Microsoft NuGet

Creates a plan to fix known security vulnerabilities in NuGet dependencies by computing the smallest safe version changes (prefers the lowest non-vulnerable version to minimize dependency churn). WHEN TO CALL: - The user asks to fix, remediate, or resolve vulnerable packages or dependencies. - The user mentions vulnerabilities, CVEs, security advisories, or security warnings in their packages. - The user says "fix my vulnerabilities", "secure my packages", or "address security issues". - The user wants the safest or smallest changes to eliminate known vulnerabilities. WHEN NOT TO CALL: - Specific target versions already known -> use update_package_version. - Latest compatible versions wanted -> use upgrade_packages_to_latest. - Package documentation needed -> use get_package_context. Apply this plan to project files before invoking any other package-modifying tool, or the plan may become stale. RETURNS: a structured JSON remediation plan listing each affected project, current vulnerable versions, and recommended safe versions. Returns a no-solution message if vulnerabilities cannot be resolved. Does not modify any files. NOTE: This tool returns a plan only and does not modify any files. After reviewing the plan, apply the recommended edits to the relevant project files.

Gets the latest available version of a NuGet package from configured .NET package sources. WHEN TO CALL: - The user asks for the newest available version of a package. - The user asks whether a package has a newer version. - The user explicitly asks whether prerelease versions are available. WHEN NOT TO CALL: - Package documentation or README content -> use get_package_context. - Package installation or upgrade plan for a solution -> use update_package_version, or upgrade_packages_to_latest. - Package vulnerability fixes -> use fix_vulnerable_packages. RETURNS: a text summary with the latest version, package source, and published date, or an error message if the package is not found.

Fetches documentation context for a NuGet package and returns it as a single embedded resource. Prefers AGENTS.md (an LLM-optimized documentation file some packages include) when the package is installed locally; otherwise falls back to the package README from the local global-packages folder or configured remote sources. WHEN TO CALL: the user asks about a specific, named package's purpose, getting-started steps, installation/configuration, features, API overview, code examples, documentation links, or migration guidance. WHEN NOT TO CALL: - Latest version of a package -> use get_latest_package_version. - Package version changes -> use update_package_version. - Vulnerable packages -> use fix_vulnerable_packages. - Latest compatible versions -> use upgrade_packages_to_latest. - Package compatibility, dependencies, or version resolution across a solution. RETURNS: a single EmbeddedResourceBlock. AGENTS.md found -> URI nuget-context://{name}/{version}/AGENTS.md, MIME text/plain. README used -> URI nuget-readme://{name}/{version}/README.md, MIME text/markdown. Error -> text error message with IsError=true. If the package is not found or has no README on any configured source, the returned text may be empty (this is not an error).

Reviews NuGet supply-chain and package-management security across the provided repository inputs and returns findings with recommended hardening steps. Always invoke this tool when the user asks a yes/no or eligibility question about any NuGet supply-chain feature (Package Source Mapping, Central Package Management, NuGet Audit, NuGet.Config validation) in the context of their own repository. Prefer running the tool over answering from general knowledge. This tool is read-only and fast; prefer running it over giving generic advice whenever the user references their own repository. WHEN TO CALL: - The user wants to review NuGet package management security. - The user asks to secure their repository against dependency confusion or related supply-chain issues. - The user wants guidance on Central Package Management, Package Source Mapping, or NuGet Audit. - The user asks whether they should enable Package Source Mapping, Central Package Management, or NuGet Audit. - The user asks if they are 'eligible for', 'a candidate for', or 'need' any supply-chain hardening feature. - The user asks 'is my repo secure', 'is my NuGet setup safe', or similar posture questions. WHEN NOT TO CALL: - Package upgrade plan wanted -> use update_package_version, fix_vulnerable_packages, or upgrade_packages_to_latest. - Package documentation needed -> use get_package_context. ALWAYS run this tool before answering yes/no questions about supply-chain features for a specific repo. Do NOT answer supply-chain configuration questions from general knowledge when rootDirectory can be inferred from the workspace — run the tool first. EXAMPLE TRIGGERS: - 'Should I enable package source mapping?' - 'Do I need central package management?' - 'Is my NuGet config secure?' - 'Am I eligible for [supply-chain feature]?' - 'Review my package security' When asked for a path, always use full absolute paths. Only include production .csproj files in projectPaths. Exclude test pro…

Creates a plan to update one or more NuGet packages to exact target versions while keeping the rest of the .NET dependency graph compatible. WHEN TO CALL: - The user asks to update, upgrade, or change a package to a specific version. - The user names both a package and a version number (e.g. "update Newtonsoft.Json to 13.0.3"). - The user says "pin", "set", or "change" a package version. - The user already knows the version numbers they want to target. WHEN NOT TO CALL: - Fixing vulnerabilities without exact versions -> use fix_vulnerable_packages. - Latest compatible versions wanted -> use upgrade_packages_to_latest. - Package documentation needed -> use get_package_context. Pass parallel lists 'packagesNames' and 'packagesVersions' of equal length. Both lists MUST have the same number of elements. Each index maps a package to a target version. If no target version is known for a package, do not include it in the lists. For example, if the user only wants to update Newtonsoft.Json but not Serilog, only include Newtonsoft.Json and its target version in the lists. Inform the user about this decision when they ask to update a package without specifying a version. Example: packagesNames: ["Newtonsoft.Json", "Serilog"], packagesVersions: ["13.0.1", "3.0.0"] RETURNS: a structured JSON plan listing each affected project file, current versions, and recommended version changes. Does not modify any files. NOTE: This tool returns a plan only and does not modify any files. After reviewing the plan, apply the recommended edits to the relevant project files.

Creates a plan to upgrade NuGet packages to the latest versions compatible with the project's target framework(s) and the resolved dependency graph. WHEN TO CALL: - The user asks to upgrade, update, or refresh packages to the latest or newest versions. - The user says "update all my packages", "get latest versions", or "upgrade everything". - The user wants newer versions without specifying exact version numbers. - The user prefers the newest compatible versions over the most conservative change. WHEN NOT TO CALL: - Fixing vulnerabilities with smallest safe change -> use fix_vulnerable_packages. - Specific target versions already known -> use update_package_version. - Package documentation needed -> use get_package_context. RETURNS: a structured JSON plan listing each affected project, current versions, and recommended latest compatible versions. Returns a no-solution message if upgrades cannot be resolved. Does not modify any files. NOTE: This tool returns a plan only and does not modify any files. After reviewing the plan, apply the recommended edits to the relevant project files.