CodeMap
NUGET · CODEMAP-MCP
Roslyn-powered MCP server for C#/VB.NET. Query symbols, call graphs, and facts. 90%+ token savings.
Available components
Last scanned (22 hours ago)
Scores higher than 60% of NuGet servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance not yet verified. View diagnostics → Unverified
- Licence could not be checked: the licence is shipped as a file inside the package, not declared as a standard (SPDX) licence identifier, so we cannot tell whether it is OSI-approved.Unverified
- Actively maintained (last published 34 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2970 tokens (~114/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 98% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "index.cleanup" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 0
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Oct 26 −2
- Stability: pass → 0.80 functional
- 3 Oct 26 0
- Stability: 0.97 → pass security
- 2 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed nuget/codemap-mcp@1.4.0
Provenance Inconclusive
We could not complete the check, so nothing is claimed either way. This is a gap on our side, not a finding about the package.
| Result | Inconclusive |
|---|---|
| Ecosystem | nuget |
| Reason | Signature present, unverified |
Signer
| Signed as | Repository signature, names nuget.org |
|---|---|
| Subject | CN=NuGet.org Repository by Microsoft,O=NuGet.org Repository by Microsoft,L=Redmond,ST=Washington,C=US |
| Issuer | CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US |
| Valid from | 23 Feb 2024 |
| Valid until | 18 May 2027 |
| Service index | https://api.nuget.org/v3/index.json |
| Owners | BranimirBajt |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
Registry declarations For information only
What the registry and the package's own manifest say about this version. The publisher or the registry writes these, nothing here is verified, and none of it affects the score.
| Repository | https://github.com/bbajt/csharp-code-map |
|---|---|
| Repository type | git |
| Commit | 7f54adbddfa2c4d435de9a389425c0827e00c98c |
| Project URL | https://github.com/bbajt/csharp-code-map |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
code.get_span ~131
Read a bounded excerpt of source code with line numbers.
| Name | Type | Req | Description |
|---|---|---|---|
| context_lines | integer | – | Extra lines before/after (default: 0) |
| end_line | integer | yes | – |
| file_path | string | yes | Repo-relative file path |
| max_lines | integer | – | Budget cap (default: 120) |
| repo_path | string | yes | Absolute path to the repository root |
| start_line | integer | yes | – |
| virtual_files | array | – | Optional unsaved file contents for Ephemeral mode (requires workspace_id) |
| workspace_id | string | – | Optional: workspace ID for overlay data |
No output schema declared.
No examples provided.
code.search_text ~155
Search indexed source file content by regex pattern. Returns file:line:excerpt for each match. Searches only indexed files (no bin/obj). Use file_path to restrict to a subtree.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | File path prefix filter (e.g. 'src/' for production files only, 'tests/' for test files). |
| limit | integer | – | Max matches to return (default: 50, max: 200) |
| pattern | string | yes | Regular expression to search for (line-by-line). Example: 'OrderService\b' or 'TODO:' |
| repo_path | string | yes | Absolute path to the repository root |
| workspace_id | string | – | Optional: workspace ID for overlay data |
No output schema declared.
No examples provided.
codemap.export ~172
Export the indexed codebase as a self-contained markdown or JSON document for pasting into any LLM chat interface. Supports summary/standard/full detail levels and a token budget.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Detail level: summary (overview only), standard (+ public API, dependencies, interfaces), full (+ all symbols, reference matrix). Default: standard. |
| format | string | – | Output format: markdown (default) or json. |
| max_tokens | integer | – | Token budget for the exported content. Defaults to 4000. |
| repo_path | string | yes | Absolute path to the repository root |
| section_filter | array | – | Optional: list of sections to include (public_api, dependencies, interfaces, all_symbols, references). |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
codemap.summarize ~126
Generate a structured markdown summary of the indexed codebase — API surface, data layer, config, DI, middleware, resilience, error handling, and logging.
| Name | Type | Req | Description |
|---|---|---|---|
| max_items_per_section | integer | – | Maximum items per section (default: 50) |
| repo_path | string | yes | Absolute path to the repository root |
| section_filter | array | – | Optional: list of sections to include (overview, api, data, config, di, middleware, resilience, exceptions, logging, metrics) |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
graph.callees ~124
Find all symbols called by a C# symbol, traversing the call graph down to the specified depth.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Max traversal depth (default: 1, max: 6) |
| limit_per_level | integer | – | Max nodes per BFS level (default: 20, max: 500) |
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | Symbol to find callees of (documentation comment ID format) |
| workspace_id | string | – | Optional: workspace ID for overlay-aware traversal |
No output schema declared.
No examples provided.
graph.callers ~121
Find all callers of a C# symbol, traversing the call graph up to the specified depth.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Max traversal depth (default: 1, max: 6) |
| limit_per_level | integer | – | Max nodes per BFS level (default: 20, max: 500) |
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | Symbol to find callers of (documentation comment ID format) |
| workspace_id | string | – | Optional: workspace ID for overlay-aware traversal |
No output schema declared.
No examples provided.
graph.trace_feature ~150
Traces a feature end-to-end starting from an entry point method or endpoint handler. Returns a hierarchical call tree annotated with architectural facts (endpoints, config, DB tables, DI registrations) at each node.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Max call depth to trace (default: 3, max: 6) |
| entry_point | string | yes | Symbol ID (FQN) or stable_id (sym_ prefix) of the entry method |
| limit | integer | – | Max nodes to traverse (default: 100, max: 500) |
| repo_path | string | yes | Absolute path to the repository root |
| workspace_id | string | – | Optional: workspace ID for overlay-aware tracing |
No output schema declared.
No examples provided.
index.cleanup ~116
Remove old cached baselines to reclaim disk space. Current HEAD and workspace-referenced baselines are never deleted. Default is dry_run:true — set dry_run:false to actually delete.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | If true, report what would be deleted without deleting (default: true) |
| keep_count | integer | – | Keep the N most recent baselines (default: 5) |
| older_than_days | integer | – | Remove baselines older than N days |
| repo_path | string | yes | Absolute path to the repository root |
No output schema declared.
No examples provided.
index.diff ~154
Compare two indexed commits and show what changed semantically: symbols added/removed/renamed, endpoints added/removed, config keys and DI registrations changed.
| Name | Type | Req | Description |
|---|---|---|---|
| from_commit | string | yes | Base commit SHA (the 'before'). Must have an existing baseline. |
| include_facts | boolean | – | Include fact-level diffs (endpoints, config, DB tables, DI). Default: true. |
| kinds | array | – | Optional: filter symbol changes to specific kinds (e.g. Class, Method, Interface). Default: all. |
| repo_path | string | yes | Absolute path to the repository root |
| to_commit | string | yes | Target commit SHA (the 'after'). Use 'HEAD' for the current commit. |
No output schema declared.
No examples provided.
index.ensure_baseline ~82
Build a semantic index for a .NET solution. Idempotent: returns immediately if the current commit is already indexed.
| Name | Type | Req | Description |
|---|---|---|---|
| commit_sha | string | – | Optional: specific commit to index (default: HEAD) |
| repo_path | string | yes | Absolute path to the repository root |
| solution_path | string | yes | Absolute path to the .sln file |
No output schema declared.
No examples provided.
index.list_baselines ~57
List all cached baselines for a repository, showing commit SHA, creation date, file size, and whether each is the current HEAD or referenced by an active workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to the repository root |
No output schema declared.
No examples provided.
index.refresh_overlay ~67
Incrementally reindex changed files for a workspace overlay.
| Name | Type | Req | Description |
|---|---|---|---|
| file_paths | array | – | Specific files to reindex (default: auto-detect via git diff) |
| repo_path | string | yes | Absolute path to repository root |
| workspace_id | string | yes | Workspace identifier to refresh |
No output schema declared.
No examples provided.
refs.find ~138
Find all references to a C# symbol, optionally filtered by reference kind.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Filter by RefKind: Call, Read, Write, Instantiate, Override, Implementation |
| limit | integer | – | Max references (default: 50, max: 500) |
| repo_path | string | yes | Absolute path to the repository root |
| resolution_state | string | – | Filter by resolution state: resolved, unresolved (default: all) |
| symbol_id | string | yes | Fully qualified symbol ID (e.g. M:MyNs.MyClass.MyMethod) |
| workspace_id | string | – | Optional: workspace ID for overlay refs |
No output schema declared.
No examples provided.
repo.status ~37
Get the current Git state of a repository and whether a baseline index exists.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to the repository root |
No output schema declared.
No examples provided.
surfaces.list_config_keys ~103
List configuration keys used by the ASP.NET solution (IConfiguration indexer, GetValue, GetSection, Options pattern).
| Name | Type | Req | Description |
|---|---|---|---|
| key_filter | string | – | Optional: prefix match on config key (e.g. 'App:') |
| limit | integer | – | Maximum number of keys to return (default: 50) |
| repo_path | string | yes | Absolute path to the repository root |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
surfaces.list_db_tables ~102
List database tables referenced by the solution (EF Core DbSet<T>, [Table] attributes, raw SQL strings).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of tables to return (default: 50) |
| repo_path | string | yes | Absolute path to the repository root |
| table_filter | string | – | Optional: prefix match on table name (e.g. 'Order') |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
surfaces.list_endpoints ~111
List HTTP endpoints exposed by the ASP.NET solution (controller-based and minimal API routes).
| Name | Type | Req | Description |
|---|---|---|---|
| http_method | string | – | Optional: filter by HTTP method |
| limit | integer | – | Maximum number of endpoints to return (default: 50) |
| path_filter | string | – | Optional: prefix match on route path (e.g. '/api/orders') |
| repo_path | string | yes | Absolute path to the repository root |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
symbols.get_card ~150
Get a full structured summary of a C# symbol including signature, docs, facts, and source code.
| Name | Type | Req | Description |
|---|---|---|---|
| include_code | boolean | – | Include source code in response (default: true). When true, the symbol's full source is included up to 100 lines; methods are rarely truncated. Set false for metadata-only lookups (faster, no disk re… |
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | Fully qualified symbol ID or sym_ stable ID |
| virtual_files | array | – | Optional unsaved file contents for Ephemeral mode (requires workspace_id) |
| workspace_id | string | – | Optional: workspace ID for overlay data |
No output schema declared.
No examples provided.
symbols.get_context ~203
Get a symbol's full context in one call: card + source code + callee cards with code. Replaces the typical search → get_card → get_definition_span → graph.callees chain.
| Name | Type | Req | Description |
|---|---|---|---|
| callee_depth | integer | – | Depth of callee expansion (default: 1, range: 0–2). 0 = no callees, 1 = immediate callees, 2 = callees of callees. |
| include_code | boolean | – | Include source code in all cards (default: true). Set false for metadata-only. |
| max_callees | integer | – | Max callee cards to include (default: 10, max: 25). |
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | FQN (e.g. M:Namespace.Class.Method) or sym_ stable ID |
| workspace_id | string | – | Optional: workspace ID for overlay-aware context |
No output schema declared.
No examples provided.
symbols.get_definition_span ~141
Source code only — no card metadata or fact hydration. Use for batch reads or when you need precise line control. For most uses, prefer symbols.get_card which includes source automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| context_lines | integer | – | Context around definition (default: 2) |
| max_lines | integer | – | Max lines to return (default: 120) |
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | Fully qualified symbol ID |
| virtual_files | array | – | Optional unsaved file contents for Ephemeral mode (requires workspace_id) |
| workspace_id | string | – | Optional: workspace ID for overlay data |
No output schema declared.
No examples provided.
symbols.search ~228
Search for C# symbols by name, namespace, kind, or file path using full-text search.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | File path prefix filter. E.g., 'src/' for production code only, 'tests/' for test code only. |
| kinds | array | – | Filter by SymbolKind (e.g. ["Class", "Method"]). When query is omitted, kinds is required — returns all symbols of those types. |
| limit | integer | – | Max results (default: 20, max: 100) |
| namespace | string | – | Namespace prefix filter |
| query | string | – | FTS5 search query (optional when kinds is set). Omit to browse all symbols of the specified kinds. Space = implicit AND. Use OR for alternatives: 'Foo OR Bar'. Use * for prefix matching: 'Order*'. |
| repo_path | string | yes | Absolute path to the repository root |
| virtual_files | array | – | Optional unsaved file contents for Ephemeral mode (requires workspace_id) |
| workspace_id | string | – | Optional: workspace ID for overlay data |
No output schema declared.
No examples provided.
types.hierarchy ~85
Get the type hierarchy for a C# type: base class, implemented interfaces, and derived types.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to the repository root |
| symbol_id | string | yes | Type symbol ID (documentation comment ID format, e.g. T:MyNs.MyClass) |
| workspace_id | string | – | Optional: workspace ID for overlay-aware query |
No output schema declared.
No examples provided.
workspace.create ~76
Create an isolated workspace session for incremental overlay indexing.
| Name | Type | Req | Description |
|---|---|---|---|
| commit_sha | string | – | Baseline commit (default: HEAD) |
| repo_path | string | yes | Absolute path to repository root |
| solution_path | string | yes | Absolute path to .sln file |
| workspace_id | string | yes | Unique workspace identifier for this agent session |
No output schema declared.
No examples provided.
workspace.delete ~55
Permanently delete a workspace and its overlay data. Use workspace.reset to keep the workspace but clear its data.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to repository root |
| workspace_id | string | yes | Workspace identifier to delete |
No output schema declared.
No examples provided.
workspace.list ~38
List all active workspaces for a repository, including staleness and quality metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to repository root |
No output schema declared.
No examples provided.
workspace.reset ~48
Discard all overlay data for a workspace and reset to the baseline state.
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | Absolute path to repository root |
| workspace_id | string | yes | Workspace identifier to reset |
No output schema declared.
No examples provided.
How do I install the CodeMap MCP server?
CodeMap runs locally as a NuGet package, launched with dnx codemap-mcp@1.4.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · codemap-mcp
claude mcp add bbajt-codemap-mcp -- dnx codemap-mcp@1.4.0 --yes
What is the CodeMap MCP server?
CodeMap is an MCP server listed in the public MCP registry as io.github.bbajt/codemap-mcp. Roslyn-powered MCP server for C#/VB.NET. Query symbols, call graphs, and facts. 90%+ token savings. This page covers its NuGet package (codemap-mcp).
Is the CodeMap MCP server safe to use?
CodeMap scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CodeMap MCP server expose?
CodeMap exposes 26 tools: repo.status, index.list_baselines, index.cleanup, index.ensure_baseline, symbols.search, and 21 more. Their descriptions and schemas cost roughly 2,970 tokens of context every time the server is loaded.
Is the CodeMap MCP server still maintained?
CodeMap is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.