Turn the ASP.NET Core Web API you already have into an MCP server

Hovik Aghajanyan released Nabu.Mcp.AspNetCore, an open-source library that turns existing ASP.NET Core Web APIs into Model Context Protocol (MCP) servers with minimal code changes. The library publishes controllers and minimal APIs as MCP tools, generating schemas from CLR types and enforcing authorization per call by pushing synthetic HttpContext through the full pipeline.

· Repo: https://github.com/hovik-aghajanyan/nabu.net https://github.com/hovik-aghajanyan/nabu.net · Docs: https://nabu.aghajanyan.me/ https://nabu.aghajanyan.me/ · NuGet: https://www.nuget.org/packages/Nabu.Mcp.AspNetCore https://www.nuget.org/packages/Nabu.Mcp.AspNetCore Nabu.Mcp.AspNetCore https://github.com/hovik-aghajanyan/nabu.net publishes existing ASP.NET Core HttpGet "{id:guid}" McpTool // <- that's it public ActionResult<TodoItem GetById Guid id = ... js app.MapGet "/customers/{id}", int id = ... .McpTool ; // <- same thing for Minimal APIs js var builder = WebApplication.CreateBuilder args ; builder.Services.AddControllers ; builder.Services.AddNabuMcp options = { options.ServerName = "my-api"; options.RequireAuthorization = true; // protect the MCP endpoint itself options.ToolVisibility = McpToolVisibility.Authorized; // advertise only what the caller may invoke } ; var app = builder.Build ; app.UseAuthentication ; app.UseAuthorization ; app.UseNabuMcp ; // serves MCP at /mcp app.MapControllers ; app.Run ; curl -X POST http://localhost:5000/mcp \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' Tool descriptions come from your XML docs; input schemas are generated from your CLR types, data annotations and nullability. Authorize , policies and roles are enforced per call — the same action that returns 403 over HTTP returns an isError tool result over MCP for the same caller, and tools/list can show each caller only the tools it is actually allowed to invoke. Direct method invocation quietly drops everything that makes an action safe : Authorize is enforced by middleware and filters, ModelState is populated by model binding, rate limiting and exception handling live outside the method. Nabu instead captures the app's RequestDelegate at startup and pushes a synthetic HttpContext — carrying the caller's identity and forwarded credentials — through the full pipeline for every tool call. McpTool repeatedly with different names, parameter subsets and pinned constants. tools/list evaluated with your own authorization policies. Authorization , Cookie or proxy headers. Nabu.Mcp.ModelContextProtocol serves the same tools through the official MCP C SDK.📚 Full documentation: https://nabu.aghajanyan.me/ https://nabu.aghajanyan.me/