I've updated the sample as per @halter73 's suggestion to use route as the criteria instead of a header - to avoid any confusion with the mechanisms provided by the upcoming authorization convenience. The sample should show how to use arbitrary criteria to modify the Tools collection in the ConfigureSessionOptions delegate.

@halter73

Applied your suggested changes to start from an empty list without clearing, but hadn't noticed that this means the capability isn't initialized when configuring the session options. To make the sample reasonably simply, I added this back rather than manually configure the capability.

I could change it to add a basic tool that's always there, but that might add more confusion than benefit.

I could change it to add a basic tool that's always there, but that might add more confusion than benefit.

I think the better bet is to manually initialize the capabilities. That way, the ConfigureSessionOptions callback doesn't need to null-check it either making it slightly shorter while also getting rid of all the WithTools calls. I'd also just index into RouteValues directly and call ToLower() inline. I it's easier to see what's going on at a glance that way.

        // Configure per-session options to filter tools based on route category
        options.ConfigureSessionOptions = async (httpContext, mcpOptions, cancellationToken) =>
        {
            var toolCategory = httpContext.Request.RouteValues["toolCategory"]?.ToString()?.ToLower() ?? "all";

            // Get pre-populated tools for the requested category
            if (toolDictionary.TryGetValue(toolCategory, out var tools))
            {
                mcpOptions.Capabilities = new();
                mcpOptions.Capabilities.Tools = new();
                var toolCollection = mcpOptions.Capabilities.Tools.ToolCollection = new();

                foreach (var tool in tools)
                {
                    toolCollection.Add(tool);
                }
            }
        };

@jozkee Is looking at moving where we put the [JsonIgnore]'d properties on the capabilities types like the collections and handlers so they aren't so deeply nested which could make this look even nicer.

Another thing that might help tighten this up is just removing the OpenTelemetry dependencies from this sample. I think it's enough to leave that in the AspNetCoreMcpServer sample and keep this one a little more focused on the per-session options.