NuGet MCP Server

Contains a Model Context Protocol (MCP) server for NuGet, enabling advanced tooling and automation scenarios for NuGet package management. See the official NuGet MCP documentation for the latest information.

Capabilities

• Uses your configured NuGet feeds to get real-time information about packages.
• Provides conservative remediation planning for packages with known vulnerabilities, including transitive dependencies.
• Provides package upgrade planning based on a project's package graph and target frameworks.
• Reviews your repository's NuGet supply-chain posture (Central Package Management, NuGet Audit, Package Source Mapping, and NuGet.Config validity) and recommends hardening steps.

Requirements

To run the MCP server, you must have .NET 10 Preview 6 or later installed. This version of .NET adds a command, dnx, which is used to download, install, and run the MCP server from nuget.org.

To verify your .NET version, run the following command in your terminal:

dotnet --info

Getting Started

To configure the NuGet MCP server, you will need to modify an mcp.json file or other configuration. The following table provides links to documentation for configuring MCP servers in different environments:

Visual Studio 2026

The NuGet MCP server ships in-box with Visual Studio 2026. You must enable it the first time in the GitHub Copilot chat tools menu.

If you'd like to use a newer version of the NuGet MCP server than the one included with Visual Studio, you can configure it with the following snippet and include it in your mcp.json:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

If you'd like to use a specific version of the MCP server, you can specify it with package name like NuGet.Mcp.Server@1.0.0:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server@1.0.0", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

When configured this way, you will need to update the version as new releases become available.

See File locations for automatic discovery of MCP configuration for more information on the location of the appropriate mcp.json for you.

Visual Studio 2022

To configure the MCP server for use with Visual Studio 2022, make sure you have update 17.14 or later installed. Then use the following snippet and include it in your mcp.json:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

If you'd like to use a specific version of the MCP server, you can specify it with package name like NuGet.Mcp.Server@1.0.0:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server@1.0.0", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

When configured this way, you will need to update the version as new releases become available.

See File locations for automatic discovery of MCP configuration for more information on the location of the appropriate mcp.json for you.

VS Code

To configure the NuGet MCP server in VS code, you can use the following badges to quickly install the MCP server:

To manually configure the MCP server for use with Visual Studio or VS Code, use the following snippet and include it in your mcp.json:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

If you'd like to use a specific version of the MCP server, you can specify it with package name like NuGet.Mcp.Server@1.0.0:

{
  "servers": {
    "nuget": {
      "type": "stdio",
      "command": "dnx",
      "args": [ "NuGet.Mcp.Server@1.0.0", "--source", "https://api.nuget.org/v3/index.json", "--yes" ]
    }
  }
}

When configured this way, you will need to update the version as new releases become available.

See MCP configuration in VS Code for more information on the location of the appropriate mcp.json for you.

GitHub Copilot

You can also configure the MCP Server to work with GitHub Copilot as a Coding Agent in your repositories.

First, you need to add the MCP Server configuration in your Copilot Coding Agent:

{ 
  "mcpServers": {
    "NuGet": {
      "type": "local",
      "command": "dnx",
      "args": ["NuGet.Mcp.Server", "--yes"],
      "tools": ["*"],
      "env": {}
    }
  } 
}

This will make all the MCP Server tools available, if you want specific tools you can list them in the "tools" parameter array.

You will also need to make sure Copilot installs .NET 10 Preview 6 or higher in order to have the command dnx and install the MCP Server.

.github/workflows/copilot-setup-steps.yml

name: "Copilot Setup Steps"

# Automatically run the setup steps when they are changed to allow for easy validation, and
# allow manual testing through the repository's "Actions" tab
on:
  workflow_dispatch:
  push:
    paths:
      - .github/workflows/copilot-setup-steps.yml
  pull_request:
    paths:
      - .github/workflows/copilot-setup-steps.yml

jobs:
  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
  copilot-setup-steps:
    runs-on: ubuntu-latest

    # Set the permissions to the lowest permissions possible needed for your steps.
    # Copilot will be given its own token for its operations.
    permissions:
      # If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete.
      contents: read

    # You can define any steps you want, and they will run before the agent starts.
    # If you do not check out your code, Copilot will do this for you.
    steps:
      - name: Install .NET 10.x
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            10.x
          dotnet-quality: preview

      - name: dotnet --info
        run: dotnet --info

Currently Supported Tools

• fix_vulnerable_packages: Fixes known security vulnerabilities in NuGet dependencies by computing the smallest safe version changes.
• upgrade_packages_to_latest: Upgrades NuGet packages to the latest compatible versions available from configured package sources.
• get_latest_package_version: Returns the latest version of a NuGet package.
• get_package_context: Returns the AGENTS.md context for a NuGet package when available; otherwise returns the package README.
• update_package_version: Updates one or more NuGet packages to exact target versions while keeping the dependency graph compatible.
• review_supply_chain_security: Reviews and recommends hardening steps for your repository's NuGet supply‑chain posture (eg, Central Package Management, NuGet Audit, Package Source Mapping, and NuGet.Config validation).

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft's privacy statement. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

Telemetry Configuration

Telemetry collection is on by default to help improve the product. This can be disabled, see Disabling All Telemetry section below for more details.

Disabling Telemetry Only

To disable Microsoft telemetry collection, set the environment variable DOTNET_CLI_TELEMETRY_OPTOUT to true or 1:

export DOTNET_CLI_TELEMETRY_OPTOUT=true

Support

If you experience an issue with the NuGet MCP server or have any other feedback, please open an issue on the NuGet GitHub repository. Please provide the requested information in the issue template so that we can better understand and address your issue or suggestion.

No Warranty / Limitation of Liability

This software is provided "as is" without warranties or conditions of any kind, either express or implied. Microsoft shall not be liable for any damages arising from use, misuse, or misconfiguration of this software.