hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Local-first MCP (Model Context Protocol) server for semantic C# analysis, navigation, validation, and refactoring on real .sln / .slnx / .csproj workspaces. It uses Roslyn and MSBuildWorkspace, runs over stdio, and does not require Visual Studio.
Correct package ID:Darylmcd.RoslynMcp · CLI:roslynmcp · Plugin:roslyn-mcp@roslyn-mcp-marketplace
workspaceIds.server_info and roslyn://server/catalog.just ci), release verification scripts, and a documented two-layer update story for the global tool and the Claude Code plugin.${user_config.*} placeholder substitution that breaks prompt-skipping install flows; the server starts with compiled-in defaults and accepts literal overrides via project-scope .mcp.json.server_info + roslyn://server/catalog so clients can discover the exact tool/resource/prompt set and support tier (stable vs experimental) without guessing.dotnet tool install), zero-install via dnx (.NET 10), or the Claude Code plugin.10.0.100 in global.json (rollForward: latestFeature)dotnet tool install -g Darylmcd.RoslynMcpDarylmcd.RoslynMcproslynmcpdotnet tool update -g Darylmcd.RoslynMcpdnx (.NET 10)dnx is the .NET SDK's npx-equivalent: it resolves a tool package from NuGet on demand, without installing a global shim. Requires .NET 10 SDK Preview 6 or later (dnx ships with the SDK).
One-shot smoke test:
dnx Darylmcd.RoslynMcp --yesThe process should start and then appear to hang — that's expected; it's an MCP server waiting for protocol messages on stdin. The --yes flag is mandatory under MCP hosts because there is no TTY for the interactive install-consent prompt.
.mcp.json snippet:
{
"mcpServers": {
"roslyn": {
"type": "stdio",
"command": "dnx",
"args": [
"Darylmcd.RoslynMcp",
"--source",
"https://api.nuget.org/v3/index.json",
"--yes"
]
}
}
}Trade-offs vs. the global tool:
dotnet tool update step)."--version", "1.35.0" to args.A copy-paste config also lives at docs/mcp-json-examples/dnx.mcp.json.
/plugin marketplace add darylmcd/Roslyn-Backed-MCP
/plugin install roslyn-mcp@roslyn-mcp-marketplaceThe plugin bundles the MCP server, 32 skills, and safety hooks. For packaging, reinstall, and local plugin-dev details, see docs/setup.md and docs/reinstall.md.
dotnet build RoslynMcp.slnx --nologo
dotnet test RoslynMcp.slnx --nologo
dotnet run --project src/RoslynMcp.Host.StdioThe JSON shape is the same across MCP clients — only the file path differs. Drop one of the docs/mcp-json-examples/ snippets into the right location for your client:
| Client | Config file | Notes |
|---|---|---|
| Claude Code | .mcp.json (repo root) | Project-scope; pairs naturally with the Claude Code Plugin path above. |
| Cursor | .cursor/mcp.json (repo root) or ~/.cursor/mcp.json (global) | Project-scope wins over global. |
| VS Code (MCP-aware) | .vscode/mcp.json (repo root) | Workspace-scope; restart the MCP host after editing. |
| Claude Desktop | claude_desktop_config.json (per-OS app-data dir) | Global only; no project-scope config. |
Minimal config (works with Option A — global tool):
{
"mcpServers": {
"roslyn": {
"type": "stdio",
"command": "roslynmcp"
}
}
}For the Option B (dnx) form, use the snippet from the previous section or copy docs/mcp-json-examples/dnx.mcp.json.
For NDJSON framing, handshake order, and minimal Python/C# client examples, see docs/stdio-client-integration.md.
After installing and wiring up .mcp.json, paste this single prompt into your MCP client to verify the server is reachable and report its surface:
Callserver_infoand read theroslyn://server/catalogresource. Report back: 1. The server name and version. 2. The total tool / resource / prompt counts and their stable-vs-experimental split. 3. Whether any workspaces are currently loaded (and their IDs if so). 4. Any warnings or degraded-state flags.
If both calls succeed and the version matches what you installed, the install is healthy.
The server is published to the official MCP Registry under the name `io.github.darylmcd/roslyn-mcp`. MCP-Registry-aware clients — and the downstream catalogs that mirror the registry (the GitHub MCP Registry, the VS Code and Visual Studio MCP galleries, and aggregators) — can discover and install the server by name.
Manifest: .claude-plugin/server.json — name io.github.darylmcd/roslyn-mcp, NuGet package Darylmcd.RoslynMcp, runtime dnx. Every release tag republishes it automatically via the publish-nuget workflow using GitHub OIDC.
You can also install directly without a registry-aware client via the Global Tool or Claude Code Plugin paths above.
The server starts with built-in defaults. To override ROSLYNMCP_* values for a repo, add a project-scope .mcp.json with literal env values.
| Variable | Default | Purpose |
|---|---|---|
ROSLYNMCP_MAX_WORKSPACES | 8 | Concurrent workspace cap |
ROSLYNMCP_BUILD_TIMEOUT_SECONDS | 300 | Build timeout |
ROSLYNMCP_TEST_TIMEOUT_SECONDS | 600 | Test timeout |
ROSLYNMCP_PREVIEW_TTL_MINUTES | 5 | Preview-token TTL |
ROSLYNMCP_REQUEST_TIMEOUT_SECONDS | 120 | Per-request timeout |
Copy-ready examples live in docs/mcp-json-examples/README.md. The full runtime/config surface is documented in ai_docs/runtime.md.
Loading a solution or project executes MSBuild evaluation. Treat workspaces as trusted code unless you run the server inside a sandbox, container, or VM.
See SECURITY.md for disclosure policy.
The current release exposes 173 tools (113 stable / 60 experimental), 14 resources (9 stable / 5 experimental), and 20 prompts (all experimental).
Use the running server for the authoritative live catalog and support tiers:
server_info for a human-readable summaryroslyn://server/catalog for the machine-readable contractroslyn://server/resource-templates for resource URI templatesStable families include workspace/session management, semantic navigation, diagnostics, build/test helpers, and preview/apply refactoring flows. Experimental families include broader project mutation, scaffolding, orchestration, direct text-edit helpers, and prompts.
src/RoslynMcp.Host.Stdio/ — stdio host, tool/resource/prompt wiring, loggingsrc/RoslynMcp.Core/ — DTOs, contracts, abstractions, preview-store typessrc/RoslynMcp.Roslyn/ — Roslyn workspace, analysis, diagnostics, refactoring, execution servicestests/RoslynMcp.Tests/ — integration and regression coverageskills/ — bundled Claude Code skill definitionshooks/ — Claude Code safety hooksIf you find a bug or behaviour gap while running /mcp-server-surface-test against your own C# repo, share it back via the Surface-test finding issue template. The shipped skill renders findings into a copy-paste body block by default; pass --auto-file and the skill calls gh issue create for you.
P0 / area: security findings are refused for public filing — see SECURITY.md for the private-disclosure path.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.