Turn the ASP.NET Core Web API you already have into an MCP server

What is Nabu.NET?

Nabu.Mcp.AspNetCore turns existing ASP.NET Core controller actions and Minimal API route handlers into Model Context Protocol tools, so AI assistants and agents can call your API safely. It does not ask you to re-declare your endpoints, duplicate validation, or re-implement your security model.

A tool call is replayed as a real HTTP request through your application's own pipeline, so authentication, authorization policies, action filters, model binding, model validation, exception handlers and every other piece of middleware keep working exactly as they do today.

Why replay the pipeline?

The obvious way to bridge an API to MCP is to reflect over controllers and invoke action methods directly. That approach quietly drops everything that makes an ASP.NET Core action safe: [Authorize] is enforced by middleware and filters, not by the method body; ModelState is populated by model binding; rate limiting, tenant resolution and exception handling all live outside the method.

Nabu takes the other route. During startup it captures the fully built RequestDelegate at the very front of the pipeline. To run a tool it constructs a synthetic HttpContext for the target route — carrying the caller's identity, forwarded credentials, a fresh DI scope and a JSON body built from the tool arguments — and pushes it through that captured pipeline. Read more in Authentication & security.

60-second example

builder.Services.AddNabuMcp(options =>
{
    options.ServerName = "my-api";
    options.RequireAuthorization = true;
});

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.UseNabuMcp();          // serves MCP at /mcp
app.MapControllers();
app.Run();

Mark an action with [McpTool] and it appears in tools/list with a schema generated from its parameters and XML documentation. See the full walkthrough in Getting started.

Frequently asked questions