ServiceStack.OrmLite.SqlServer

MCP Two-Phase Confirmation Tokens ​

The MCP Server's approval policy has been upgraded from a simple boolean ( RejectToolsRequiringApproval ) to a three-mode ApprovalMode enum:

Mode Behavior

ConfirmationToken New default. Write/destructive calls return a requires_confirmation response with a signed, short-lived token. The AI assistant presents the summary to the user for explicit confirmation, then re-invokes with the token. The server validates user identity, target API, payload hash, expiry and single-use replay before executing.

Reject Fail-closed - refuses any tool requiring interactive approval (the previous default).

DelegateToClient Executes immediately, relying on the MCP client's native confirmation dialog.

Mcp = { ToolGroups = ["api_tools"], // Default ApprovalMode = McpApprovalMode.ConfirmationToken, // Default ConfirmationTokenExpiry = TimeSpan.FromMinutes(5), // Default }

For production deployments, configure a shared SigningSecret (≥ 32 bytes) and register a distributed ICacheClient for cross-instance replay protection. See MCP Server - Approval for details.

The old RejectToolsRequiringApproval property is marked [Obsolete] and maps to Reject (true) or DelegateToClient (false).

[Mcp] Attribute for MCP-specific Descriptions ​

A new [Mcp(Description = ...)] attribute lets you provide imperative, agent-facing instructions for DTOs exposed over MCP - such as mandatory prerequisites or confirmation steps - without polluting the regular [Description] used by AI.Chat API Tools, API Explorers, Admin UIs and OpenAPI generators:

[Description("Submits and charges a coffee shop order.")] [Mcp(Description = """ Submits and charges a coffee shop order. IMPORTANT: Before calling this API you MUST first call PreviewCoffeeShopOrder, present the itemized summary and total price to the human customer verbatim, and WAIT for their explicit natural-language confirmation of both the items and the total in a subsequent user turn. """)] [Tool("the user wants to place an order", Safety = ToolSafety.Write, RequiresApproval = true)] public class CreateCoffeeShopOrder : IPost, IReturn<CreateCoffeeShopOrderResponse> { }

When set, MCP responses ( api_search , api_describe , confirmation summaries) prefer [MCP(Description)] over the regular [Description] . All non-MCP consumers continue to see the original [Description] .

Most MCP API Assistants can infer the need for confirmation from the MCP annotations, but some require explicit instructions to avoid circumventing the 2-phase confirmation without seeking explicit human approval. The [Mcp] attribute provides a way to communicate those instructions without affecting other consumers.

MCP-aware API Tool Responses ​

• api_search and api_describe now return MCP-flavored summaries when called over the MCP transport.

• api_call output schema includes confirmationToken , expiresInSeconds , summary and instruction fields for the two-phase flow.

• Empty args on parameterless APIs (e.g. IGet DTOs with no properties) now correctly emit {} instead of null to satisfy strict MCP schema validation.

Durable Agents ​

The motivation for this architectural upgrade came after extreme long-running agent workflows caused single thread message JSON payloads to grow past 200MB. This monolithic column approach eventually degraded database tooling (even causing database IDE JDBC drivers to run out of memory) and strained the browser DOM until the UI froze and crashed.

To scale reliably for complex autonomous tasks, the agent execution was re-architected into a durable, slice-based system that is significantly more responsive, memory-efficient, and resilient:

AI.Chat agents can now run complex, multi-step tasks that span many model and tool exchanges without being tied to a single browser request. You can close your browser, refresh the page, or lose connectivity mid-run and return to find the agent's progress exactly where it left off.

Resumable execution - Long tool-calling workflows no longer fail after hitting a fixed iteration limit. The agent works in resumable slices, checkpointing progress to the database between each one. A run can continue across hundreds of model exchanges with a configurable budget (default 250 steps).

Survives disconnects - Run state, elapsed time, context usage, errors, cancellation, and tool-approval waits are all persisted. A page refresh reconnects to the live run. A partial streaming response is isolated from committed history, so an interrupted stream never damages earlier messages.

Automatic context compaction - A context usage indicator shows how much of the selected model's window is in use. When it reaches ~80%, AI.Chat automatically summarizes older working context while preserving current instructions and a recent verbatim tail, then continues the same run. The full original conversation remains available for review. A manual compact button creates a clean child thread instead, leaving the original unchanged.

Windowed message loading - Threads with thousands of messages no longer block the UI. The chat view loads the first 20 and latest 100 messages initially; the middle is fetched on demand. The sidebar uses an authoritative database message count and a compact preview rather than downloading every conversation.

SSE with automatic fallback - Real-time updates are delivered over Server-Sent Events for lower latency. If SSE is unavailable through a proxy or host configuration, the browser automatically falls back to reliable long polling. No configuration is required - the default "auto" transport handles both.

Provider compatibility - Text-only and strict providers (e.g. GLM) receive a compatible projection of the conversation. Multipart attachments, orphaned tool results, and malformed legacy tool history are cleaned up in the outbound copy without rewriting canonical history, reducing provider failures in long-running sessions.

New core_tools for AI Agents ​

Added two essential, zero-dependency core tools to enable web resource reading and fast codebase exploration:

fetch_url

• Fetches HTTP/HTTPS URLs and converts HTML into clean, token-efficient Markdown.

• Automatically strips boilerplate, scripts, stylesheets, and navigation layouts ( <script> , <style> , <nav> , <footer> , <aside> , etc.).

• Accurately preserves headings, tables, code blocks, blockquotes, lists, emphasis, and hyperlinks (with relative URL resolution).

• Returns raw text for non-HTML content (JSON, plain text) and includes configurable length limits and response truncation.

grep_search

• Fast text and regular expression search across files and directory trees.

• Automatically prunes non-source and virtual environment directories ( .git , node_modules , bin , obj , .venv , dist , build , etc.) and ignores binary files.

• Supports file glob filtering (e.g. *.cs , *.py ), case-sensitivity options, and result capping with formatted relative path and line numbers.