NuGet MCP Server
The official Microsoft NuGet MCP server: live package data, upgrade planning and vulnerability remediation for .NET projects.
- 1,553 ★ on the repository
- Last commit
Minimal access
Why this level
- Reads package data from NuGet feeds and drafts plans; the assistant itself makes project changes with your approval.
Install
- Works in
Manual install
{"servers":{"nuget":{"type":"stdio","command":"dnx","args":["NuGet.Mcp.Server","--source","https://api.nuget.org/v3/index.json","--yes"]}}}A `mcp.json` snippet for Visual Studio and VS Code.
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- Reads package data from NuGet feeds and drafts plans; the assistant itself makes project changes with your approval.
This is third-party code. Review the repository files before installing.
What it does
The NuGet MCP server takes package information from the configured NuGet feeds, so the assistant works with current package versions. It builds a conservative plan for fixing known vulnerabilities, including transitive dependencies, and an upgrade plan based on the project package graph and target frameworks. It also reviews the supply-chain posture of a repository: Central Package Management, NuGet Audit, Package Source Mapping and the validity of `NuGet.Config`, then recommends hardening steps. It starts through the `dnx` command that arrived with .NET 10 and downloads the server from nuget.org.
Who it is for. .NET developers in Visual Studio, VS Code and GitHub Copilot who update dependencies and work through NuGet audit warnings.
Good fit when
- The audit reports a vulnerability in a transitive package and a safe version has to be chosen.
- Before a target framework upgrade the assistant drafts a package change plan.
- A team enables Central Package Management and checks its feed configuration.
- Copilot Coding Agent updates dependencies in a repository on request.
Not a fit when
- The project is not .NET and does not use NuGet.
- The machine has a .NET SDK older than version 10 and the `dnx` command is missing.
- The package feed is private and access from the developer machine is not configured.
Example request
Find vulnerable packages in the solution, including transitive ones, and propose a minimal upgrade plan that keeps target frameworks working.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
It needs .NET 10 Preview 6 or newer, which introduced the `dnx` command. Visual Studio 2022 supports the server from update 17.14, and Visual Studio 2026 ships it in the box but it must be enabled on first use in the GitHub Copilot Chat tools menu. An unversioned name always fetches the latest release, so pin a specific one (`NuGet.Mcp.Server@1.0.0`) and update it by hand. For Copilot Coding Agent add a .NET 10 install to `copilot-setup-steps.yml`.
How to disable. Remove the `nuget` entry from `mcp.json` or disable the server in the Copilot Chat tools menu. The downloaded package stays in the `dnx` cache and is cleaned with the other .NET caches.
FAQ
How do I connect NuGet MCP in VS Code?
Click the Install Server button from the README or add a `nuget` server to `mcp.json` with the command `dnx` and the arguments `NuGet.Mcp.Server --source https://api.nuget.org/v3/index.json --yes`.
Do I need to install anything for Visual Studio 2026?
The server is already in the box and only needs enabling in the GitHub Copilot Chat tools menu. A newer version is connected through `mcp.json`.
How do I pin the server version?
Put the package name with a number in the arguments, for example `NuGet.Mcp.Server@1.0.0`. New releases then have to be picked up by hand.
What does the server check in a repository?
Central Package Management, NuGet Audit, Package Source Mapping and the validity of `NuGet.Config`. It then recommends supply-chain hardening steps.
Which .NET version is required?
.NET 10 Preview 6 or newer. `dotnet --info` shows the installed version. The `dnx` command from that version downloads the server from nuget.org and runs it.
Discussion
No questions or reviews yet.
Related
MCP serversRoslyn CodeLens MCP gives an agent a semantic map of a .NET solution: callers, type hierarchies, DI, diagnostics and safe renames
A plugin with skills for building TypeScript MCP servers and MCP apps: the agent scaffolds, edits, debugs and verifies them
A Unity package: the Editor serves MCP over HTTP itself, and agents and the command line drive scenes, assets and builds
Nx MCP server: the agent sees monorepo projects, reads Nx docs and inspects failed CI tasks in Nx Cloud
A transparent proxy between an AI client and an MCP server: shows every JSON-RPC frame in the terminal, checks a capture in CI and exports spans
Microsoft's free official MCP server for Microsoft Learn docs: search, page fetch and code samples with no key
README in short
The server lives in the `mcp` folder of the NuGet Home repository, which also tracks NuGet client proposals. Setup documentation covers Visual Studio, VS Code and GitHub Copilot.