Findings & checks · 20 flagged
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · ai_docs/audits/20260930-1340/evidence/run1.transcript.json×12
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
Show all 12 locations
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · ai_docs/audits/20260930-1340/evidence/run2.transcript.json×6
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
Show all 6 locations
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · ai_docs/items/external-overload-candidate-handle-roundtrip.md
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · agents/audit-phase-runner.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Roslyn-Backed MCP Server
Local-first MCP (Model Context Protocol) server for semantic C# analysis, navigation, validation, and refactoring on real .sln / .slnx / .csproj workspaces. It uses Roslyn and MSBuildWorkspace, runs over stdio, and does not require Visual Studio. Refactoring tools follow a preview → apply discipline: previews return short-lived tokens, so agents can dry-run multi-file edits before mutating the workspace. It ships as a .NET global tool, a Claude Code plugin, and a source-buildable stdio host.
Correct package ID:Darylmcd.RoslynMcp · CLI:roslynmcp · Plugin:roslyn-mcp@roslyn-mcp-marketplace
Quick Start
Prerequisite: the .NET 10 SDK.
Option A — Install As A Global Tool
dotnet tool install -g Darylmcd.RoslynMcpUpdate later with dotnet tool update -g Darylmcd.RoslynMcp.
Configure a filesystem boundary before first use. The global tool ships a binary, not a config, and an unset boundary is fail-closed: every path-taking tool rejects its input. SetROSLYNMCP_SANCTIONED_ROOTSin your MCP client config (for example a project-scope.mcp.json):
>
``json { "mcpServers": { "roslyn": { "type": "stdio", "command": "roslynmcp", "env": { "ROSLYNMCP_SANCTIONED_ROOTS": "." } } } } ``>
. resolves against the server process's working directory, which your MCP client chooses; use an absolute path to pin the boundary. See Setup.Option B — Zero-Install Via dnx (.NET 10)
dnx resolves the package from NuGet on demand, without installing a global shim: run dnx Darylmcd.RoslynMcp. Pin a version for reproducible setups with Darylmcd.RoslynMcp@<version>. Configure the same ROSLYNMCP_SANCTIONED_ROOTS boundary as above; copy-paste configs live in docs/mcp-json-examples/, and details are in Setup.
Option C — Claude Code Plugin
/plugin marketplace add darylmcd/Roslyn-Backed-MCP
/plugin install roslyn-mcp@roslyn-mcp-marketplaceThe plugin bundles 32 skills and safety hooks, then launches the exact release-matched Darylmcd.RoslynMcp package through dnx; it does not require a global roslynmcp shim. The first launch requires NuGet access unless the package is already cached. The plugin's bundled "." boundary resolves to the session's working directory, so start Claude Code inside the repo you want to analyze; see Setup for the other supported overrides.
Per-Client Config
The JSON shape is the same across MCP clients (VS Code uses a top-level "servers" key); only the config file path differs. See the compatibility matrix for per-client paths and a health-check prompt, and docs/mcp-json-examples/ for copy-ready snippets.
Live Surface
The current release exposes 171 tools (110 stable / 61 experimental), 14 resources (9 stable / 5 experimental), and 20 prompts (all experimental).
Use the running server for the authoritative live catalog and support tiers:
server_infofor a human-readable summaryroslyn://server/catalogfor the machine-readable contractroslyn://server/resource-templatesfor resource URI templates
Stable families include workspace/session management, semantic navigation, diagnostics, build/test helpers, and preview/apply refactoring flows. Experimental families include broader project mutation, scaffolding, orchestration, direct text-edit helpers, and prompts. Set ROSLYNMCP_TOOL_TIERS=stable to register only the closed stable workflow (currently 91 callable tools) for clients that eagerly load tool definitions.
Configuration And Security
All operational settings are optional ROSLYNMCP_* environment variables with compiled-in defaults; the full reference is in docs/setup.md. The exception is ROSLYNMCP_SANCTIONED_ROOTS, which you must set (see above).
Loading a solution or project executes MSBuild evaluation: only load repositories you trust, or run the server in a sandbox. The filesystem boundary is server-owned; a client's MCP Roots can only narrow it. See docs/setup.md and SECURITY.md for the disclosure policy. Upgrading from 2.x? Read the migration notes first.
Docs
- docs/README.md — index of everything under
docs/ - docs/setup.md — packaging, install options, configuration, security model, plugin install, CI artifacts
- docs/compatibility.md — MCP client compatibility matrix and health check
- docs/stdio-client-integration.md — custom MCP client integration
- docs/product-contract.md — stable vs experimental surface contract
- docs/release-policy.md — release gates and compatibility rules
- CONTRIBUTING.md — build from source, tests, and filing surface-test findings
- AGENTS.md — bootstrap entry point for AI agents working in this repo
- ai_docs/README.md — canonical AI-doc routing index
Support
- Bugs and feature requests: GitHub Issues
- Contribution guidelines: CONTRIBUTING.md
- Security disclosures: SECURITY.md