DYN-10868: Bump DynamoMCP to 0.6.1

[RobertGlobant20]

Purpose

Lockstep bump of the hard-pinned DynamoVisualProgramming.DynamoMCP built-in package reference from [0.6.0] to [0.6.1], to consume the DynamoMCP 0.6.1 release. Same one-line shape as #17334 (0.5.9 → 0.6.0) and #17319 (0.5.8 → 0.5.9).

Tracking task: DYN-10868.

0.6.1 is the largest DynamoMCP release to date — nine PRs, eight of them new MCP tools. The two items that matter most for Dynamo:

• DYN-10868 Added — bearer tokens are now verified against the issuing authority's published JWKS when the ADP Desktop SDK provides no MCP token validation, so Autodesk Assistant can drive Dynamo in Civil 3D. ADP Desktop SDK 7.0.x replaced the identity wrapper's IDSDKWrapper with a component whose only ProcessMessage message is GetUserID; ValidateMCPToken is gone, the wrapper answers a bare {"_returnCode": 2}, nothing evaluates the token and the gate fails closed. This is not Civil 3D-specific — AdpDesktopSDK\bin is a junction to the newest installed SDK, so installing 7.0.x repoints it for every Autodesk product on the machine. The new tier verifies the RS256 signature, exp, nbf and aud with no ADP or IDSDK dependency. It is a fallback, not a replacement: IDSDK is asked first and any verdict it renders is final, never retried against JWKS, so hosts where IDSDK works are unaffected and a genuine rejection cannot be worked around. Trust is pinned to the three known MCP auth hosts, redirects are disabled on the key fetch, and alg is pinned to RS256. One documented reduction in strength: the device-session check the native API performs is not reproduced, because its expected value lives inside Identity Manager and is not derivable from the token.
• DYN-10770 follow-on / DYN-10756 Fixed — two undo-group teardown paths closed Dynamo's undo action group from a thread that was not Dynamo's.

The eight new tools: cancel_run, add_nodes_to_group, find_nodes, collapse_group, set_run_mode, get_node_value, export_screenshot, export_node_help_doc.

One behaviour change worth a reviewer's eye, though it is confined to the MCP tool surface and not to Dynamo APIs: set_node_value now fails with an explicit message on Date Time nodes and on parameterless zero-input nodes (e.g. Point.Origin) instead of reporting a success that never did anything. Dynamo exposes no working update key for them — neither DateTime nor its BasicInteractive base overrides UpdateValueCore — so those calls only appeared to succeed.

Verification performed against the published package:

• dotnet restore src/DynamoCoreWpf/DynamoCoreWpf.csproj succeeds and src/DynamoCoreWpf/obj/project.assets.json resolves DynamoVisualProgramming.DynamoMCP/0.6.1 under the exact-version pin, with no version-resolution errors.
• The 0.6.0 and 0.6.1 packages carry an identical payload file set (34 files; nothing added or removed), so no packaging or copy-target change is needed — unlike the 0.6.0 bump, which added extra/MCP_ExtensionDefinition.xml.
• All bundled third-party assembly versions are unchanged: BigGustave 1.0.6, Humanizer 3.0.1, Json.More 2.2.0, JsonPointer.Net 6.0.1, JsonSchema.Net 8.0.5, ModelContextProtocol[.Core] 1.3.0, SharpGLTF.* 1.0.0, Microsoft.Extensions.* (10.0.826.23019 / AI.Abstractions 10.500.226.25501), DynamoPlayer.* 7.0.7. The ABOUT.txt third-party attribution added in DYN-10707 therefore needs no update. Notably the JWKS tier above introduced no new dependency — it is implemented against the existing surface.
• Only MCPServer.dll and MCPExtension.dll advance, 0.6.0.0 → 0.6.1.0 (verified by comparing VersionInfo.FileVersion across every DLL in both packages). MCPServer.dll grows 459,608 → 803,672 bytes, which is the eight new tools plus the JWKS validator; MCPExtension.dll is byte-identical in size.
• The published package is Authenticode-signed: Get-AuthenticodeSignature reports Valid for both MCPServer.dll and MCPExtension.dll.
• .github/scripts/check_file_version.ps1 lists the DynamoMCP assemblies by filename with no pinned versions, and 0.6.1 adds no new assembly, so its exclusion list is unaffected.

Declarations

Check these if you believe they are true

• Is documented according to the standards — the existing csproj comment block documenting the hard pin, the bin-wrapped package layout and the lockstep-bump rule all remain accurate; no code added.
• The level of testing this PR includes is appropriate — dependency version bump with no new code paths, so no new tests. Verified via restore resolution and a content/assembly-version/signature diff of the 0.6.0 vs 0.6.1 packages (above).
• Changes to the API follow Semantic Versioning and are documented in the API Changes document — no public Dynamo API changes in this PR.

Release Notes

Autodesk Assistant can now drive Dynamo in Civil 3D and on any machine running ADP Desktop SDK 7.0.x, where bearer-token validation previously failed closed. Adds eight assistant-facing capabilities: cancelling a run, finding nodes, reading a node's value, adding nodes to a group, collapsing a group, setting the run mode, exporting a screenshot, and exporting a node help doc.

Reviewers

@jasonstratton (reviewed #17307, #17314, #17319, #17334)

Notes: the only functional change in this diff is the pinned version string on line 2222; everything else above is verification evidence.

FYIs

Disclosure on the source release build: DynamoMCP's 0.6.1 pipeline went red at the system_test stage, after the signing and NuGet-publish stages had already completed — the failure is a known intermittent race in the new export_node_help_doc integration test, tracked as DYN-10957. The same code passed the same stage on its own PR build 38 minutes earlier. The published artifact is unaffected and independently verified above (contents, assembly versions, signatures), but flagging it rather than leaving it to be discovered.

🤖 Generated with Claude Code

[github-actions]

See the ticket for this pull request: https://autodesk.atlassian.net/browse/DYN-10868

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Updates DynamoCoreWpf to consume DynamoMCP 0.6.1.

Changes:

• Bumps the exact package version from 0.6.0 to 0.6.1.
• Preserves existing package-copy and isolation behavior.

File	Description
src/​DynamoCoreWpf/​DynamoCoreWpf.csproj	Updates the hard-pinned DynamoMCP package reference.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud