InMemoryMcpTaskStorePlus, an IMcpTaskStorePlus that records who started a task and refuses tasks/get, tasks/update, and tasks/cancel from anyone else.
Authenticated tasks
Stamp the logged-in user on create. Isolate later manipulation to that user.
Choose a store
Database, distributed cache, and eventing. Entity Framework Core works with any EF provider.
Install
Why this exists
The SDKInMemoryMcpTaskStore is process-wide. Under stateless Streamable HTTP that is the right default for a single-purpose server. A multi-user remote MCP server needs one more rule: a client who can guess (or be handed) another user’s task id must not be able to poll, cancel, or complete that work.
Core owns the snapshots and keeps an owner on each one. HTTP hosts call AddHttpContextAccessor() and pass sp => sp.GetRequiredService<IHttpContextAccessor>().HttpContext?.User into WithTasksPlus. Stdio hosts pass a constant user id. Client-facing code that already has a principal calls IMcpTaskStorePlus overloads directly.
The Streamable HTTP sample is samples/CloudNimble.McpEssentials.Samples.Web.