Add opt-in exception summarization for server-side logging

Adds McpServerOptions.ExceptionSummarizer, an optional delegate that maps an
Exception to a sanitized description. When set, server-side failure paths log
that description instead of attaching the raw Exception. When null (the
default), every callsite logs exactly as before.

The delegate runs only when the level of the event being written is enabled,
matching the enabled-check the generated logging methods perform internally, and
each summarized variant reuses its raw counterpart's EventName so both emit the
same EventId.

Core stays free of a hard dependency on
Microsoft.Extensions.Diagnostics.ExceptionSummarization; the DI package takes
the package reference and McpServerOptionsSetup populates the delegate from an
optionally-registered IExceptionSummarizer.

Fixes #1690

Author: Akbar Dızajı

Directory.Packages.props

@@ -13,6 +13,7 @@
     <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="$(MicrosoftExtensionsVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="$(System10Version)" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.ExceptionSummarization" Version="10.8.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(System10Version)" />
   </ItemGroup>

docs/concepts/logging/logging.md

@@ -85,3 +85,42 @@ Lastly, the client must configure a notification handler for <xref:ModelContextP
 The following example simply writes the log messages to the console.
 
 [!code-csharp[](samples/client/Program.cs?name=snippet_LoggingHandler)]
+
+### Sanitizing exceptions in the server's own diagnostic logs
+
+Separately from the MCP Logging utility described above, the server writes its own diagnostic logs to the
+[ILogger] it was configured with. When a request handler, tool, prompt, or resource throws, those logs include the
+raw <xref:System.Exception>, which most logging providers render as the exception message plus its stack trace.
+That output can contain sensitive or overly detailed runtime data.
+
+Set <xref:ModelContextProtocol.Server.McpServerOptions.ExceptionSummarizer> to log a sanitized description instead.
+When it is set, the failure paths log only the string the delegate returns, and the raw exception is not attached to
+the log entry. The default is `null`, which preserves the existing behavior of logging the raw exception.
+
+```csharp
+builder.Services.AddMcpServer(options =>
+{
+    options.ExceptionSummarizer = ex => ex.GetType().Name;
+});
+```
+
+The summarized and raw forms of each event share one `EventId`, so filters and alerts keyed on `EventId` behave the
+same whether or not a summarizer is configured. The delegate runs only when the corresponding log level is enabled,
+so it costs nothing on a level that is filtered out.
+
+The `ModelContextProtocol` package also integrates with the standard
+[Microsoft.Extensions.Diagnostics.ExceptionSummarization](https://learn.microsoft.com/dotnet/api/microsoft.extensions.diagnostics.exceptionsummarization)
+abstractions. If an `IExceptionSummarizer` is registered in the container and `ExceptionSummarizer` has not been set
+explicitly, the SDK populates it with `"{ExceptionType}: {Description}"` taken from the `ExceptionSummary`:
+
+```csharp
+builder.Services.AddExceptionSummarizer(b => b.AddHttpProvider());
+builder.Services.AddMcpServer();
+```
+
+Both of those fields are documented as free of privacy-sensitive information. `ExceptionSummary.AdditionalDetails` is
+not, and `ExceptionSummary.ToString()` appends it, so neither is used. The exception type is included because
+`Description` on its own is `"Unknown"` for exception types that no registered provider handles.
+
+If the delegate throws or returns `null`, the SDK falls back to logging the raw exception, so a faulty summarizer
+can never fail the session.

src/ModelContextProtocol.Core/ExceptionSummaryHelper.cs

@@ -0,0 +1,38 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace ModelContextProtocol;
+
+/// <summary>
+/// Provides the single, shared entry point used by exception-logging callsites to apply an
+/// optional user-supplied exception summarizer.
+/// </summary>
+internal static class ExceptionSummaryHelper
+{
+    /// <summary>
+    /// Attempts to produce a sanitized description of <paramref name="exception"/> using <paramref name="summarizer"/>.
+    /// </summary>
+    /// <returns>
+    /// <see langword="true"/> if a summary was produced and the caller should log it in place of
+    /// <paramref name="exception"/>; otherwise, <see langword="false"/>, in which case the caller must log
+    /// <paramref name="exception"/> exactly as it would have without a summarizer. The summarizer is supplied
+    /// by the host, so throwing or returning <see langword="null"/> both fall back rather than disrupt the session.
+    /// </returns>
+    public static bool TrySummarize(Func<Exception, string>? summarizer, Exception exception, [NotNullWhen(true)] out string? summary)
+    {
+        if (summarizer is not null)
+        {
+            try
+            {
+                summary = summarizer(exception);
+                return summary is not null;
+            }
+            catch
+            {
+                // A faulty summarizer must never fail logging; fall back to the raw exception.
+            }
+        }
+
+        summary = null;
+        return false;
+    }
+}

src/ModelContextProtocol.Core/McpSessionHandler.cs

@@ -95,6 +95,7 @@ internal static bool SupportsNaturalOutputSchemas(string? protocolVersion)
     /// </summary>
     private readonly ConcurrentDictionary<RequestId, CancellationTokenSource> _handlingRequests = new();
     private readonly ILogger _logger;
+    private readonly Func<Exception, string>? _exceptionSummarizer;
 
     // This _sessionId is solely used to identify the session in telemetry and logs.
     private readonly string _sessionId = Guid.NewGuid().ToString("N");
@@ -115,6 +116,10 @@ internal static bool SupportsNaturalOutputSchemas(string? protocolVersion)
     /// <param name="incomingMessageFilter">A filter that wraps incoming message processing. Takes the next handler and returns a wrapped handler. If null, a passthrough filter is used.</param>
     /// <param name="outgoingMessageFilter">A filter that wraps outgoing message processing. Takes the next handler and returns a wrapped handler. If null, a passthrough filter is used.</param>
     /// <param name="logger">The logger.</param>
+    /// <param name="exceptionSummarizer">
+    /// An optional callback that produces a sanitized description of an exception. When non-<see langword="null"/>,
+    /// exception logging callsites log that description instead of the raw <see cref="Exception"/>.
+    /// </param>
     public McpSessionHandler(
         bool isServer,
         ITransport transport,
@@ -123,7 +128,8 @@ public McpSessionHandler(
         NotificationHandlers notificationHandlers,
         JsonRpcMessageFilter? incomingMessageFilter,
         JsonRpcMessageFilter? outgoingMessageFilter,
-        ILogger logger)
+        ILogger logger,
+        Func<Exception, string>? exceptionSummarizer = null)
     {
         Throw.IfNull(transport);
 
@@ -144,6 +150,7 @@ public McpSessionHandler(
         _incomingMessageFilter = incomingMessageFilter ?? (next => next);
         _outgoingMessageFilter = outgoingMessageFilter ?? (next => next);
         _logger = logger;
+        _exceptionSummarizer = exceptionSummarizer;
 
         // ping was removed in the 2026-07-28 protocol revision (SEP-2575). On the 2026-07-28 or later version,
         // return MethodNotFound; on an older version, the per-spec behavior is to always answer
@@ -323,14 +330,7 @@ ex is OperationCanceledException &&
                         }
                         else if (ex is not OperationCanceledException)
                         {
-                            if (_logger.IsEnabled(LogLevel.Trace))
-                            {
-                                LogMessageHandlerExceptionSensitive(EndpointName, message.GetType().Name, JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage), ex);
-                            }
-                            else
-                            {
-                                LogMessageHandlerException(EndpointName, message.GetType().Name, ex);
-                            }
+                            LogMessageHandlerFailure(message, ex);
                         }
                     }
                     finally
@@ -470,7 +470,7 @@ await _incomingMessageFilter(async (msg, ct) =>
                 }
                 catch (Exception ex)
                 {
-                    LogRequestHandlerException(EndpointName, request.Method, GetElapsed(requestStartingTimestamp).TotalMilliseconds, ex);
+                    LogRequestHandlerFailure(EndpointName, request.Method, GetElapsed(requestStartingTimestamp).TotalMilliseconds, ex);
                     throw;
                 }
 
@@ -1280,9 +1280,68 @@ internal static McpProtocolException CreateRemoteProtocolExceptionFromError(Json
     [LoggerMessage(Level = LogLevel.Information, Message = "{EndpointName} method '{Method}' request handler completed in {ElapsedMilliseconds}ms.")]
     private partial void LogRequestHandlerCompleted(string endpointName, string method, double elapsedMilliseconds);
 
+    /// <summary>
+    /// Logs a failed request handler, substituting a sanitized description for the raw exception when a
+    /// summarizer is configured. The summarizer only runs when the event's level is enabled, matching the
+    /// enabled-check the generated logging methods perform internally.
+    /// </summary>
+    private void LogRequestHandlerFailure(string endpointName, string method, double elapsedMilliseconds, Exception exception)
+    {
+        if (_exceptionSummarizer is not null &&
+            _logger.IsEnabled(LogLevel.Warning) &&
+            ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            LogRequestHandlerExceptionSummarized(endpointName, method, elapsedMilliseconds, exceptionSummary);
+        }
+        else
+        {
+            LogRequestHandlerException(endpointName, method, elapsedMilliseconds, exception);
+        }
+    }
+
+    /// <summary>
+    /// Logs a failed message handler. The trace-vs-warning selection is unchanged from the non-summarizing
+    /// path; only the payload differs. The summarizer runs only when the selected event's level is enabled.
+    /// </summary>
+    private void LogMessageHandlerFailure(JsonRpcMessage message, Exception exception)
+    {
+        string messageType = message.GetType().Name;
+
+        if (_logger.IsEnabled(LogLevel.Trace))
+        {
+            if (_exceptionSummarizer is not null &&
+                ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+            {
+                LogMessageHandlerExceptionSensitiveSummarized(EndpointName, messageType, exceptionSummary, JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage));
+            }
+            else
+            {
+                LogMessageHandlerExceptionSensitive(EndpointName, messageType, JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage), exception);
+            }
+        }
+        else if (_exceptionSummarizer is not null &&
+            _logger.IsEnabled(LogLevel.Warning) &&
+            ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            LogMessageHandlerExceptionSummarized(EndpointName, messageType, exceptionSummary);
+        }
+        else
+        {
+            LogMessageHandlerException(EndpointName, messageType, exception);
+        }
+    }
+
+    // Each summarized variant names its raw counterpart as its EventName so the pair emits one EventId and
+    // one event name, keeping consumers that filter on EventId working when a summarizer is configured. The
+    // generator derives the numeric id from the event name, which defaults to the method name, so only the
+    // summarized variant declares EventName: declaring it on both trips SYSLIB1025.
+
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} method '{Method}' request handler failed in {ElapsedMilliseconds}ms.")]
     private partial void LogRequestHandlerException(string endpointName, string method, double elapsedMilliseconds, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Warning, EventName = nameof(LogRequestHandlerException), Message = "{EndpointName} method '{Method}' request handler failed in {ElapsedMilliseconds}ms: {ExceptionSummary}.")]
+    private partial void LogRequestHandlerExceptionSummarized(string endpointName, string method, double elapsedMilliseconds, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Information, Message = "{EndpointName} received request for unknown request ID '{RequestId}'.")]
     private partial void LogNoRequestFoundForMessageWithId(string endpointName, RequestId requestId);
 
@@ -1313,9 +1372,15 @@ internal static McpProtocolException CreateRemoteProtocolExceptionFromError(Json
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} message handler {MessageType} failed.")]
     private partial void LogMessageHandlerException(string endpointName, string messageType, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Warning, EventName = nameof(LogMessageHandlerException), Message = "{EndpointName} message handler {MessageType} failed: {ExceptionSummary}.")]
+    private partial void LogMessageHandlerExceptionSummarized(string endpointName, string messageType, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Trace, Message = "{EndpointName} message handler {MessageType} failed. Message: '{Message}'.")]
     private partial void LogMessageHandlerExceptionSensitive(string endpointName, string messageType, string message, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Trace, EventName = nameof(LogMessageHandlerExceptionSensitive), Message = "{EndpointName} message handler {MessageType} failed: {ExceptionSummary}. Message: '{Message}'.")]
+    private partial void LogMessageHandlerExceptionSensitiveSummarized(string endpointName, string messageType, string exceptionSummary, string message);
+
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} received unexpected {MessageType} message type.")]
     private partial void LogEndpointHandlerUnexpectedMessageType(string endpointName, string messageType);