Add opt-in exception summarization for server-side logging

Adds McpServerOptions.ExceptionSummarizer, an optional delegate that maps an
Exception to a sanitized description. When set, server-side failure paths log
that description instead of attaching the raw Exception. When null (the
default), every callsite logs exactly as before.

Core stays free of a hard dependency on
Microsoft.Extensions.Diagnostics.ExceptionSummarization; the DI package takes
the package reference and McpServerOptionsSetup populates the delegate from an
optionally-registered IExceptionSummarizer.

Fixes #1690

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Akbar Dızajı

Directory.Packages.props

@@ -13,6 +13,7 @@
     <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="$(MicrosoftExtensionsVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="$(System10Version)" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.ExceptionSummarization" Version="10.8.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(System10Version)" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(System10Version)" />
   </ItemGroup>

docs/concepts/logging/logging.md

@@ -85,3 +85,34 @@ Lastly, the client must configure a notification handler for <xref:ModelContextP
 The following example simply writes the log messages to the console.
 
 [!code-csharp[](samples/client/Program.cs?name=snippet_LoggingHandler)]
+
+### Sanitizing exceptions in the server's own diagnostic logs
+
+Separately from the MCP Logging utility described above, the server writes its own diagnostic logs to the
+[ILogger] it was configured with. When a request handler, tool, prompt, or resource throws, those logs include the
+raw <xref:System.Exception>, which most logging providers render as the exception message plus its stack trace.
+That output can contain sensitive or overly detailed runtime data.
+
+Set <xref:ModelContextProtocol.Server.McpServerOptions.ExceptionSummarizer> to log a sanitized description instead.
+When it is set, the failure paths log only the string the delegate returns, and the raw exception is not attached to
+the log entry. The default is `null`, which preserves the existing behavior of logging the raw exception.
+
+```csharp
+builder.Services.AddMcpServer(options =>
+{
+    options.ExceptionSummarizer = ex => ex.GetType().Name;
+});
+```
+
+The `ModelContextProtocol` package also integrates with the standard
+[Microsoft.Extensions.Diagnostics.ExceptionSummarization](https://learn.microsoft.com/dotnet/api/microsoft.extensions.diagnostics.exceptionsummarization)
+abstractions. If an `IExceptionSummarizer` is registered in the container and `ExceptionSummarizer` has not been set
+explicitly, the SDK populates it with `ExceptionSummary.Description`:
+
+```csharp
+builder.Services.AddExceptionSummarizer(b => b.AddHttpProvider());
+builder.Services.AddMcpServer();
+```
+
+If the delegate throws or returns `null`, the SDK falls back to logging the raw exception, so a faulty summarizer
+can never fail the session.

src/ModelContextProtocol.Core/ExceptionSummaryHelper.cs

@@ -0,0 +1,38 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace ModelContextProtocol;
+
+/// <summary>
+/// Provides the single, shared entry point used by exception-logging callsites to apply an
+/// optional user-supplied exception summarizer.
+/// </summary>
+internal static class ExceptionSummaryHelper
+{
+    /// <summary>
+    /// Attempts to produce a sanitized description of <paramref name="exception"/> using <paramref name="summarizer"/>.
+    /// </summary>
+    /// <returns>
+    /// <see langword="true"/> if a summary was produced and the caller should log it in place of
+    /// <paramref name="exception"/>; otherwise, <see langword="false"/>, in which case the caller must log
+    /// <paramref name="exception"/> exactly as it would have without a summarizer. The summarizer is supplied
+    /// by the host, so throwing or returning <see langword="null"/> both fall back rather than disrupt the session.
+    /// </returns>
+    public static bool TrySummarize(Func<Exception, string>? summarizer, Exception exception, [NotNullWhen(true)] out string? summary)
+    {
+        if (summarizer is not null)
+        {
+            try
+            {
+                summary = summarizer(exception);
+                return summary is not null;
+            }
+            catch
+            {
+                // A faulty summarizer must never fail logging; fall back to the raw exception.
+            }
+        }
+
+        summary = null;
+        return false;
+    }
+}

src/ModelContextProtocol.Core/McpSessionHandler.cs

@@ -95,6 +95,7 @@ internal static bool SupportsNaturalOutputSchemas(string? protocolVersion)
     /// </summary>
     private readonly ConcurrentDictionary<RequestId, CancellationTokenSource> _handlingRequests = new();
     private readonly ILogger _logger;
+    private readonly Func<Exception, string>? _exceptionSummarizer;
 
     // This _sessionId is solely used to identify the session in telemetry and logs.
     private readonly string _sessionId = Guid.NewGuid().ToString("N");
@@ -115,6 +116,10 @@ internal static bool SupportsNaturalOutputSchemas(string? protocolVersion)
     /// <param name="incomingMessageFilter">A filter that wraps incoming message processing. Takes the next handler and returns a wrapped handler. If null, a passthrough filter is used.</param>
     /// <param name="outgoingMessageFilter">A filter that wraps outgoing message processing. Takes the next handler and returns a wrapped handler. If null, a passthrough filter is used.</param>
     /// <param name="logger">The logger.</param>
+    /// <param name="exceptionSummarizer">
+    /// An optional callback that produces a sanitized description of an exception. When non-<see langword="null"/>,
+    /// exception logging callsites log that description instead of the raw <see cref="Exception"/>.
+    /// </param>
     public McpSessionHandler(
         bool isServer,
         ITransport transport,
@@ -123,7 +128,8 @@ public McpSessionHandler(
         NotificationHandlers notificationHandlers,
         JsonRpcMessageFilter? incomingMessageFilter,
         JsonRpcMessageFilter? outgoingMessageFilter,
-        ILogger logger)
+        ILogger logger,
+        Func<Exception, string>? exceptionSummarizer = null)
     {
         Throw.IfNull(transport);
 
@@ -144,6 +150,7 @@ public McpSessionHandler(
         _incomingMessageFilter = incomingMessageFilter ?? (next => next);
         _outgoingMessageFilter = outgoingMessageFilter ?? (next => next);
         _logger = logger;
+        _exceptionSummarizer = exceptionSummarizer;
 
         // ping was removed in the 2026-07-28 protocol revision (SEP-2575). On the 2026-07-28 or later version,
         // return MethodNotFound; on an older version, the per-spec behavior is to always answer
@@ -323,7 +330,18 @@ ex is OperationCanceledException &&
                         }
                         else if (ex is not OperationCanceledException)
                         {
-                            if (_logger.IsEnabled(LogLevel.Trace))
+                            if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, ex, out string? exceptionSummary))
+                            {
+                                if (_logger.IsEnabled(LogLevel.Trace))
+                                {
+                                    LogMessageHandlerExceptionSensitiveSummarized(EndpointName, message.GetType().Name, JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage), exceptionSummary);
+                                }
+                                else
+                                {
+                                    LogMessageHandlerExceptionSummarized(EndpointName, message.GetType().Name, exceptionSummary);
+                                }
+                            }
+                            else if (_logger.IsEnabled(LogLevel.Trace))
                             {
                                 LogMessageHandlerExceptionSensitive(EndpointName, message.GetType().Name, JsonSerializer.Serialize(message, McpJsonUtilities.JsonContext.Default.JsonRpcMessage), ex);
                             }
@@ -470,7 +488,15 @@ await _incomingMessageFilter(async (msg, ct) =>
                 }
                 catch (Exception ex)
                 {
-                    LogRequestHandlerException(EndpointName, request.Method, GetElapsed(requestStartingTimestamp).TotalMilliseconds, ex);
+                    if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, ex, out string? exceptionSummary))
+                    {
+                        LogRequestHandlerExceptionSummarized(EndpointName, request.Method, GetElapsed(requestStartingTimestamp).TotalMilliseconds, exceptionSummary);
+                    }
+                    else
+                    {
+                        LogRequestHandlerException(EndpointName, request.Method, GetElapsed(requestStartingTimestamp).TotalMilliseconds, ex);
+                    }
+
                     throw;
                 }
 
@@ -1283,6 +1309,9 @@ internal static McpProtocolException CreateRemoteProtocolExceptionFromError(Json
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} method '{Method}' request handler failed in {ElapsedMilliseconds}ms.")]
     private partial void LogRequestHandlerException(string endpointName, string method, double elapsedMilliseconds, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} method '{Method}' request handler failed in {ElapsedMilliseconds}ms: {ExceptionSummary}.")]
+    private partial void LogRequestHandlerExceptionSummarized(string endpointName, string method, double elapsedMilliseconds, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Information, Message = "{EndpointName} received request for unknown request ID '{RequestId}'.")]
     private partial void LogNoRequestFoundForMessageWithId(string endpointName, RequestId requestId);
 
@@ -1313,9 +1342,15 @@ internal static McpProtocolException CreateRemoteProtocolExceptionFromError(Json
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} message handler {MessageType} failed.")]
     private partial void LogMessageHandlerException(string endpointName, string messageType, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} message handler {MessageType} failed: {ExceptionSummary}.")]
+    private partial void LogMessageHandlerExceptionSummarized(string endpointName, string messageType, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Trace, Message = "{EndpointName} message handler {MessageType} failed. Message: '{Message}'.")]
     private partial void LogMessageHandlerExceptionSensitive(string endpointName, string messageType, string message, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Trace, Message = "{EndpointName} message handler {MessageType} failed: {ExceptionSummary}. Message: '{Message}'.")]
+    private partial void LogMessageHandlerExceptionSensitiveSummarized(string endpointName, string messageType, string message, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Warning, Message = "{EndpointName} received unexpected {MessageType} message type.")]
     private partial void LogEndpointHandlerUnexpectedMessageType(string endpointName, string messageType);
 

src/ModelContextProtocol.Core/Server/McpServerImpl.cs

@@ -21,6 +21,7 @@ internal sealed partial class McpServerImpl : McpServer
     };
 
     private readonly ILogger _logger;
+    private readonly Func<Exception, string>? _exceptionSummarizer;
     private readonly ITransport _sessionTransport;
     private readonly bool _servicesScopePerRequest;
     private readonly List<Action> _disposables = [];
@@ -88,6 +89,7 @@ public McpServerImpl(ITransport transport, McpServerOptions options, ILoggerFact
         _endpointName = _serverOnlyEndpointName;
         _servicesScopePerRequest = options.ScopeRequests;
         _logger = loggerFactory?.CreateLogger<McpServer>() ?? NullLogger<McpServer>.Instance;
+        _exceptionSummarizer = options.ExceptionSummarizer;
 
         _clientInfo = options.KnownClientInfo;
         _clientCapabilities = options.KnownClientCapabilities;
@@ -161,7 +163,8 @@ void Register<TPrimitive>(McpServerPrimitiveCollection<TPrimitive>? collection,
             _notificationHandlers,
             incomingMessageFilter,
             outgoingMessageFilter,
-            _logger);
+            _logger,
+            _exceptionSummarizer);
     }
 
     /// <summary>
@@ -1230,7 +1233,7 @@ await originalListResourceTemplatesHandler(request, cancellationToken).Configure
                 }
                 catch (Exception e)
                 {
-                    ReadResourceError(request.Params?.Uri ?? string.Empty, e);
+                    LogReadResourceError(request.Params?.Uri ?? string.Empty, e);
                     throw;
                 }
             });
@@ -1344,7 +1347,7 @@ await originalListPromptsHandler(request, cancellationToken).ConfigureAwait(fals
                 }
                 catch (Exception e)
                 {
-                    GetPromptError(request.Params?.Name ?? string.Empty, e);
+                    LogGetPromptError(request.Params?.Name ?? string.Empty, e);
                     throw;
                 }
             });
@@ -1597,7 +1600,7 @@ private McpRequestInvocationFilter<CallToolRequestParams, ResultOrAlternate<Call
                 // not an error (tools throw it to signal an InputRequiredResult).
                 if (!(e is OperationCanceledException && cancellationToken.IsCancellationRequested) && e is not InputRequiredException)
                 {
-                    ToolCallError(request.Params?.Name ?? string.Empty, e);
+                    LogToolCallError(request.Params?.Name ?? string.Empty, e);
                 }
 
                 if ((e is OperationCanceledException && cancellationToken.IsCancellationRequested) || e is McpProtocolException || e is InputRequiredException)
@@ -1648,7 +1651,7 @@ private void LogToolCallLifecycles(
             else if (!(lifecycle.Exception is OperationCanceledException && lifecycle.CancellationRequested) &&
                 lifecycle.Exception is not InputRequiredException)
             {
-                ToolCallError(toolName, lifecycle.Exception!);
+                LogToolCallError(toolName, lifecycle.Exception!);
             }
         }
     }
@@ -2380,7 +2383,7 @@ private async Task ObserveHandlerCompletionAsync(Task<JsonNode?> handlerTask)
         }
         catch (Exception ex)
         {
-            MrtrHandlerError(ex);
+            LogMrtrHandlerError(ex);
         }
         finally
         {
@@ -2407,21 +2410,78 @@ private async Task ObserveHandlerCompletionAsync(Task<JsonNode?> handlerTask)
         }
     }
 
+    private void LogToolCallError(string toolName, Exception exception)
+    {
+        if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            ToolCallErrorSummarized(toolName, exceptionSummary);
+        }
+        else
+        {
+            ToolCallError(toolName, exception);
+        }
+    }
+
+    private void LogGetPromptError(string promptName, Exception exception)
+    {
+        if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            GetPromptErrorSummarized(promptName, exceptionSummary);
+        }
+        else
+        {
+            GetPromptError(promptName, exception);
+        }
+    }
+
+    private void LogReadResourceError(string resourceUri, Exception exception)
+    {
+        if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            ReadResourceErrorSummarized(resourceUri, exceptionSummary);
+        }
+        else
+        {
+            ReadResourceError(resourceUri, exception);
+        }
+    }
+
+    private void LogMrtrHandlerError(Exception exception)
+    {
+        if (ExceptionSummaryHelper.TrySummarize(_exceptionSummarizer, exception, out string? exceptionSummary))
+        {
+            MrtrHandlerErrorSummarized(exceptionSummary);
+        }
+        else
+        {
+            MrtrHandlerError(exception);
+        }
+    }
+
     [LoggerMessage(Level = LogLevel.Error, Message = "\"{ToolName}\" threw an unhandled exception.")]
     private partial void ToolCallError(string toolName, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Error, Message = "\"{ToolName}\" threw an unhandled exception: {ExceptionSummary}.")]
+    private partial void ToolCallErrorSummarized(string toolName, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Information, Message = "\"{ToolName}\" completed. IsError = {IsError}.")]
     private partial void ToolCallCompleted(string toolName, bool isError);
 
     [LoggerMessage(Level = LogLevel.Error, Message = "GetPrompt \"{PromptName}\" threw an unhandled exception.")]
     private partial void GetPromptError(string promptName, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Error, Message = "GetPrompt \"{PromptName}\" threw an unhandled exception: {ExceptionSummary}.")]
+    private partial void GetPromptErrorSummarized(string promptName, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Information, Message = "GetPrompt \"{PromptName}\" completed.")]
     private partial void GetPromptCompleted(string promptName);
 
     [LoggerMessage(Level = LogLevel.Error, Message = "ReadResource \"{ResourceUri}\" threw an unhandled exception.")]
     private partial void ReadResourceError(string resourceUri, Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Error, Message = "ReadResource \"{ResourceUri}\" threw an unhandled exception: {ExceptionSummary}.")]
+    private partial void ReadResourceErrorSummarized(string resourceUri, string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Information, Message = "ReadResource \"{ResourceUri}\" completed.")]
     private partial void ReadResourceCompleted(string resourceUri);
 
@@ -2431,6 +2491,9 @@ private async Task ObserveHandlerCompletionAsync(Task<JsonNode?> handlerTask)
     [LoggerMessage(Level = LogLevel.Debug, Message = "An MRTR handler threw an unhandled exception.")]
     private partial void MrtrHandlerError(Exception exception);
 
+    [LoggerMessage(Level = LogLevel.Debug, Message = "An MRTR handler threw an unhandled exception: {ExceptionSummary}.")]
+    private partial void MrtrHandlerErrorSummarized(string exceptionSummary);
+
     [LoggerMessage(Level = LogLevel.Debug, Message = "Failed to deliver \"{NotificationMethod}\" to subscription \"{SubscriptionId}\".")]
     private partial void SubscriptionNotificationFailed(string notificationMethod, string subscriptionId, Exception exception);
 }

src/ModelContextProtocol.Core/Server/McpServerOptions.cs

@@ -205,6 +205,33 @@ public McpServerFilters Filters
     [Obsolete(Obsoletions.DeprecatedSampling_Message, DiagnosticId = Obsoletions.Deprecated_DiagnosticId, UrlFormat = Obsoletions.Deprecated_Url)]
     public int MaxSamplingOutputTokens { get; set; } = 1000;
 
+    /// <summary>
+    /// Gets or sets an optional callback used to produce a sanitized description of an exception for logging.
+    /// </summary>
+    /// <value>
+    /// A delegate that maps an <see cref="Exception"/> to a short description to be logged in place of the
+    /// exception itself, or <see langword="null"/> to log the raw <see cref="Exception"/>. The default is
+    /// <see langword="null"/>.
+    /// </value>
+    /// <remarks>
+    /// <para>
+    /// By default, server-side failure paths pass the raw <see cref="Exception"/> to <see cref="Microsoft.Extensions.Logging.ILogger"/>,
+    /// which most logging providers render as the exception message plus its stack trace. That output can include
+    /// sensitive or overly detailed runtime data. Setting this property opts into logging only the string this
+    /// delegate returns; the raw <see cref="Exception"/> is not attached to those log entries.
+    /// </para>
+    /// <para>
+    /// When the <c>ModelContextProtocol</c> package is used, this property is populated automatically from an
+    /// <c>IExceptionSummarizer</c> registered in the dependency injection container (for example, via
+    /// <c>services.AddExceptionSummarizer()</c>) if it has not already been set.
+    /// </para>
+    /// <para>
+    /// If the delegate throws or returns <see langword="null"/>, the raw <see cref="Exception"/> is logged instead,
+    /// so a faulty summarizer can never fail the session.
+    /// </para>
+    /// </remarks>
+    public Func<Exception, string>? ExceptionSummarizer { get; set; }
+
     /// <summary>
     /// Gets or sets custom request handlers to register with the server.
     /// </summary>