Turn the ASP.NET Core Web API you already have into an MCP server

· Repo: https://github.com/hovik-aghajanyan/nabu.net

· Docs: https://nabu.aghajanyan.me/

· NuGet: https://www.nuget.org/packages/Nabu.Mcp.AspNetCore

Nabu.Mcp.AspNetCore publishes existing ASP.NET Core

[HttpGet("{id:guid}")]
[McpTool]                                   // <- that's it
public ActionResult<TodoItem> GetById(Guid id) => ...
js
app.MapGet("/customers/{id}", (int id) => ...)
   .McpTool();                              // <- same thing for Minimal APIs
js
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers();
builder.Services.AddNabuMcp(options =>
{
    options.ServerName = "my-api";
    options.RequireAuthorization = true;                    // protect the MCP endpoint itself
    options.ToolVisibility = McpToolVisibility.Authorized;  // advertise only what the caller may invoke
});

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.UseNabuMcp();          // serves MCP at /mcp
app.MapControllers();
app.Run();
curl -X POST http://localhost:5000/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tool descriptions come from your XML docs; input schemas are generated from your CLR types, data

annotations and nullability. [Authorize]

, policies and roles are enforced per call — the same action

that returns 403 over HTTP returns an isError

tool result over MCP for the same caller, and

tools/list

can show each caller only the tools it is actually allowed to invoke.

Direct method invocation quietly drops everything that makes an action safe: [Authorize]

is enforced

by middleware and filters, ModelState

is populated by model binding, rate limiting and exception

handling live outside the method. Nabu instead captures the app's RequestDelegate

at startup and pushes

a synthetic HttpContext

— carrying the caller's identity and forwarded credentials — through the full

pipeline for every tool call.

[McpTool]

repeatedly with different names, parameter subsets and pinned constants.tools/list

evaluated with your own authorization policies.Authorization

, Cookie

or proxy headers.Nabu.Mcp.ModelContextProtocol

serves the same tools through the official MCP C# SDK.📚 Full documentation: https://nabu.aghajanyan.me/