How I Built a C# MCP Server with Single-Use Order Approvals

Building a C# MCP Server for Single-Use Order Approvals involved creating a small .NET 8 MCP server called dotnet-mcp-orders-server that exposes fictional orders with list, lookup, and cancellation tools over stdio. To ensure proper authorization, cancellation requires an independently recorded approval with a five-minute expiration time.

The project includes 12 tests, all passing in GitHub CI, which exercise the tool methods and approval behavior without establishing an interactive connection with the model. The server exposes three tools: list_orders, get_order, and cancel_order. The cancellation tool accepts only an order ID and requires a valid approval before proceeding.

Approval is recorded outside the conversation by an operator running a separate Python command, which writes an approval file containing the action, order ID, and expiration time in a designated directory. This file is then claimed by the server, validated, and used to cancel the pending order.

The cancellation flow involves checking the order's status and ensuring the approval is valid and not expired. If all conditions are met, the order's status is updated to cancelled, and the server returns the updated order. The server uses a lock to coordinate calls within the service instance and ensures that only pending orders can be cancelled.

The 12 test cases cover various scenarios, including listing orders, reading an order, rejecting unknown IDs, rejecting cancellations without approval, consuming valid approvals, and rejecting cancellations of shipped orders. The tests also include invalid approval cases and unsafe ID inputs to ensure proper error handling and validation.