.NET 11 builds you an MCP server in one command. Securing it is still your job.

using Microsoft.AspNetCore.Authentication.JwtBearer;
using ModelContextProtocol.AspNetCore.Authentication;
using ModelContextProtocol.Authentication;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = McpAuthenticationDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.Authority = "https://login.example.com";
        options.Audience = "https://mcp.example.com";
    })
    .AddMcp(options =>
    {
        options.ResourceMetadata = new ProtectedResourceMetadata
        {
            AuthorizationServers = ["https://login.example.com"],
            ScopesSupported = ["orders.read", "orders.write"]
        };
    });

builder.Services.AddAuthorization(options =>
    options.AddPolicy("orders.write", policy => policy.RequireClaim("scope", "orders.write")));

builder.Services
    .AddMcpServer()
    .WithHttpTransport(options => options.Stateless = true)
    .AddAuthorizationFilters()
    .WithTools<OrderTools>();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapMcp().RequireAuthorization();
app.Run();

internal class OrderTools
{
    [McpServerTool, Description("Lists the open orders of the signed-in customer.")]
    public string[] GetOpenOrders(ClaimsPrincipal user) =>
        [$"orders for {user.FindFirstValue(ClaimTypes.NameIdentifier)}"];

    [McpServerTool, Description("Cancels one order of the signed-in customer.")]
    [Authorize(Policy = "orders.write")]
    public string CancelOrder(ClaimsPrincipal user, [Description("Order number")] string orderId) =>
        $"cancel {orderId} for {user.FindFirstValue(ClaimTypes.NameIdentifier)}";
}