Skip to main content
Version: 2.1

Version 2.1.0 Release Notes

Release date: August 13, 2026

Version 2.1.0 is a service release for the .NET 10 and Orchard Core 3.0 line. It keeps the Orchard Core package range at >= 3.0.0 and < 3.1.0, and updates the CrestApps.Core package line to stable 1.2.0.

At a glance​

Area2.1.0 focus
Platform.NET 10, Orchard Core >= 3.0.0 and < 3.1.0, CrestApps.Core 1.2.0, ModelContextProtocol 2.0.0, and YesSql 5.4.7.
AI and MCPOpt-in MCP Server tool exposure, MCP Server admin settings, documentation search tool instances, and clearer AI feature categories.
RecipesExpanded generated recipe schemas for admin menus, deployments, placements, queries, rules, URL rewriting, and sitemaps.
OmnichannelInbound activity logging and safer migration repair paths for contacts and activity batches.
ReportsCorrect Reports OpenXml feature dependency wiring.
Roles and TelephonyImproved role-picker UI and a telephony interaction synchronization service.

Breaking changes​

MCP Server tool exposure is opt-in​

The MCP Server no longer exposes all registered AI tools by default. Previously, every registered AI tool was listed and callable by connected MCP clients. In 2.1.0, tool exposure is opt-in:

  • No AI tools or tool instances are listed or callable until they are selected in the new MCP Server settings card, configured in McpServerOptions.Tools, or exposed by enabling McpServerOptions.ExposeAllTools.
  • The Expose all tools option exposes only selectable tools. System tools and hidden tools are not exposed, even when this option is enabled.
  • Deployments that relied on the previous "expose everything" behavior must enable Expose all tools or configure an explicit allow-list before MCP clients can continue using those tools.
  • MCP prompts, resources, and resource templates are not affected by the tool allow-list.

Review the MCP Server settings after upgrading, especially production tenants that expose the /mcp endpoint to external clients.

Upgrade notes​

Package compatibility​

Applications using CrestApps.OrchardCore 2.1.0 should stay on Orchard Core >= 3.0.0 and < 3.1.0. This release uses the stable CrestApps.Core 1.2.0 packages, not preview packages.

The stable CrestApps.Core 1.2.0 package line also moves the MCP SDK packages to ModelContextProtocol 2.0.0. YesSql remains pinned to 5.4.7, and no CrestApps.Core preview packages are used.

MCP Server settings​

The Settings → Artificial Intelligence page now includes an MCP Server card. Administrators with the new Manage MCP Server settings permission can configure:

  • The MCP authentication mode.
  • Whether OpenID Connect callers must also have the Access MCP Server permission.
  • Whether all selectable tools should be exposed.
  • The exact AI tools and AI tool instances exposed to MCP clients.

Shell configuration under CrestApps:AI:McpServer still overrides stored site settings for deployment scenarios. The older CrestApps:McpServer configuration path remains supported as a compatibility override.

Change logs​

AI and MCP​

MCP Server opt-in tool exposure​

The MCP Server now enforces the tool allow-list when clients list tools and when they call tools. This means a tool that is not exposed can neither be discovered nor invoked through MCP.

The server settings UI reuses the AI profile tool and tool-instance selectors, so operators can expose a small, reviewed set of capabilities to external MCP clients.

See MCP Server for details.

Documentation search tool instances​

The AI Tool Instances feature now includes built-in documentation search sources for sitemap crawl, prebuilt search index, and Algolia DocSearch. Operators can add documentation sites as tool instances and expose only the selected instances to MCP clients.

The Algolia search-only API key is protected at rest with ASP.NET Core data protection and is not sent back to the browser during editing. Leaving the API key field blank keeps the existing stored key.

See AI Tool Instances for details.

AI feature categories​

The Orchard Core Features page now groups AI features into more focused categories: A2A, Orchestrators, Knowledgebase, and MCP. This makes the feature list easier to scan and helps operators enable related AI capabilities.

Recipes​

The recipe schema system now covers more Orchard Core and CrestApps concepts. The new schema providers and services add richer generated schema support for:

  • Admin menu nodes.
  • Deployment steps.
  • Placement node filters.
  • Query sources.
  • Rule conditions and operators.
  • URL rewrite rule sources.
  • Sitemap sources.
  • Recipe schema examples.

These schemas improve recipe authoring and validation for deployment plans, admin menus, queries, rules, placements, and sitemaps.

Omnichannel​

Inbound activity logging​

The Omnichannel Management activity UI now supports inbound activity logging. The activity creation flow separates outbound scheduled work from inbound completed work, and the subject selector is filtered by the direction configured on the subject flow.

The UI blocks inbound or outbound activity creation when no subject is configured for the selected direction, and it auto-selects the subject when only one valid option exists.

See Omnichannel Management for details.

Migration reliability fixes​

Several migration repair paths now avoid poisoning Orchard Core's shared migration session:

  • The contact index repair migration runs each idempotent table, column, and index change in an isolated transaction.
  • The activity batch index migration applies the Source and CreatedUtc column additions as isolated, idempotent schema changes.
  • The Local DNC registry repair migration resolves physical table names with the tenant table prefix before checking schema metadata, and it does not rethrow if the table is already present.
  • Existing tenants at old Omnichannel contact migration versions are no longer forced through an unnecessary contact-version reindex during this repair path.

These changes help PostgreSQL, SQL Server, MySQL, SQLite, and prefixed multi-tenant installations recover from earlier incomplete migration runs.

Reports​

The Reports (OpenXml) feature now depends on the base Reports feature through the shared ReportsConstants.Feature identifier. This keeps the Excel export add-on wired to the reports framework correctly.

Roles​

The Enhanced Roles module now uses bootstrap-select for role picker controls. Role selection now supports search, select all, and deselect all in both the RolePickerPart editor and excluded-role part settings.

See Roles for details.

Resources​

The shared Resources module now uses @crestapps/bootstrap-select 1.2.4 and @crestapps/ai-chat-ui 1.2.0. Local assets, CDN URLs, package locks, and SRI hashes were updated together.

Telephony​

The Telephony module now registers DefaultTelephonyInteractionSynchronizationService as the implementation of ITelephonyInteractionSynchronizationService. The service reconciles persisted telephony interactions with provider call state, including active calls, finalized calls, and orphaned records.

See Telephony for details.

Security and dependency updates​

The transitive SSH.NET dependency is pinned to the patched 2026.0.0 release for GHSA-q939-rpr3-3284. This removes the high-severity audit warning for the SFTP MCP resource dependency chain.