.NET: fix: mcp workflow isolation by baywet · Pull Request #9545 · microsoft/agent-framework

Vincent Biret (baywet) · 2026-10-19T19:20:26Z

dotnet part of the #8662 PR

Copilot

🟡 Changes recommended

Cache eviction can terminate unfinished workflows’ MCP sessions, breaking continuity and disrupting pending callers.

1 open issue

Retain MCP sessions until workflows fully complete · New

What changed in this PR

Implements the .NET portion of #8662, isolating declarative MCP sessions by workflow while preserving compatibility with existing handlers.

Changes:

Propagates workflow identity through execution contexts and subworkflows.
Adds workflow-scoped MCP caching, capacity limits, and coordinated cleanup.
Adds isolation, continuation, cancellation, and lifetime tests.

File	Description
dotnet/tests/Microsoft.Agents.AI.Workflows.UnitTests/RepresentationTests.cs	Tests subworkflow identity and checkpoint compatibility.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.UnitTests/PowerFx/WorkflowFormulaStateTests.cs	Tests persisted fallback identity.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.UnitTests/ObjectModel/InvokeMcpToolExecutorTest.cs	Tests scoped invocation and approval handling.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.UnitTests/Kit/RootExecutorTests.cs	Updates context setup.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.UnitTests/Kit/IWorkflowContextExtensionsTests.cs	Updates context creation helpers.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests/DefaultMcpToolHandlerTests.cs	Tests workflow-aware cache keys.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests/DefaultMcpToolHandlerLifetimeTests.cs	Tests cache capacity, concurrency, and cleanup.
dotnet/src/Microsoft.Agents.AI.Workflows/SubworkflowBinding.cs	Derives hierarchical session identifiers.
dotnet/src/Microsoft.Agents.AI.Workflows/Specialized/WorkflowHostExecutor.cs	Propagates child workflow identity.
dotnet/src/Microsoft.Agents.AI.Workflows/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt	Records session-context API.
dotnet/src/Microsoft.Agents.AI.Workflows/PublicAPI/net9.0/PublicAPI.Unshipped.txt	Records session-context API.
dotnet/src/Microsoft.Agents.AI.Workflows/PublicAPI/net8.0/PublicAPI.Unshipped.txt	Records session-context API.
dotnet/src/Microsoft.Agents.AI.Workflows/PublicAPI/net472/PublicAPI.Unshipped.txt	Records session-context API.
dotnet/src/Microsoft.Agents.AI.Workflows/PublicAPI/net10.0/PublicAPI.Unshipped.txt	Records session-context API.
dotnet/src/Microsoft.Agents.AI.Workflows/IWorkflowContext.cs	Defines optional session identity contract.
dotnet/src/Microsoft.Agents.AI.Workflows/InProc/InProcessRunnerContext.cs	Exposes identity through bound contexts.
dotnet/src/Microsoft.Agents.AI.Workflows/InProc/InProcessRunner.cs	Separates workflow and checkpoint identities.
dotnet/src/Microsoft.Agents.AI.Workflows/GroupChatManager.cs	Preserves identity through context wrappers.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt	Records scoped handler contract.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/PublicAPI/net9.0/PublicAPI.Unshipped.txt	Records scoped handler contract.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/PublicAPI/net8.0/PublicAPI.Unshipped.txt	Records scoped handler contract.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/PublicAPI/net472/PublicAPI.Unshipped.txt	Records scoped handler contract.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/PublicAPI/net10.0/PublicAPI.Unshipped.txt	Records scoped handler contract.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/ObjectModel/InvokeMcpToolExecutor.cs	Dispatches calls with workflow scope.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Kit/RootExecutor.cs	Creates session-aware contexts.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Kit/ActionExecutor.cs	Creates session-aware contexts.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Interpreter/DelegateActionExecutor.cs	Creates session-aware contexts.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Interpreter/DeclarativeWorkflowExecutor.cs	Creates session-aware contexts.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Interpreter/DeclarativeWorkflowContext.cs	Resolves and persists workflow identity.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Interpreter/DeclarativeActionExecutor.cs	Creates session-aware contexts.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/IMcpToolHandler.cs	Adds compatible scoped handler interface.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt	Records scoped invocation API.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/PublicAPI/net9.0/PublicAPI.Unshipped.txt	Records scoped invocation API.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/PublicAPI/net8.0/PublicAPI.Unshipped.txt	Records scoped invocation API.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/PublicAPI/net472/PublicAPI.Unshipped.txt	Records scoped invocation API.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/PublicAPI/net10.0/PublicAPI.Unshipped.txt	Records scoped invocation API.
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/DefaultMcpToolHandler.cs	Implements scoped caching and resource lifetimes.

_{Review effort: Balanced}

+                    clientToDispose = this._clients[idleNode.Value];
+                    this._clients.Remove(idleNode.Value);
+                    this._clientLru.Remove(idleNode);
+                    clientToDispose.Evicted = true;
+                    clientToDispose.DisposalClaimed = true;
+                    this._retiredClients.Add(clientToDispose);


github-code-quality · 2026-10-19T19:29:14Z

Code coverage overview

Languages: C#

C# / code-coverage/dotnet

main c01db29	fix/mcp-workflow-ses... 96cbf3c	+/-
86%	86%	0%

View coverage of the 8 most impacted files.

File	main c01db29	fix/mcp-workflow-ses... 96cbf3c	+/-
`/home/runner/wo...SessionStore.cs`	100%	53%	-47%
`/home/runner/wo...unnerContext.cs`	92%	92%	0%
`/home/runner/wo...kflowContext.cs`	81%	82%	+1%
`/home/runner/wo...pToolHandler.cs`	88%	91%	+3%
`/home/runner/wo...rocessRunner.cs`	91%	94%	+3%
`/home/runner/wo...pChatManager.cs`	61%	64%	+3%
`/home/runner/wo...HostExecutor.cs`	83%	86%	+3%
`/home/runner/wo...kflowBinding.cs`	90%	93%	+3%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

github-actions

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 96cbf3c5c41f
Model: gpt-5.6-sol

Overview

The PR propagates a framework-owned workflow session identifier into MCP caching and adds substantial concurrency, cancellation, disposal, provider-isolation, and credential-origin guardrails. The new bounded cache coalesces same-key creation and carefully drains active and retired clients. Residual risks remain for legacy workflow contexts that initialize identity through queued state, for stateful sessions evicted while their workflows are still live, and for unrelated tenants sharing the fixed active-session limit.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/DefaultMcpToolHandler.cs, dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Interpreter/DeclarativeWorkflowContext.cs

github-actions · 2026-10-19T19:31:36Z

+        string generatedSessionId = Guid.NewGuid().ToString("N");
+        string sessionId = source is IWorkflowSessionContext sessionContext
+            ? sessionContext.SessionId
+            : await source.ReadOrInitStateAsync(


For a legacy/custom IWorkflowContext that does not implement IWorkflowSessionContext, multiple declarative executors reaching this branch in one superstep each generate a different value. The IWorkflowContext contract permits initialization to be queued and warns that multiple executor initializations conflict, so this can split one workflow across MCP sessions or fail when state is published. Please make the workflow session ID an intrinsic shared runtime value, or require and propagate IWorkflowSessionContext, rather than deriving it through per-executor queued initialization.

github-actions · 2026-10-19T19:31:36Z

+                        throw new InvalidOperationException("MCP client capacity is exhausted; retry when an active invocation completes.");
+                    }
+
+                    clientToDispose = this._clients[idleNode.Value];


An idle client is only between calls; it does not mean its workflow session has ended. After 32 other keys are used, this evicts a still-live workflow's stateful MCP session, so its next tool call creates a fresh protocol session and silently loses server-side state. Please add a workflow-session completion/release lifecycle and evict only ended or expired scopes, or otherwise preserve continuity for live workflow sessions.

github-actions · 2026-10-19T19:31:36Z

+
+            if (!this._clientCreations.TryGetValue(clientCacheKey, out clientCreation))
+            {
+                if (this._clients.Count + this._retiredClients.Count + this._clientCreations.Count >= this._clientCacheMaxSize)


This fixed handler-wide quota lets 32 active distinct scopes consume every slot, after which unrelated workflows using a new session/server/header key fail immediately with InvalidOperationException until one call completes or is cancelled. Because the public constructor cannot tune or partition the limit, one tenant's slow MCP calls can deny MCP access to every other tenant sharing the handler. Please isolate capacity per tenant/workflow owner or add fair backpressure and a configurable limit so one tenant cannot exhaust the shared pool.

+    private readonly HashSet<CachedClient> _retiredClients = [];
+    private readonly Dictionary<string, OwnedHttpClient> _ownedHttpClients = [];
    private readonly SemaphoreSlim _clientLock = new(1, 1);
+    private readonly SemaphoreSlim _clientCreationSemaphore;


fix: mcp workflow isolation

96cbf3c

Vincent Biret (baywet) requested review from SergeyMenshykh, Eduard van Valkenburg (eavanvalkenburg), Evan Mattson (moonbox3), Roger Barreto (rogerbarreto) and westey (westey-m) as code owners October 19, 2026 19:20

Vincent Biret (baywet) self-assigned this Oct 19, 2026

Vincent Biret (baywet) requested a review from Peter Ibekwe (peibekwe) as a code owner October 19, 2026 19:20

Copilot AI balanced review requested due to automatic review settings October 19, 2026 19:20

Vincent Biret (baywet) deployed to github-app-auth October 19, 2026 19:20 — with GitHub Actions Active

Vincent Biret (baywet) deployed to integration October 19, 2026 19:20 — with GitHub Actions Active

agent-framework-automation Bot added .NET Usage: [Issues, PRs], Target: .Net workflows Usage: [Issues, PRs], Target: Workflows labels Oct 19, 2026

Vincent Biret (baywet) deployed to integration October 19, 2026 19:20 — with GitHub Actions Active

github-actions Bot changed the title ~~fix: mcp workflow isolation~~ .NET: fix: mcp workflow isolation Oct 19, 2026

Copilot started reviewing on behalf of Vincent Biret (baywet) October 19, 2026 19:21

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

github-actions Bot reviewed Oct 19, 2026

View reviewed changes

github-code-quality Bot found potential problems Oct 19, 2026

View reviewed changes

Navigation Menu

Repository navigation

.NET: fix: mcp workflow isolation - #9545

.NET: fix: mcp workflow isolation#9545
Vincent Biret (baywet) wants to merge 1 commit into
mainfrom
fix/mcp-workflow-session-isolation-dotnet

Vincent Biret (baywet) commented Oct 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-code-quality Bot commented Oct 19, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Oct 19, 2026

Uh oh!

github-actions Bot Oct 19, 2026

Uh oh!

github-actions Bot Oct 19, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Vincent Biret (baywet) commented Oct 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

github-code-quality Bot commented Oct 19, 2026

Code coverage overview

C# / code-coverage/dotnet

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

MAF Automated Review — Iteration 1

Overview

Uh oh!

github-actions Bot Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants