microsoft / microsoft/aspire.dev
[Docs] MCP gaps - security documentation and troubleshooting
@IEvangelist is already working on this.
Since Feb 20, 2026.
- Dominant language
- MDX
- Stars
- 193
- Forks
- 87
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 73
Description
Summary
Based on analysis of 20,415 Discord messages from the Aspire community, MCP documentation exists but is missing security information for enterprise approval and troubleshooting guidance.
Current State
MCP docs exist and cover:
- ✅
configure-the-mcp-server- setup guide - ✅
aspire-mcp-command- CLI reference - ✅
aspire-mcp-init-command- initialization - ✅
aspire-mcp-start-command- starting server - ✅ Supported AI assistants (VS Code, Claude Code, Copilot CLI, OpenCode)
Missing Documentation
1. Security Documentation for Enterprise Approval (multiple questions)
Customer Quote:
"I am submitting tomorrow a request to approve the aspire mcp for general use, and they need this type of information up front. Is there a security doc for the mcp? I know you have internal security reviews for the aspire cli/mcp"
Requested Documentation:
- Security model of MCP server
- What data is exposed/accessible
- Network boundaries (localhost only?)
- Authentication/authorization
- Enterprise deployment considerations
2. Claude Code Troubleshooting
Customer Quote:
"I've been battling Aspire MCP + Claude Code for quite a while now without success. Am I missing something? It seems like the MCP only detects AppHosts running at MCP startup, but you need to start/stop AppHosts during the session, so it doesn't work to just start the AppHost before starting Claude. This creates a chicken-and-egg problem..."
Requested Documentation:
- AppHost detection lifecycle
- How to handle start/stop during session
- Common Claude Code integration issues
- Debugging MCP connection problems
3. MCP + aspire deploy
Customer Quote:
"Trying to run
aspire deployand I have an MCP inspector resource via.AddMcpInspector(...). If I don't include it during publish, the pipeline executes and my ACA resources deploy successfully."
Requested Documentation:
- Handling MCP resources during deployment
- Dev-only MCP resource patterns
- Excluding MCP from publish
Data Source
- Discord channels: #💫│general, #🔵│azure, #🔨│building-resources
- Help threads: 147 from #🆘│help
- Total messages: 20,415
- Date range: April 2025 - February 2026
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.