Make RunSessionHandler experimental and revisit design

[halter73]

The line to resolve services from the HttpContext here is unsafe because it comes from the initialize request that normally has already completed. I also think there's an issue where if you write a RunSessionHandler intentionally to complete early, it does not forcibly end the session. At the same time, having access to the HttpContext when a session starts before you call McpServer.RunAsync could be useful, so I don't want to prevent people from doing that in 1.0

For these reasons, and because we want to release 1.0, I think we should make the RunSessionHandler API experimental. We might have to delete it and replace it with something else. In some cases ConfigureSessionOptions might be the better option, so we should suggest that in the experimental warning. We should also mention that the API may be deleted or change signatures.

https://github.com/mikekistler/mcp-whats-new/blob/234486bf76fb917919ebc936424f00269eabb0f9/StreamResumability/server/Program.cs#L28

    .WithHttpTransport(options =>
    {
        // Use RunSessionHandler to clean up streams when a session ends
        options.RunSessionHandler = async (httpContext, mcpServer, cancellationToken) =>
        {
            try
            {
                await mcpServer.RunAsync(cancellationToken);
            }
            finally
            {
                // Delete all streams associated with this session when it ends
                if (!string.IsNullOrEmpty(mcpServer.SessionId))
                {
                    var eventStreamStore = httpContext.RequestServices.GetRequiredService<SessionTrackingEventStreamStore>();
                    await eventStreamStore.DeleteStreamsForSessionAsync(mcpServer.SessionId);
                }
            }
        };

[dagirard]

@halter73, in Dynamics 365 Business Central, we rely a quite lot on RunSessionHandler to map our own product session to the MCP session, and actually we had to create middlewares to capture that first request and do some initialization in there (then pass it down the RunSessionHandler through a DI container)

We can have a chat about it. Thanks though for not changing that for v1.0 :)

[glen-84]

How do we access the McpServer now? We are currently doing this:

var mcpServers = new ConcurrentDictionary<string, McpServer>();

options.RunSessionHandler = async (_, mcpServer, token) =>
{
    if (mcpServer.SessionId == null)
    {
        // There is no sessionId if serverOptions.Stateless is true.
        await mcpServer.RunAsync(token);
        return;
    }

    try
    {
        mcpServers[mcpServer.SessionId] = mcpServer;
        await mcpServer.RunAsync(token);
    }
    finally
    {
        // This code runs when the session ends.
        mcpServers.TryRemove(mcpServer.SessionId, out var _);
    }
};

We are then able to send notifications to the active servers.

[glen-84]

@halter73 Are you able to assist?

[halter73]

I responded in #1416. Tl;dr: keep doing what you are doing for now. We won't delete it without an alternative unless protocol-level sessions are removed entirely.