DevProjex
NUGET · DEVPROJEX · 2 COMPONENTS
Read-only MCP server that turns a folder or repository into redacted, token-efficient context.
Available components
Last scanned (3 hours ago)
Scores higher than 78% of NuGet servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance not yet verified. View diagnostics → Unverified
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 33 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3397 tokens (~424/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 0
- Stability: 0.97 → pass security
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed nuget/devprojex@5.2.0
Provenance Inconclusive
We could not complete the check, so nothing is claimed either way. This is a gap on our side, not a finding about the package.
| Result | Inconclusive |
|---|---|
| Ecosystem | nuget |
| Reason | Signature present, unverified |
Signer
| Signed as | Repository signature, names nuget.org |
|---|---|
| Subject | CN=NuGet.org Repository by Microsoft,O=NuGet.org Repository by Microsoft,L=Redmond,ST=Washington,C=US |
| Issuer | CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US |
| Valid from | 23 Feb 2024 |
| Valid until | 18 May 2027 |
| Service index | https://api.nuget.org/v3/index.json |
| Owners | avazbek22 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
Registry declarations For information only
What the registry and the package's own manifest say about this version. The publisher or the registry writes these, nothing here is verified, and none of it affects the score.
| Repository | https://github.com/Avazbek22/DevProjex |
|---|---|
| Repository type | git |
| Commit | 3c22f8cf53c8e32a0b8f9372aff0c77aba7a793d |
| Project URL | https://github.com/Avazbek22/DevProjex |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze Analyze project ~548
Measures a selection before packaging: protected metrics, estimates, document size, and largest files. Use it to choose pack_context filters or max_tokens; use get_tree for structure and pack_context for content. Returns measured and estimated metrics without file bodies. Key parameters: detail=full|compact|signatures, top_files, git_scope, paths, include_patterns, exclude_patterns, profile, and max_file_bytes. Last detail_by_pattern match wins. max_tokens reports pack_context's greedy admission; rank and focus require it. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| detail | string | – | Content transform: full adds no transformations; transformations enabled by the active profile still apply. Compact removes comments and blank lines, and signatures keeps supported code signatures; o… |
| detail_by_pattern | array | – | Overrides detail by file in array order; the last match wins, never widens selection, and unmatched or invalid entries are reported. |
| exclude_patterns | – | – | Removes paths with the same project-relative glob syntax as include_patterns. |
| focus | – | – | Seeds focus-v1 order from 1..16 selected paths; requires rank=importance and never widens selection. |
| git_scope | – | – | Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree. |
| include_patterns | – | – | Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected. |
| max_file_bytes | – | – | Excludes selected files larger than this byte count; accepts an integer or numeric string. |
| max_tokens | – | – | Sets greedy content admission; document structure and its report are outside this heuristic token budget. |
| paths | – | – | Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary. |
| profile | string | – | Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| rank | string | – | Orders the selection with importance-v1 and controls max_tokens admission; omission keeps ordinary order and avoids dependency or Git-history work. |
| top_files | – | – | Returns this many largest text files by estimated tokens. |
| tracked_only | – | – | Restricts results to Git-tracked files; accepts a boolean or its string form. |
No output schema declared.
No examples provided.
get_file Get project file ~441
Reads selected text after mandatory secret and configured private-data replacement. Use it after get_tree or search_project; use pack_context for broad multi-file context. Use path for one page or requests for up to eight files and sixteen file/range/symbol selections; forms are exclusive. Send one batched call whenever you want more than one file, range, or known symbol: requests=[{"path":"src/a.ts","symbol":"Router.load"}]. Items report ok, partial, not-returned, or unavailable; overlapping ranges share a 1,000-line/50,000-character cap. Coordinates use returned text; start_column continues a page. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| end_line | – | – | Last inclusive 1-based returned-text line; accepts integer or numeric string. |
| path | string | – | Single-file form. Exactly one of path or requests is required. Names an existing selected file; Markdown escapes from the default get_tree format are accepted, while format=text supplies literal name… |
| profile | string | – | Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| requests | array | – | Batch form. Exactly one of requests or path is required. Reads up to eight files and sixteen selections; a path reads the whole file, while ranges or symbol narrow it. Single-file ranges cannot accom… |
| start_column | – | – | First 1-based Unicode character on start_line; use a returned continuation value. |
| start_line | – | – | First 1-based returned-text line; accepts integer or numeric string. |
| symbol | string | – | Reads a qualified, or file-unique simple, declaration with path instead of a range; search_project supplies names. Cannot combine with line or column fields; missing, unavailable, or non-unique decla… |
No output schema declared.
No examples provided.
get_tree Get project tree ~400
Returns filtered structure without contents. Use it to find files by name; use analyze instead for size and token metrics, or pack_context for multi-file content. Returns Markdown/text/JSON/XML within 2,000 lines and 50,000 characters. paths selects literal locations; include_patterns selects names or directories in one call, e.g. include_patterns=["src/middleware/{powered-by,body-limit,bearer-auth}/**/*handler*.ts"]. format=markdown|text|json|xml; max_depth=0..1000 counts levels below the project root; git_scope and filters only narrow. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| exclude_patterns | – | – | Removes paths with the same project-relative glob syntax as include_patterns. |
| format | string | – | Selects the tree representation; markdown is the compact default. |
| git_scope | – | – | Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree. |
| include_patterns | – | – | Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected. |
| max_depth | – | – | Limits levels below the project root without descending below a paths entry; omit it for the deepest complete tree that fits. |
| max_file_bytes | – | – | Excludes selected files larger than this byte count; accepts an integer or numeric string. |
| paths | – | – | Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| tracked_only | – | – | Restricts results to Git-tracked files; accepts a boolean or its string form. |
No output schema declared.
No examples provided.
list_projects List projects ~82
Lists local projects, profiles, and baseline filters. Use it to choose a root or inspect policy; use get_tree for structure. Returns indexes, protected names and paths, root types, profiles, and Git/exclusion policy. A local project accepts a unique listed name, #index, or absolute path returned by list_projects; remote URLs require opt-in. No parameters.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
pack_context Pack project context ~608
Builds multi-file project context. Use it after get_tree, search_project, or analyze; use get_file for one file. Returns inline untrusted project data, or pack_id plus a preview above 50,000 characters for read_pack. Key parameters: detail, view=tree|content|tree-content, format, rank, focus, max_tokens, git_scope, and detail_by_pattern. detail=full still transforms content. expand_related adds resolved selected neighbours. focus requires rank=importance; max_tokens admits greedily by estimate. Last pattern override wins. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| detail | string | – | Content transform: full adds no transformations; transformations enabled by the active profile still apply. Compact removes comments and blank lines, and signatures keeps supported code signatures; o… |
| detail_by_pattern | array | – | Overrides detail by file in array order; the last match wins, never widens selection, and unmatched or invalid entries are reported. |
| exclude_patterns | – | – | Removes paths with the same project-relative glob syntax as include_patterns. |
| expand_related | object | – | Adds resolved neighbours of seed files without widening filters or Git scope; stops at 400 files and reports the limit. |
| focus | – | – | Seeds focus-v1 order from 1..16 selected paths; requires rank=importance and never widens selection. |
| format | string | – | Chooses readable markdown/text or structured JSON/XML output. |
| git_scope | – | – | Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree. |
| include_patterns | – | – | Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected. |
| max_file_bytes | – | – | Excludes selected files larger than this byte count; accepts an integer or numeric string. |
| max_tokens | – | – | Sets greedy content admission; document structure and its report are outside this heuristic token budget. |
| paths | – | – | Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary. |
| profile | string | – | Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| rank | string | – | Orders the selection with importance-v1 and controls max_tokens admission; omission keeps ordinary order and avoids dependency or Git-history work. |
| tracked_only | – | – | Restricts results to Git-tracked files; accepts a boolean or its string form. |
| view | string | – | Chooses tree, file content, or both for the pack. |
No output schema declared.
No examples provided.
read_pack Read context pack ~172
Reads a stored result page created by pack_context, search_project, or related_files. Use its pack_id; use pack_context instead when no valid stored result exists. Returns untrusted data up to 1,000 lines or 50,000 characters with trusted continuation or range notes. Protection changes invalidate stored content; selection-only changes retain it with a warning. Ranges and columns are inclusive and 1-based.
| Name | Type | Req | Description |
|---|---|---|---|
| end_line | – | – | Last inclusive 1-based returned-text line; accepts integer or numeric string. |
| pack_id | string | yes | Session id returned by pack_context, search_project, or related_files. |
| start_column | – | – | First 1-based Unicode character on start_line; use a returned continuation value. |
| start_line | – | – | First 1-based returned-text line; accepts integer or numeric string. |
No output schema declared.
No examples provided.
related_files Find related files ~392
Finds evidenced dependencies and dependents for one to 16 seed files without widening selection. Use it after search_project or get_tree; use search_project for text references or get_file for content. Returns paths, evidence, resolution status, token estimates, language coverage, partial-parse and configuration diagnostics, and scope; results above 50,000 characters use read_pack. Key parameters: path, direction=dependencies|dependents|both, profile, git_scope, include_patterns, exclude_patterns, and max_file_bytes. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| direction | string | – | Chooses outward dependencies, inward dependents, or both. |
| exclude_patterns | – | – | Removes paths with the same project-relative glob syntax as include_patterns. |
| git_scope | – | – | Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree. |
| include_patterns | – | – | Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected. |
| max_file_bytes | – | – | Excludes selected files larger than this byte count; accepts an integer or numeric string. |
| path | – | yes | Seed file, or up to 16 seed files, within the effective selection. |
| profile | string | – | Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| tracked_only | – | – | Restricts results to Git-tracked files; accepts a boolean or its string form. |
No output schema declared.
No examples provided.
search_project Search project ~492
Searches transformed text with a timed .NET regex. It matches file content, never paths; find names with get_tree include_patterns. Use it for symbols or phrases; symbols=true finds declarations, not uses; use related_files for dependency links. Returns grouped numbered matches, merged context, complete|partial status, inspected/retained/written counts, and continuation. Line numbers use returned text; generated redaction replacements never match. Key parameters: pattern, paths, context_lines, ignore_case, max_results=1..200, git_scope, include_patterns, exclude_patterns, and max_file_bytes. The best unique declaration includes up to 1,800 protected body characters within the same cap. Project: unique listed name, absolute path returned by list_projects, or #index.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | string | – | Remote Git branch; invalid for local projects. |
| context_lines | – | – | Context lines per match; overlapping windows merge. |
| exclude_patterns | – | – | Removes paths with the same project-relative glob syntax as include_patterns. |
| git_scope | – | – | Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree. |
| ignore_case | – | – | Enables case-insensitive matching; accepts a boolean or its string form. |
| include_patterns | – | – | Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected. |
| max_file_bytes | – | – | Excludes selected files larger than this byte count; accepts an integer or numeric string. |
| max_results | – | – | Limits displayed match lines while scanning continues; the boundary reports encountered, retained, and written counts. |
| paths | – | – | Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary. |
| pattern | string | yes | Required .NET regex with a 2-second timeout over redacted file content, never paths; use get_tree include_patterns for names. Text inserted by redaction never matches. |
| project | string | – | unique listed name, absolute path returned by list_projects, or #index. |
| symbols | – | – | Match declarations of the name in pattern (Foo, class Foo, Foo|Bar), not uses. |
| tracked_only | – | – | Restricts results to Git-tracked files; accepts a boolean or its string form. |
No output schema declared.
No examples provided.
How do I install the DevProjex MCP server?
DevProjex runs locally as a NuGet package, launched with dnx devprojex@5.2.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · devprojex
claude mcp add avazbek22-devprojex -- dnx devprojex@5.2.0 --yes
What is the DevProjex MCP server?
DevProjex is an MCP server listed in the public MCP registry as io.github.Avazbek22/devprojex. Read-only MCP server that turns a folder or repository into redacted, token-efficient context. This page covers its NuGet package (devprojex).
Is the DevProjex MCP server safe to use?
DevProjex scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the DevProjex MCP server expose?
DevProjex exposes 8 tools: list_projects, get_tree, analyze, pack_context, read_pack, and 3 more. Their descriptions and schemas cost roughly 3,135 tokens of context every time the server is loaded.
Is the DevProjex MCP server still maintained?
DevProjex is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the DevProjex MCP server under?
DevProjex declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.