PlugWiki
Microsoft NuGet logo

NuGet MCP Server: Setup for Claude, Cursor and VS Code

OfficialLocal
Getnuget/home
Tools
6
3 read · 3 change
Works in
12
apps
Risk
Medium
can write
Version
1.4.23
last commit Oct 2026

Lets your AI assistant check, fix and upgrade the NuGet packages in your .NET projects.

This is Microsoft's own NuGet server. It runs on your computer and uses the NuGet feeds you already have configured, so the assistant sees the same packages your build does. It needs the .NET SDK installed, and the install box shows the exact setup for each app. Visual Studio 2026 includes it, and you switch it on once in the Copilot chat tools menu.

It can edit your project files when you ask it to fix or upgrade packages, so keep your work committed before you start.

Good for

  • .NET developers who want the assistant to fix packages with known vulnerabilities
  • Teams planning package upgrades who want the assistant to check versions against their own feeds
  • Maintainers tightening a repo's NuGet setup, such as source mapping and audit settings

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Microsoft NuGet MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Microsoft NuGet MCP server to Claude Code. Run this command:

claude mcp add nuget -- dnx NuGet.Mcp.Server --source https://api.nuget.org/v3/index.json --yes

Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires .NET 10 SDK or later (adds dnx).

Read-only mode: There is no read-only setting. Ask only for version lookups and the supply-chain review if you want nothing changed.

Install the .NET 10 SDK or later first, because it provides the dnx command that downloads and runs the server. These configs are our adaptation of the README's dnx example, which names VS Code, Visual Studio and the GitHub Copilot coding agent. Add a version to the package name to pin it. There is no read-only setting.

Built from the package data we hold. Not yet tested by us.

Tools

  • Looks up the newest version of a NuGet package

    Returns the latest version of a package from your configured NuGet feeds.

    Try: “What is the latest version of Newtonsoft.Json?”

    Network · get_latest_package_version

  • Shows a package's guide for AI tools, or its README

    Returns the package's AGENTS.md file when it has one, and otherwise its README, so the assistant can use the package correctly.

    Try: “Read the README for the Serilog package before I use it”

    Network · get_package_context

  • Checks how safely your repo handles NuGet packages

    Reviews your repository's NuGet setup, such as Central Package Management, NuGet Audit, Package Source Mapping and NuGet.Config, and suggests ways to harden it.

    Try: “Review the NuGet supply-chain security of this repository”

    Files · review_supply_chain_security

  • Fixes packages with known security holes

    Finds the smallest version changes that remove known vulnerabilities, including ones in indirect dependencies, and applies them to your projects.

    Try: “Fix the vulnerable NuGet packages in this solution”

    Write · fix_vulnerable_packages

  • Upgrades packages to their newest compatible versions

    Upgrades the NuGet packages in your project to the latest versions your configured feeds offer that work with your project.

    Try: “Upgrade all NuGet packages in this project to the latest versions”

    Write · upgrade_packages_to_latest

  • Sets packages to exact versions you choose

    Updates one or more packages to the exact versions you name while keeping the dependency graph working together.

    Try: “Update Microsoft.Extensions.Logging to 9.0.0”

    Write · update_package_version

Read from the source code

Permissions

medium risk · 3 things to watch

Medium risk

The assistant can change package versions in your project files, and the server has no read-only switch. Commit your work before you ask for fixes or upgrades and review what changed.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It changes package versions in your projects

    Three tools apply fixes and upgrades to your project files. Commit your work first, then review the diff before you build. github.com

  • It uses your private feeds

    It reads packages from the feeds in your NuGet settings, including private ones. Only use it on machines where those feeds are meant to be used. github.com

  • Microsoft collects usage data by default

    The README says telemetry is on and can be switched off by setting DOTNET_CLI_TELEMETRY_OPTOUT to true or 1. github.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Talks toYour configured NuGet feeds. Microsoft (telemetry, can be turned off)
Sign-in and keysNo sign-in of its own. It uses the NuGet feed settings and credentials already on your machine.

Questions

Is the NuGet MCP server official?

Yes. Microsoft publishes it as the NuGet.Mcp.Server package, and the NuGet team documents it on Microsoft Learn.

What do I need installed?

The .NET 10 SDK or later. It adds the dnx command that downloads and runs the server from nuget.org. Check your version with dotnet --info.

Is it built into Visual Studio?

Yes, in Visual Studio 2026. Open the GitHub Copilot chat, open the tools menu and tick the server named nuget. Visual Studio 2022 needs version 17.14 or later and a manual config.

Does it need an API key or sign-in?

No. It has no sign-in of its own. It uses the NuGet feeds and credentials already set up on your machine.

Can it run read-only?

Not as a setting. Only get_latest_package_version, get_package_context and review_supply_chain_security leave your files alone, so ask for those, or review each change before you accept it.

Does it send data to Microsoft?

Yes, telemetry is on by default. Set the environment variable DOTNET_CLI_TELEMETRY_OPTOUT to true or 1 to turn it off.

How do I pin a version of the server?

Add the version to the package name, as in NuGet.Mcp.Server@1.0.0. You then need to update it by hand as new releases come out.

Information

updated Nov 2, 2026

Publisher
Official
Transport
stdio
Version
1.4.23
Last commit
Oct 20, 2026
Open issues
1,350
Listed in
Official MCP registry

GitHubOfficial MCP RegistryChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 2
  1. NuGet MCP Server README · github.com
  2. Using the NuGet MCP Server · learn.microsoft.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.