Skip to content
Back to skills

Grpc

ASecurity

Build or review gRPC services and clients in .NET. USE FOR: ASP.NET Core gRPC, protobuf contracts, unary or streaming RPC, gRPC client factory, interceptors, deadlines, cancellation, channel reuse, backend service integration. DO NOT USE FOR: broad browser-facing APIs without gRPC-Web tradeoff review, SignalR realtime hubs, plain REST APIs. INVOKES: dotnet build/test and focused service or client smoke checks when code changes.

  • 485 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 27, 2026
developmentapibackendperformancedocumentation

Works with

  • cli
  • api

Security analysis

A100/100

Pro scans all 4 files and shows the line behind each finding

Scanned May 27, 2026

npx -y skills add managedcode/dotnet-skills --skill grpc --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Grpc?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Grpc
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/managedcode-grpc/badge)](https://www.skillsdirectory.com/skills/managedcode-grpc)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: grpc
description: "Build or review gRPC services and clients in .NET. USE FOR: ASP.NET Core gRPC, protobuf contracts, unary or streaming RPC, gRPC client factory, interceptors, deadlines, cancellation, channel reuse, backend service integration. DO NOT USE FOR: broad browser-facing APIs without gRPC-Web tradeoff review, SignalR realtime hubs, plain REST APIs. INVOKES: dotnet build/test and focused service or client smoke checks when code changes."
compatibility: "Requires ASP.NET Core gRPC or gRPC client projects."
---

# gRPC for .NET

## Trigger On

- building backend-to-backend RPC services or clients
- adding protobuf contracts, streaming calls, or interceptors
- deciding between gRPC, HTTP APIs, and SignalR
- optimizing gRPC performance, deadlines, cancellation, or connection reuse
- integrating service-to-service communication in microservices

## Do Not Use For

- public browser-first APIs unless gRPC-Web limitations are explicitly acceptable
- SignalR hub design, realtime UI fan-out, or websocket-style client collaboration
- generic ASP.NET Core minimal APIs or REST controllers with no protobuf/RPC requirement
- non-.NET gRPC work unless the user asks for cross-stack contract guidance

## Load References

- [references/patterns.md](references/patterns.md) for proto design, streaming implementations, interceptors, health checks, load balancing, and client factory setup.
- [references/anti-patterns.md](references/anti-patterns.md) for common channel, deadline, streaming, message-size, and exception-handling mistakes.

## Workflow

1. Validate the architecture fit before touching code.
   - prefer gRPC for backend RPC, strong contracts, low-latency calls, or streaming
   - prefer REST or minimal APIs for broad browser compatibility and loosely coupled public APIs
   - prefer SignalR for browser/client realtime fan-out and UI collaboration
2. Treat `.proto` files as the source of truth.
   - keep package names, `csharp_namespace`, service names, and versioning deliberate
   - reserve removed field numbers and avoid reusing tags
   - use wrapper types or explicit messages when optionality matters
3. Choose the RPC shape from the interaction model.
   - unary for request/response
   - server streaming for large or progressive result sets
   - client streaming for uploads or batches
   - bidirectional streaming for coordinated two-way flows
4. Wire server and client behavior together.
   - register services with `AddGrpc`
   - use `AddGrpcClient` or long-lived `GrpcChannel` reuse
   - set deadlines and propagate cancellation
   - convert domain failures to appropriate `RpcException` status codes
5. Add observability and resilience where the boundary justifies it.
   - logging or exception interceptors
   - OpenTelemetry traces and status-code metrics
   - retry policy only for safe idempotent calls
6. Validate with the repo's normal build and tests, plus a focused smoke call when runnable.

```mermaid
flowchart LR
  A["RPC requirement"] --> B["proto contract"]
  B --> C["server implementation"]
  B --> D["client factory or channel"]
  C --> E["deadlines / cancellation / status codes"]
  D --> E
  E --> F["build, tests, smoke call"]
```

## Examples

Use client factory for normal app integration:

```csharp
builder.Services.AddGrpcClient<Greeter.GreeterClient>(options =>
{
    options.Address = new Uri("https://localhost:5001");
});
```

Always set a deadline and pass cancellation:

```csharp
var response = await client.SayHelloAsync(
    new HelloRequest { Name = name },
    deadline: DateTime.UtcNow.AddSeconds(5),
    cancellationToken: cancellationToken);
```

For streaming, check cancellation inside the read/write loop and keep message sizes bounded. Load [references/patterns.md](references/patterns.md) before writing detailed streaming code.

## Anti-Patterns

- creating a new `GrpcChannel` per call
- omitting deadlines and relying only on client-side cancellation
- ignoring `ServerCallContext.CancellationToken` in streaming handlers
- sending large single messages instead of chunking or streaming
- using gRPC as the default public browser API
- swallowing exceptions inside interceptors
- retrying non-idempotent calls without explicit policy

## Deliver

- stable protobuf contracts and generated-code ownership
- service and client code that match the RPC shape
- explicit deadline, cancellation, retry, and status-code behavior
- tests or smoke checks for serialization and call behavior
- documentation of browser, transport, or deployment constraints when relevant

## Validate

- `dotnet build` succeeds after contract or generated-code changes
- tests or smoke checks exercise at least one server/client call
- streaming methods respect cancellation and bounded message sizes
- channels are reused through client factory or a long-lived channel
- status-code handling is intentional and observable
- browser constraints are documented if gRPC-Web is involved

Files in this skill

  • SKILL.md4.8 KB
  • manifest.json74 B
  • references/anti-patterns.md24.6 KB
  • references/patterns.md22.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…