Access to HttpContext within handler delegates like ListToolsHandler for authentication-aware logic

[max529]

Is your feature request related to a problem? Please describe.
I'm currently working with the Model Context Protocol in .NET and would like to dynamically filter the tools returned by the ListToolsHandler based on the current user's authentication context. However, it doesn't seem possible to access the current HTTP context inside the ListToolsHandler or similar delegate handlers. This limits the ability to tailor tool availability based on user identity or permissions.

Describe the solution you'd like
I would like to be able to access the current HttpContext (or any equivalent user context) from within handlers like ListToolsHandler, CallToolHandler, etc. This would allow implementing features like per-user tool availability or custom authorization logic.

Describe alternatives you've considered
I haven't found a clear alternative to accessing the HTTP context directly from these handlers. Most approaches seem like workarounds and don't offer a clean or reliable way to integrate authentication data.

[KitsKlip]

Also looking into this feature.
As an option we pass header values in the request to set a few option (basically authorization). Then we created a custom ListTool handler.

The list tool handler works fine but the HttpContext is lost as a new scope is created here
https://github.dev/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.Core/Server/RequestContext.cs on line.

With middleware we can capture some of the details and keep it in memory. But in the custom ListTool handler there is no way to identify the specific request to recapture the values collected in the middleware

Would be great if the there is a way to identify the actual Mcp-session-id of the request in the custom handler, or the HttpContext

[KitsKlip]

Found a hackey way to get around this with the link that cege7480 provided (#365).

This is not ideal but at least we can test a possible way of limiting tools based on some sort of Authorization..

`builder.Services.AddMcpServer()
	 .WithHttpTransport(options =>
	 {
		 options.ConfigureSessionOptions = async (httpContext, mcpServerOptions, cancellationToken) =>
		 {
			 var sessionId = httpContext.Response.Headers[McpSessionContext.McpSessionIdHeader];
			 if (string.IsNullOrWhiteSpace(sessionId))
				 return;
			 
			 mcpServerOptions.KnownClientInfo = new ImplementationWitContext()
			 {
				 Name = mcpServerOptions.KnownClientInfo?.Name ?? "Unknown",
				 Version = mcpServerOptions.KnownClientInfo?.Version ?? "1.0.0",
				 SessionId = sessionId.ToString()
			 };
			 await McpSessionContext.SetSession(sessionId!, httpContext);
		 };
	 })
	.WithCallToolHandler(Handlers.CallToolHandler)
	.WithListToolsHandler(Handlers.ListToolHandler);`

Create new class with some additional property where we can store the session Id

`public sealed class ImplementationWitContext : Implementation
{
	public string SessionId { get; init; } = string.Empty;
}`

Then in the handler:

public static Func<RequestContext<ListToolsRequestParams>, CancellationToken, ValueTask<ListToolsResult>> ListToolHandler => (request, cancellationToken) => { if (request.Server.ServerOptions.KnownClientInfo is ImplementationWitContext clientInfo) { var session = McpSessionContext.GetCurrentSession(clientInfo.SessionId); } .....

Some static or singleton class to keep some session information

` public static class McpSessionContext
    {
    	private static ConcurrentDictionary<string, McpSession> _cache = new();//TODO: This should be cache
    
    	public static async Task SetSession(string sessionId, HttpContext context)
    	{
    		if (string.IsNullOrWhiteSpace(sessionId))
    			return;
    
    		if (_cache.ContainsKey(sessionId))
    		{
    			var body = await GetRequestBodyAsync(context);
    			_cache[sessionId].BodyHistory.Add(new McpSessionHistory(body));
    			return;
    		}
    
    		var session = new McpSession
    		{
    			SessionId = sessionId,
    			Data = context.Request.Headers.ToDictionary()
    		};
    
    		_cache[sessionId] = session;
    	}
    	public static McpSession? GetCurrentSession(string sessionId)
    		=> _cache.Where(kv => kv.Key.Equals(sessionId, StringComparison.OrdinalIgnoreCase)).Select(kv => kv.Value).FirstOrDefault();`

Would be great if there is a more 'native' way to accomplish this