DYN-10707: Correct and complete DynamoMCP third-party attribution in ABOUT.txt

[jasonstratton]

Purpose

Fixes DYN-10707. Corrects and completes the DynamoMCP third-party attributions added by #17228. Both issues in this PR were raised by @RobertGlobant20 during review of that PR.

1. ModelContextProtocol and ModelContextProtocol.Core v1.3.0 were attributed as MIT, but upstream declares Apache-2.0.

Verified against the pinned v1.3.0 tag rather than main:

	Upstream csharp-sdk v1.3.0	ABOUT.txt before this PR
License	Apache-2.0, the declared SPDX expression in both nuspecs	The MIT License (MIT)
Copyright	Copyright (c) 2024-2026 Model Context Protocol a Series of LF Projects, LLC.	Copyright (c) 2023-present Model Context Protocol contributors, plus Copyright (c) 2023-present Microsoft Corporation
License body	Apache-2.0	Full MIT permission text

The two copyright lines appear nowhere in the upstream LICENSE.

Upstream v1.3.0/LICENSE is a dual-license state: an Apache-2.0 body and a distinct MIT License section under the same copyright holder, because contributions not yet relicensed remain MIT. That code is compiled into the assemblies we redistribute, so the entry now reproduces both notices under the single upstream copyright line, mirroring upstream's own LICENSE layout. Thanks to @RobertGlobant20 for catching that the first revision of this PR described the MIT residual in prose instead of reproducing the notice, which would have traded an Apache-2.0 gap for an MIT one.

The cited LICENSE URL is pinned to /blob/v1.3.0/LICENSE instead of /blob/main/LICENSE. main is a moving target on a repository that is actively relicensing, which is the most likely reason the MIT text was accurate when transcribed and wrong by the time it merged.

2. Ten Microsoft.Extensions packages ship in the DynamoMCP package with no attribution at all.

MCPExtension.csproj copies mcp_server/Microsoft.Extensions*.dll by wildcard. The resolved set is Microsoft.Extensions.AI.Abstractions v10.5.2 plus nine packages at v10.0.8: Caching, Configuration, DependencyInjection, Diagnostics, FileProviders, Hosting and Logging Abstractions, plus Options and Primitives. All MIT.

ABOUT.txt already attributes Microsoft.Extensions.Configuration.Json v6.0.0 individually, so the established convention in this file is to list these rather than treat them under a blanket .NET runtime attribution. The new block is placed immediately beside that entry and reuses its exact format and license text. Its license URLs are pinned rather than citing main: dotnet/runtime at tag v10.0.8, and dotnet/extensions at the commit recorded in the AI.Abstractions nuspec, since that package has no matching tag. The pre-existing Configuration.Json v6.0.0 entry is left untouched as out of scope.

Note on scope: the same csproj also has a mcp_server/System.Net*.dll wildcard, but it matches nothing. No System.Net package appears in the resolved dependency graph and no such DLL is produced, so there is nothing to attribute there.

ABOUT.txt remains CRLF throughout: 939 CRLF, 0 bare LF.

Declarations

Check these if you believe they are true

• Is documented according to the standards
• The level of testing this PR includes is appropriate
• Changes to the API follow Semantic Versioning and are documented in the API Changes document.

Release Notes

Corrected the About box attribution for the Model Context Protocol C# SDK, which is dual-licensed under Apache-2.0 and MIT rather than MIT alone, and added the previously missing attributions for the Microsoft.Extensions packages bundled with DynamoMCP.

Reviewers

@RobertGlobant20, who raised both findings in #17228 and reviewed the first revision here.

Two notes for reviewers:

• Roberto has asked for an OSS-compliance sign-off on the dual-license wording. That is outstanding.
• This needs to be cherry-picked to RC4.2.0_master, which carries the same incorrect text via [Cherry-pick] DYN-10705: Add DynamoMCP OSS attributions to ABOUT.txt #17233.

FYIs

None

[github-actions]

See the ticket for this pull request: https://jira.autodesk.com/browse/DYN-10707

[Copilot]

Pull request overview

Updates Dynamo’s canonical third-party acknowledgements (ABOUT.txt) to correct and complete OSS attributions for the DynamoMCP shipped dependencies, aligning the recorded license/copyright details with the referenced upstream sources.

Changes:

• Added missing attributions for the Microsoft.Extensions.* packages bundled with DynamoMCP (MIT).
• Corrected ModelContextProtocol / ModelContextProtocol.Core v1.3.0 attribution to Apache-2.0 (including pinning the LICENSE URL to the v1.3.0 tag) and replaced the prior MIT text with an Apache-2.0 notice plus an upstream transition note.

[RobertGlobant20]

Verified the Apache-2.0 fix against the package cache — both v1.3.0 nuspecs declare Apache-2.0, the copyright line matches v1.3.0/LICENSE, and the ten Microsoft.Extensions.* entries match the DLL versions in bin\mcp_server\ one-for-one. Pinning the LICENSE URL to the tag is a good call.

One blocker.

Upstream v1.3.0/LICENSE contains both an Apache-2.0 body and an MIT License section, because some contributions haven't been relicensed yet. That MIT code is still compiled into the DLLs we ship, and MIT requires its permission notice accompany all copies.

This PR deletes that notice and replaces it with a sentence describing it ("contributions not yet relicensed remain under the MIT License"). A description isn't the notice. So we've closed the Apache-2.0 gap and opened an MIT one.

Fix: keep both, under the single correct copyright line — same as upstream's LICENSE does. After the Apache short-form paragraph:

Portions not yet relicensed remain under the MIT License:

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Dual-license state, so worth an OSS-compliance sign-off on the wording.

Non-blocking: the new Microsoft.Extensions.* block uses /blob/main/ URLs — the moving-target problem this PR argues against two hunks later. Consistent with the existing Configuration.Json entry, but worth pinning while you're here.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jasonstratton]

@RobertGlobant20 , my recent PR change should address the concern in your comment. Please take another look to confirm.

Good catch on that and the need for an OSS check. I am unaware of the process and so out of mind ... uh, out of mind. I should have thought about it because the initial PR with ABOUT.txt changes did mention OSS.

@johnpierson , since you authored that PR, I imagine you know the process to get the sign off. Would you let me know how to get it?

Oh, just thinking about it, there will be another ABOUT.txt change coming with the changes needed for the json-everything version change. So I'll hold off on getting the sign off until then. Or does it need to happen with every PR before they get merged? ... My intent being to get this change approved and merged without the sign-off. Then get the sign off for these changes and those for json-complete at the same time, when merging DYN-10727 changes to Dynamo

[RobertGlobant20]

Both findings addressed. Verified the restored MIT notice against upstream's dual-body v1.3.0/LICENSE, and confirmed all three pinned URLs resolve (200) with the expected license text — nice touch pinning dotnet/extensions to the exact source revision baked into the shipped AI.Abstractions DLL. Package list and versions match bin\mcp_server\ one-for-one. LGTM.

[jasonstratton]

With the approval, I'm going to go ahead and merge the change. There is another change coming for DYN-10727. When it is ready, we will get sign off on these changes at the same time since those changes may impact these as well.