggestion, it now uses route-based tool category selection:

Before (header-based):

curl -H "X-User-Role: admin" https://localhost:5001/mcp

After (route-based):

# Connect to different endpoints for different tool sets
https://localhost:5001/clock      # Clock tools only
https://localhost:5001/calculator # Calculator tools only  
https://localhost:5001/userinfo   # Session info tools only

Tool Categories Redesigned

Replaced role-based tools with functional categories as suggested:

• Clock Tools (/clock): Time and date operations (GetTime, GetDate, ConvertTimeZone)
• Calculator Tools (/calculator): Mathematical operations (Calculate, CalculatePercentage, SquareRoot)
• UserInfo Tools (/userinfo): Session and system information (GetSessionInfo, GetSystemInfo, EchoWithContext)

Route-Based Implementation

The sample now uses MapMcp("/{toolCategory?}") and filters tools based on route parameters:

options.ConfigureSessionOptions = async (httpContext, mcpOptions, cancellationToken) =>
{
    var toolCategory = GetToolCategoryFromRoute(httpContext);
    var toolCollection = mcpOptions.Capabilities?.Tools?.ToolCollection;
    
    switch (toolCategory?.ToLower())
    {
        case "clock":
            AddToolsForType<ClockTool>(toolCollection);
            break;
        case "calculator":
            AddToolsForType<CalculatorTool>(toolCollection);
            break;
        // ...
    }
};

Benefits

• Eliminates Auth Confusion: No more pseudo-authentication that could mislead developers
• Easy Testing: Simple URL-based testing without managing headers or tokens
• Clear Tool Separation: Functional categories make the purpose of each tool set obvious
• Production Foundation: Demonstrates a pattern that can be extended for real-world scenarios

This implementation maintains the educational value of demonstrating per-session tool filtering while addressing the concerns about authentication patterns in samples.

Testing

The sample includes test endpoints to verify route detection:

• /test-category/clock - Verify clock category detection
• /test-category/calculator - Verify calculator category detection
• /test-category/userinfo - Verify userinfo category detection

Fixes the concerns raised in modelcontextprotocol#724 while preserving the core demonstration of ConfigureSessionOptions for per-session tool filtering.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.