WeavePort packages
WeavePort is an embedded backend plugin platform for owner-controlled applications and plugins. Version 0.3.1 targets .NET 10 and is licensed under MIT. The API is evolving; review the exact compatibility matrix before upgrading.
Use WeavePort.Abstractions for contracts, WeavePort.Hosting for binding and worker ownership, WeavePort.Sdk to author C# plugins, and WeavePort.Sdk.Client for typed calls and bounded result streams. Applications own domain contracts, callback authorization and durable state. Hosting depends on the MIT-licensed Microsoft logging abstractions; it installs no logger provider or global configuration.
A PluginHost owns the shared worker budget. Bind immutable PluginContext identity, a trusted execution profile, application callbacks and explicit callback grants with BindAsync. Dispose clients, bindings and the host deterministically. Cancellation can leave external effects uncertain: retries require application idempotency or reconciliation. Cleanup exceptions report failure after independent cleanup attempts; callbacks retain admission until they actually complete.
ProcessProfile requires explicit trust and absolute executable paths. Native processes provide no filesystem/network sandbox or hard resource ceilings. Docker profiles require an existing engine and prepared images. Installing packages does not install either runtime. Timeouts must be positive and at most 4,294,967,294 milliseconds.
Installed-plugin resolution verifies the exact manifest and artifact hashes against owner-supplied pins, rejects missing compatibility declarations, and separates installed versions from activation for future operations. Preserve old artifacts while retained application state references them. The internal distribution includes copyable examples, an offline package feed, compatibility guidance and a native recovery runbook.
The qualified .NET package set is 0.3.1; host API and wire protocol remain version 1. Python and TypeScript author SDKs remain version 0.1.0. Do not mix binaries from different deliveries merely because an API or protocol number matches. Exact package hashes and qualified runtimes are recorded in the release qualification evidence.
Optional diagnostics use new PluginHost(logger) with an application-owned ILogger<PluginHost>. Events 1001–1005 identify startup, callback, invocation, cleanup and maintenance failures; event 1006 identifies host admission refusals using fixed reason codes. Events include safe worker/correlation/stage/type fields and exclude payloads, configuration, credentials, raw stderr and exception messages. The existing constructor keeps logging disabled.
Reuse local MCP tools
Hosting 0.3.1 can discover and call tools from trusted local MCP servers under the same worker lifecycle and tenant budgets as native plugins. Select ProcessProtocol.Mcp20251125 or ProcessProtocol.Mcp20260728 on a ProcessProfile; the default remains Native. MCP uses IPluginSession.InvokeAsync with tools/list and tools/call; the native typed client and callbacks are not translated. No additional MCP runtime dependency is installed.
This release consumes local stdio servers; it does not expose an MCP gateway or implement remote HTTP, resources, prompts or interactive continuations. The application selects and authorizes tools and checks both host status and MCP isError. See https://weaveport.dev/docs/mcp-plugins.html for a complete example and trust limits.