# DevProjex (nuget · devprojex)

Read-only MCP server that turns a folder or repository into redacted, token-efficient context.

- Trust score: 83/100 (high trust)
- Change this week: +1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `devprojex`: 40/100, [markdown](https://verifymcp.io/servers/avazbek22-devprojex/devprojex.md), [page](https://verifymcp.io/servers/avazbek22-devprojex/devprojex)
- nuget · `devprojex`: 83/100 (this document), [markdown](https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2.md), [page](https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2)

## Channel facts

- Registry: `nuget`
- Package: `devprojex`
- Version: `5.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Build provenance not yet verified.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 33 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3397 tokens (~424/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the DevProjex MCP server?

DevProjex runs locally as a NuGet package, launched with dnx devprojex@5.2.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add avazbek22-devprojex -- dnx devprojex@5.2.0 --yes
```

### Cursor

```json
{
  "mcpServers": {
    "avazbek22-devprojex": {
      "command": "dnx",
      "args": [
        "devprojex@5.2.0",
        "--yes"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "avazbek22-devprojex": {
      "command": "dnx",
      "args": [
        "devprojex@5.2.0",
        "--yes"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add avazbek22-devprojex -- dnx devprojex@5.2.0 --yes
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "avazbek22-devprojex": {
      "type": "local",
      "command": [
        "dnx",
        "devprojex@5.2.0",
        "--yes"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  avazbek22-devprojex:
    command: "dnx"
    args: ["devprojex@5.2.0", "--yes"]
```

### Netclaw

```json
{
  "McpServers": {
    "avazbek22-devprojex": {
      "Transport": "stdio",
      "Command": "dnx",
      "Arguments": [
        "devprojex@5.2.0",
        "--yes"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "avazbek22-devprojex": {
      "command": "dnx",
      "args": [
        "devprojex@5.2.0",
        "--yes"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-01 (score 83, 0)

- [security] Stability: 0.97 → pass

### 2026-10-31 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-18 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (8)

### `list_projects` (~82 tokens)

List projects

Lists local projects, profiles, and baseline filters. Use it to choose a root or inspect policy; use get_tree for structure. Returns indexes, protected names and paths, root types, profiles, and Git/exclusion policy. A local project accepts a unique listed name, #index, or absolute path returned by list_projects; remote URLs require opt-in. No parameters.

### `get_tree` (~400 tokens)

Get project tree

Returns filtered structure without contents. Use it to find files by name; use analyze instead for size and token metrics, or pack_context for multi-file content. Returns Markdown/text/JSON/XML within 2,000 lines and 50,000 characters. paths selects literal locations; include_patterns selects names or directories in one call, e.g. include_patterns=["src/middleware/{powered-by,body-limit,bearer-auth}/**/*handler*.ts"]. format=markdown|text|json|xml; max_depth=0..1000 counts levels below the project root; git_scope and filters only narrow. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `exclude_patterns`: Removes paths with the same project-relative glob syntax as include_patterns.
- `format` (string): Selects the tree representation; markdown is the compact default.
- `git_scope`: Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree.
- `include_patterns`: Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected.
- `max_depth`: Limits levels below the project root without descending below a paths entry; omit it for the deepest complete tree that fits.
- `max_file_bytes`: Excludes selected files larger than this byte count; accepts an integer or numeric string.
- `paths`: Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `tracked_only`: Restricts results to Git-tracked files; accepts a boolean or its string form.

### `analyze` (~548 tokens)

Analyze project

Measures a selection before packaging: protected metrics, estimates, document size, and largest files. Use it to choose pack_context filters or max_tokens; use get_tree for structure and pack_context for content. Returns measured and estimated metrics without file bodies. Key parameters: detail=full|compact|signatures, top_files, git_scope, paths, include_patterns, exclude_patterns, profile, and max_file_bytes. Last detail_by_pattern match wins. max_tokens reports pack_context's greedy admission; rank and focus require it. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `detail` (string): Content transform: full adds no transformations; transformations enabled by the active profile still apply. Compact removes comments and blank lines, and signatures keeps supported code signatures; o…
- `detail_by_pattern` (array): Overrides detail by file in array order; the last match wins, never widens selection, and unmatched or invalid entries are reported.
- `exclude_patterns`: Removes paths with the same project-relative glob syntax as include_patterns.
- `focus`: Seeds focus-v1 order from 1..16 selected paths; requires rank=importance and never widens selection.
- `git_scope`: Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree.
- `include_patterns`: Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected.
- `max_file_bytes`: Excludes selected files larger than this byte count; accepts an integer or numeric string.
- `max_tokens`: Sets greedy content admission; document structure and its report are outside this heuristic token budget.
- `paths`: Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary.
- `profile` (string): Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `rank` (string): Orders the selection with importance-v1 and controls max_tokens admission; omission keeps ordinary order and avoids dependency or Git-history work.
- `top_files`: Returns this many largest text files by estimated tokens.
- `tracked_only`: Restricts results to Git-tracked files; accepts a boolean or its string form.

### `pack_context` (~608 tokens)

Pack project context

Builds multi-file project context. Use it after get_tree, search_project, or analyze; use get_file for one file. Returns inline untrusted project data, or pack_id plus a preview above 50,000 characters for read_pack. Key parameters: detail, view=tree|content|tree-content, format, rank, focus, max_tokens, git_scope, and detail_by_pattern. detail=full still transforms content. expand_related adds resolved selected neighbours. focus requires rank=importance; max_tokens admits greedily by estimate. Last pattern override wins. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `detail` (string): Content transform: full adds no transformations; transformations enabled by the active profile still apply. Compact removes comments and blank lines, and signatures keeps supported code signatures; o…
- `detail_by_pattern` (array): Overrides detail by file in array order; the last match wins, never widens selection, and unmatched or invalid entries are reported.
- `exclude_patterns`: Removes paths with the same project-relative glob syntax as include_patterns.
- `expand_related` (object): Adds resolved neighbours of seed files without widening filters or Git scope; stops at 400 files and reports the limit.
- `focus`: Seeds focus-v1 order from 1..16 selected paths; requires rank=importance and never widens selection.
- `format` (string): Chooses readable markdown/text or structured JSON/XML output.
- `git_scope`: Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree.
- `include_patterns`: Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected.
- `max_file_bytes`: Excludes selected files larger than this byte count; accepts an integer or numeric string.
- `max_tokens`: Sets greedy content admission; document structure and its report are outside this heuristic token budget.
- `paths`: Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary.
- `profile` (string): Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `rank` (string): Orders the selection with importance-v1 and controls max_tokens admission; omission keeps ordinary order and avoids dependency or Git-history work.
- `tracked_only`: Restricts results to Git-tracked files; accepts a boolean or its string form.
- `view` (string): Chooses tree, file content, or both for the pack.

### `read_pack` (~172 tokens)

Read context pack

Reads a stored result page created by pack_context, search_project, or related_files. Use its pack_id; use pack_context instead when no valid stored result exists. Returns untrusted data up to 1,000 lines or 50,000 characters with trusted continuation or range notes. Protection changes invalidate stored content; selection-only changes retain it with a warning. Ranges and columns are inclusive and 1-based.

Input parameters:

- `end_line`: Last inclusive 1-based returned-text line; accepts integer or numeric string.
- `pack_id` (string, required): Session id returned by pack_context, search_project, or related_files.
- `start_column`: First 1-based Unicode character on start_line; use a returned continuation value.
- `start_line`: First 1-based returned-text line; accepts integer or numeric string.

### `search_project` (~492 tokens)

Search project

Searches transformed text with a timed .NET regex. It matches file content, never paths; find names with get_tree include_patterns. Use it for symbols or phrases; symbols=true finds declarations, not uses; use related_files for dependency links. Returns grouped numbered matches, merged context, complete|partial status, inspected/retained/written counts, and continuation. Line numbers use returned text; generated redaction replacements never match. Key parameters: pattern, paths, context_lines, ignore_case, max_results=1..200, git_scope, include_patterns, exclude_patterns, and max_file_bytes. The best unique declaration includes up to 1,800 protected body characters within the same cap. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `context_lines`: Context lines per match; overlapping windows merge.
- `exclude_patterns`: Removes paths with the same project-relative glob syntax as include_patterns.
- `git_scope`: Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree.
- `ignore_case`: Enables case-insensitive matching; accepts a boolean or its string form.
- `include_patterns`: Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected.
- `max_file_bytes`: Excludes selected files larger than this byte count; accepts an integer or numeric string.
- `max_results`: Limits displayed match lines while scanning continues; the boundary reports encountered, retained, and written counts.
- `paths`: Narrows selection to literal paths for existing project-relative files or directories; glob characters are ordinary.
- `pattern` (string, required): Required .NET regex with a 2-second timeout over redacted file content, never paths; use get_tree include_patterns for names. Text inserted by redaction never matches.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `symbols`: Match declarations of the name in pattern (Foo, class Foo, Foo|Bar), not uses.
- `tracked_only`: Restricts results to Git-tracked files; accepts a boolean or its string form.

### `related_files` (~392 tokens)

Find related files

Finds evidenced dependencies and dependents for one to 16 seed files without widening selection. Use it after search_project or get_tree; use search_project for text references or get_file for content. Returns paths, evidence, resolution status, token estimates, language coverage, partial-parse and configuration diagnostics, and scope; results above 50,000 characters use read_pack. Key parameters: path, direction=dependencies|dependents|both, profile, git_scope, include_patterns, exclude_patterns, and max_file_bytes. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `direction` (string): Chooses outward dependencies, inward dependents, or both.
- `exclude_patterns`: Removes paths with the same project-relative glob syntax as include_patterns.
- `git_scope`: Narrows to staged, changed (including untracked files), or diff:<ref>..<ref> paths; content stays from the current working tree.
- `include_patterns`: Narrows with project-relative '/' globs: '*' and '?' stay in one segment, '**/' spans depths, and '{a,b}' alternates; matching is case-sensitive, while '!' and '[...]' are rejected.
- `max_file_bytes`: Excludes selected files larger than this byte count; accepts an integer or numeric string.
- `path` (required): Seed file, or up to 16 seed files, within the effective selection.
- `profile` (string): Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `tracked_only`: Restricts results to Git-tracked files; accepts a boolean or its string form.

### `get_file` (~441 tokens)

Get project file

Reads selected text after mandatory secret and configured private-data replacement. Use it after get_tree or search_project; use pack_context for broad multi-file context. Use path for one page or requests for up to eight files and sixteen file/range/symbol selections; forms are exclusive. Send one batched call whenever you want more than one file, range, or known symbol: requests=[{"path":"src/a.ts","symbol":"Router.load"}]. Items report ok, partial, not-returned, or unavailable; overlapping ranges share a 1,000-line/50,000-character cap. Coordinates use returned text; start_column continues a page. Project: unique listed name, absolute path returned by list_projects, or #index.

Input parameters:

- `branch` (string): Remote Git branch; invalid for local projects.
- `end_line`: Last inclusive 1-based returned-text line; accepts integer or numeric string.
- `path` (string): Single-file form. Exactly one of path or requests is required. Names an existing selected file; Markdown escapes from the default get_tree format are accepted, while format=text supplies literal name…
- `profile` (string): Selection profile: standard uses all eight exclusion toggles plus gitignore; local uses the desktop profile listed by list_projects.profiles; otherwise give a portable profile path inside the project.
- `project` (string): unique listed name, absolute path returned by list_projects, or #index.
- `requests` (array): Batch form. Exactly one of requests or path is required. Reads up to eight files and sixteen selections; a path reads the whole file, while ranges or symbol narrow it. Single-file ranges cannot accom…
- `start_column`: First 1-based Unicode character on start_line; use a returned continuation value.
- `start_line`: First 1-based returned-text line; accepts integer or numeric string.
- `symbol` (string): Reads a qualified, or file-unique simple, declaration with path instead of a range; search_project supplies names. Cannot combine with line or column fields; missing, unavailable, or non-unique decla…

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2#diagnostics

## Score history

- 2026-11-05: 83
- 2026-11-04: 83
- 2026-11-03: 83
- 2026-11-02: 83
- 2026-11-01: 83
- 2026-10-31: 83
- 2026-10-30: 82
- 2026-10-29: 82
- 2026-10-28: 81
- 2026-10-27: 81
- 2026-10-26: 81
- 2026-10-25: 80
- 2026-10-24: 80
- 2026-10-23: 79
- 2026-10-22: 79
- 2026-10-21: 78
- 2026-10-20: 78
- 2026-10-19: 77
- 2026-10-18: 77
- 2026-10-17: 76
- 2026-10-16: 76
- 2026-10-15: 75
- 2026-10-14: 75
- 2026-10-13: 69
- 2026-10-12: 69
- 2026-10-06: 69
- 2026-10-05: 69
- 2026-10-04: 69
- 2026-10-03: 69
- 2026-10-02: 54

## Common questions

### What is the DevProjex MCP server?

DevProjex is an MCP server listed in the public MCP registry as io.github.Avazbek22/devprojex. Read-only MCP server that turns a folder or repository into redacted, token-efficient context. This page covers its NuGet package (devprojex).

### Is the DevProjex MCP server safe to use?

DevProjex scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the DevProjex MCP server expose?

DevProjex exposes 8 tools: list_projects, get_tree, analyze, pack_context, read_pack, and 3 more. Their descriptions and schemas cost roughly 3,135 tokens of context every time the server is loaded.

### Is the DevProjex MCP server still maintained?

DevProjex is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the DevProjex MCP server under?

DevProjex declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- NuGet package: https://www.nuget.org/packages/devprojex
- Socket report: https://socket.dev/nuget/package/devprojex
- Repository: https://github.com/Avazbek22/DevProjex
- Changelog RSS feed: https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2.xml
- Changelog JSON feed: https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2.json
- HTML version of this page: https://verifymcp.io/servers/avazbek22-devprojex/devprojex-2