io.github.csa7mdm/dotnetdevmcp
NUGET · DOTNETDEVMCP · SCANNED SEP 24
MCP server for .NET: Roslyn code navigation and refactoring, build, and affected-test selection.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability83
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3780 tokens (~102/item across 37 items; 37 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: the tool surface changed between 0.2.2 and 0.3.3: 16 tool removals, 0 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage88
- 86% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 91% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 37 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.csa7mdm/dotnetdevmcp MCP server?
io.github.csa7mdm/dotnetdevmcp runs locally as a NuGet package, launched with dnx DotNetDevMCP@0.3.3 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · DotNetDevMCP
claude mcp add csa7mdm-dotnetdevmcp -- dnx DotNetDevMCP@0.3.3 --yes
{
"mcpServers": {
"csa7mdm-dotnetdevmcp": {
"command": "dnx",
"args": [
"DotNetDevMCP@0.3.3",
"--yes"
]
}
}
} {
"servers": {
"csa7mdm-dotnetdevmcp": {
"command": "dnx",
"args": [
"DotNetDevMCP@0.3.3",
"--yes"
]
}
}
} codex mcp add csa7mdm-dotnetdevmcp -- dnx DotNetDevMCP@0.3.3 --yes
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"csa7mdm-dotnetdevmcp": {
"type": "local",
"command": [
"dnx",
"DotNetDevMCP@0.3.3",
"--yes"
],
"enabled": true
}
}
} mcp_servers:
csa7mdm-dotnetdevmcp:
command: "dnx"
args: ["DotNetDevMCP@0.3.3", "--yes"] {
"McpServers": {
"csa7mdm-dotnetdevmcp": {
"Transport": "stdio",
"Command": "dnx",
"Arguments": [
"DotNetDevMCP@0.3.3",
"--yes"
]
}
}
} {
"mcpServers": {
"csa7mdm-dotnetdevmcp": {
"command": "dnx",
"args": [
"DotNetDevMCP@0.3.3",
"--yes"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 −14
- Stability: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- Schema quality: 78 → 102 ▼ functional
- Schema quality: 78 → 100 ▼ functional
- Tool coverage: 79% → 86% ▲ functional
- Package version: 0.2.2 → 0.3.3 functional
- Package version: 0.2.2 → 0.3.1 functional
- Package version: 0.2.2 → 0.3.0 functional
- 23 Sept 26 71
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed nuget/DotNetDevMCP@0.3.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | nuget |
| Reason | Signature malformed |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
configure_resource_limits ~39
Sets the maximum number of orchestrated operations that may run concurrently.
| Name | Type | Req | Description |
|---|---|---|---|
| maxConcurrency | integer | yes | Maximum number of concurrent operations (>= 1) |
No output schema declared.
No examples provided.
dotnet_analyze_project ~31
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDependencies | boolean | – | – |
| includeMetrics | boolean | – | – |
| path | string | yes | – |
No output schema declared.
No examples provided.
dotnet_analyze_quality ~15
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
No output schema declared.
No examples provided.
dotnet_build ~201
Builds a .NET project or solution with configurable options. Returns a compact summary by default (counts, all errors, up to the first 20 de-duplicated warnings); pass verbose=true for raw MSBuild output lines too.
| Name | Type | Req | Description |
|---|---|---|---|
| configuration | string|null | – | Build configuration (Debug/Release) |
| framework | string|null | – | Target framework (e.g., net8.0) |
| noRestore | boolean | – | Skip restoring packages |
| projectPath | string | yes | Path to the project file (.csproj) or solution file (.sln) |
| runtime | string|null | – | Target runtime (e.g., win-x64, linux-x64) |
| verbose | boolean | – | Include raw MSBuild output lines in the response. Default false returns a compact summary only. |
| verbosity | integer | – | Verbosity level (0=quiet, 1=minimal, 2=normal, 3=detailed, 4=diagnostic) |
No output schema declared.
No examples provided.
dotnet_build_with_properties ~159
Builds a .NET project with custom MSBuild properties. Useful for setting version numbers, configuration values, etc. Returns a compact summary by default; pass verbose=true for raw MSBuild output lines too.
| Name | Type | Req | Description |
|---|---|---|---|
| configuration | string|null | – | Build configuration (Debug/Release) |
| framework | string|null | – | Target framework (e.g., net8.0) |
| projectPath | string | yes | Path to the project file (.csproj) or solution file (.sln) |
| properties | object | yes | MSBuild properties as key-value pairs (e.g., Version=1.0.0, Configuration=Release) |
| verbose | boolean | – | Include raw MSBuild output lines in the response. Default false returns a compact summary only. |
No output schema declared.
No examples provided.
dotnet_clean ~91
Cleans build artifacts from a .NET project or solution.
| Name | Type | Req | Description |
|---|---|---|---|
| configuration | string|null | – | Build configuration to clean (Debug/Release) |
| projectPath | string | yes | Path to the project file (.csproj) or solution file (.sln) |
| verbose | boolean | – | Include the full raw output in the response. Default false omits it on success and returns only a short tail on failure. |
No output schema declared.
No examples provided.
dotnet_detect_circular_dependencies ~17
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| solutionPath | string | yes | – |
No output schema declared.
No examples provided.
dotnet_get_dependencies ~15
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | – |
No output schema declared.
No examples provided.
dotnet_restore ~76
Restores NuGet packages for a .NET project or solution.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | Path to the project file (.csproj) or solution file (.sln) |
| verbose | boolean | – | Include the full raw output in the response. Default false omits it on success and returns only a short tail on failure. |
No output schema declared.
No examples provided.
dotnet_scan_outdated_packages ~17
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | – |
No output schema declared.
No examples provided.
dotnet_test_affected ~383
Finds the tests that reference the code in the changed files (via Roslyn, through the loaded solution) and runs only those. Default changed files: the git working tree. Requires a loaded solution (SharpTool_LoadSolution or --load-solution).
| Name | Type | Req | Description |
|---|---|---|---|
| changedFiles | array|null | – | Changed source files. Omit to use git: uncommitted changes, or the diff against gitBase if given. |
| dryRun | boolean | – | Only report which tests would run; do not run them. |
| framework | string|null | – | Run one target framework only, e.g. net10.0: much faster for multi-targeted test projects. Default: every framework. |
| gitBase | string|null | – | Git ref to diff against instead of the working tree, e.g. main or HEAD~3 |
| maxDepth | integer | – | How many reference hops to follow from a changed symbol (1 = tests that call it directly). Default 8. |
| maxSelectedFraction | number | – | Above this share of all test methods, run the whole solution instead of the filtered selection. Measured on Polly: a selection of 4% of tests ran 3.3x faster than the whole suite, but 23% was slower… |
| maxSelectionSeconds | integer | – | Seconds allowed for tracing. Past it the change reaches too much code for selection to beat running everything, so the whole solution runs instead. Default 10. |
| noBuild | boolean | – | Skip building the affected test projects. Only when nothing changed since the last build. |
| timeoutSeconds | integer | – | Kill the run and fail it past this many seconds. A run must always return, even if a test hangs. Default 600. |
No output schema declared.
No examples provided.
dotnet_test_discover ~78
Lists the tests in a test project (dotnet test --list-tests). Builds the project first unless it is already built.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string|null | – | VSTest filter, e.g. FullyQualifiedName~OrderService or Category=Unit |
| projectPath | string | yes | Path to the test project (.csproj) |
No output schema declared.
No examples provided.
dotnet_test_run ~267
Runs tests in a project or a whole solution with one dotnet test invocation and returns per-test results, failures with messages and stack traces. Use filter or testNames to narrow.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string|null | – | VSTest filter expression, e.g. FullyQualifiedName~OrderService|Category=Unit. For a project that runs under Microsoft.Testing.Platform, this is instead that test framework's own filter options, e.g.… |
| framework | string|null | – | Run one target framework only, e.g. net10.0. Default: every framework the projects target. |
| noBuild | boolean | – | Skip the build. Only when nothing changed since the last build. |
| path | string | yes | Path to a test project (.csproj) or a solution (.sln) |
| testNames | array|null | – | Exact fully qualified test names to run (Namespace.Class.Method). Combined with filter if both given. |
| timeoutSeconds | integer | – | Kill the run and fail it past this many seconds. A run must always return, even if a test hangs (e.g. an injected fault causing a deadlock). Default 600. |
No output schema declared.
No examples provided.
execute_workflow ~80
Runs tools of this server as a dependency graph: steps whose dependencies are done run in parallel, dependents wait. Use for build -> test -> analyze pipelines.
| Name | Type | Req | Description |
|---|---|---|---|
| steps | array | yes | Steps. dependsOn lists step names that must finish first; steps with no unmet dependencies run in parallel. |
| workflowName | string | yes | Name of the workflow |
No output schema declared.
No examples provided.
get_resource_metrics ~24
Returns current concurrency limits and how many orchestrated operations are running or queued.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
orchestrate_parallel ~85
Runs several tools of this server concurrently (throttled by the resource manager) and returns every result. Use for independent operations, e.g. build two projects while running tests.
| Name | Type | Req | Description |
|---|---|---|---|
| maxParallelism | integer|null | – | Maximum degree of parallelism (default: processor count) |
| operations | array | yes | Operations to run. Each has the tool name and its arguments object. |
No output schema declared.
No examples provided.
SharpTool_AddMember ~206
Adds one or more new member definitions (Property, Field, Method, inner Class, etc.) to a specified type. Code is parsed, inserted, and formatted. Definition can include xml documentation and attributes. Writing small components produces cleaner code, so you can use this to break up large components, in addition to adding new functionality.
| Name | Type | Req | Description |
|---|---|---|---|
| codeSnippet | string | yes | The C# code to add. |
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| fileNameHint | string | yes | If the target is a partial type, specifies which file to add to. Set to 'auto' to determine automatically. |
| fullyQualifiedTargetName | string | yes | FQN of the parent type or method. |
| lineNumberHint | integer | yes | Suggest a line number to insert the member near. '-1' to determine automatically. |
No output schema declared.
No examples provided.
SharpTool_AnalyzeComplexity ~96
Deep analysis of code complexity metrics including cyclomatic complexity, cognitive complexity, method stats, coupling, and inheritance depth. Scans methods, classes, or entire projects to identify maintenance risks and guide refactoring decisions.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | yes | The scope to analyze: 'method', 'class', or 'project' |
| target | string | yes | The fully qualified name of the method/class, or project name to analyze |
No output schema declared.
No examples provided.
SharpTool_CreateRoslynDocument ~118
Creates a new document file with the specified content. Returns error if the file already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| content | string | yes | The content to write to the file. For C#, omit indentation to save tokens. Code will be auto-formatted. |
| filePath | string | yes | The absolute path where the file should be created. |
No output schema declared.
No examples provided.
SharpTool_FindAndReplace ~199
Every developer's favorite. Use this for all small edits (code tweaks, usings, namespaces, interface implementations, attributes, etc.) instead of rewriting large members or types.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| regexPattern | string | yes | Regex operating in multiline mode, so `^` and `$` match per line. Always use `\s*` at the beginnings of lines for unknown indentation. Make sure to escape your escapes for json. |
| replacementText | string | yes | Replacement text, which can include regex groups ($1, ${name}, etc.) |
| target | string | yes | Target, which can be either a FQN (replaces text within a declaration) or a filepath supporting globbing (`*`) (replaces all instances across files) |
No output schema declared.
No examples provided.
SharpTool_FindReferences ~60
Finds all references to a specified symbol with surrounding context. Indentation is omitted to save space. Critical for understanding symbol usage patterns across the codebase before editing the target.
| Name | Type | Req | Description |
|---|---|---|---|
| fullyQualifiedSymbolName | string | yes | The FQN of the symbol. |
No output schema declared.
No examples provided.
SharpTool_GetMembers ~100
Lists the full signatures of members of a specified type, including XML documentation. Essential for rapidly understanding a type's API, but does not give you the implementations. Use this like Intellisense when you're writing code which depends on the target class.
| Name | Type | Req | Description |
|---|---|---|---|
| fullyQualifiedTypeName | string | yes | The fully qualified name of the type. |
| includePrivateMembers | boolean | yes | If true, includes private members; otherwise, only public/internal/protected members. |
No output schema declared.
No examples provided.
SharpTool_ListImplementations ~73
Gets the locations and FQNs of all implementations of an interface or abstract method, and lists derived classes for a base class. Crucial for navigating polymorphic code and understanding implementation patterns.
| Name | Type | Req | Description |
|---|---|---|---|
| fullyQualifiedSymbolName | string | yes | The fully qualified name of the interface, abstract method, or base class. |
No output schema declared.
No examples provided.
SharpTool_LoadProject ~39
Use this immediately after LoadSolution. This injects a comprehensive understanding of the project structure into your context.
| Name | Type | Req | Description |
|---|---|---|---|
| projectName | string | yes | – |
No output schema declared.
No examples provided.
SharpTool_LoadSolution ~147
The the `SharpTool` suite provides you with focused, high quality, and high information density dotnet analysis and editing tools. When using `SharpTool`s, you focus on individual components, and navigate with type hierarchies and call graphs instead of raw code. Because of this, you create more modular, coherent, composable, type-safe, and thus inherently correct code. `SharpTool_LoadSolution` is the entry point for the suite, and should be called once at the beginning of your session to initialize the other tools with data from the solution.
| Name | Type | Req | Description |
|---|---|---|---|
| solutionPath | string | yes | The absolute file path to the .sln or .slnx solution file. |
No output schema declared.
No examples provided.
SharpTool_ManageAttributes ~103
Reads or writes all attributes on a declaration.
| Name | Type | Req | Description |
|---|---|---|---|
| codeToWrite | string | yes | For 'read', must be 'None'. For 'write', specify all attributes that should exist on the target declaration. This will replace all existing attributes. |
| operation | string | yes | 'read' or 'write'. For 'read', set codeToWrite to 'None'. |
| targetDeclaration | string | yes | The FQN of the target declaration to manage attributes for |
No output schema declared.
No examples provided.
SharpTool_ManageUsings ~105
Reads or writes using directives in a document.
| Name | Type | Req | Description |
|---|---|---|---|
| codeToWrite | string | yes | For 'read', must be 'None'. For 'write', provide all using directives that should exist in the file. This will replace all existing usings. |
| filePath | string | yes | The absolute path to the file to manage usings in |
| operation | string | yes | 'read' or 'write'. For 'read', set codeToWrite to 'None'. |
No output schema declared.
No examples provided.
SharpTool_MoveMember ~132
Moves a member (property, field, method, nested type, etc.) from one type/namespace to another. The member is removed from the source location and added to the destination.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| fullyQualifiedDestinationTypeOrNamespaceName | string | yes | FQN of the destination type or namespace where the member should be moved. |
| fullyQualifiedMemberName | string | yes | FQN of the member to move. |
No output schema declared.
No examples provided.
SharpTool_OverwriteMember ~170
Replaces the definition of an existing member or type with new C# code, or deletes it. Code is parsed and formatted. Code can contain multiple new members, update the existing member, and/or replace it with a new one.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| fullyQualifiedMemberName | string | yes | FQN of the member or type to rewrite. |
| newMemberCode | string | yes | The new C# code for the member or type. *If this member has attributes or XML documentation, they MUST be included here.* To Delete the target instead, set this to `// Delete {memberName}`. |
No output schema declared.
No examples provided.
SharpTool_OverwriteRoslynDocument ~124
Overwrites an existing document file with the specified content. You must use SharpTool_ReadRawFromRoslynDocument first.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| content | string | yes | The content to write to the file. For C#, omit indentation to save tokens. Code will be auto-formatted. |
| filePath | string | yes | The absolute path to the file to overwrite. |
No output schema declared.
No examples provided.
SharpTool_ReadRawFromRoslynDocument ~50
Reads the content of a file in the solution or referenced directories. Omits indentation to save tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | The absolute path to the file to read. |
No output schema declared.
No examples provided.
SharpTool_ReadTypesFromRoslynDocument ~71
Returns a comprehensive tree of types (classes, interfaces, structs, etc.) and their members from a specified file. Use this to enter the more powerful 'type' domain from the 'file' domain.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | The absolute path to the file to analyze. |
No output schema declared.
No examples provided.
SharpTool_RenameSymbol ~105
Renames a symbol (variable, method, property, type) and updates all references. Changes are formatted.
| Name | Type | Req | Description |
|---|---|---|---|
| commitMessage | string | yes | Commit message summary of this change. Ignored when git integration is disabled (the default) - enable with --git-commit-edits to have edits create git commits. |
| fullyQualifiedSymbolName | string | yes | FQN of the symbol to rename. |
| newName | string | yes | The new name for the symbol. |
No output schema declared.
No examples provided.
SharpTool_RequestNewTool ~103
Allows requesting a new tool to be added to the SharpTools MCP server. Logs the request for review.
| Name | Type | Req | Description |
|---|---|---|---|
| expectedOutput | string | yes | Expected output and format. |
| expectedParameters | string | yes | Expected input parameters and their descriptions. |
| justification | string | yes | Justification for why this tool would be valuable. |
| toolDescription | string | yes | Detailed description of what the tool should do. |
| toolName | string | yes | Name for the proposed tool. |
No output schema declared.
No examples provided.
SharpTool_SearchDefinitions ~86
Dual-engine pattern search across source code AND compiled assemblies for public APIs. Perfect for finding all implementations of a pattern - e.g., finding all async methods with 'ConfigureAwait', or all classes implementing IDisposable. Searches declarations, signatures, and type hierarchies.
| Name | Type | Req | Description |
|---|---|---|---|
| regexPattern | string | yes | The regex pattern to match against full declaration text (multiline) and symbol names. |
No output schema declared.
No examples provided.
SharpTool_Undo ~40
Reverts the last applied change to the solution. You can undo all consecutive changes you have made. Returns a diff of the change that was undone.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
SharpTool_ViewDefinition ~75
Displays the verbatim source code from the declaration of a target symbol (class, method, property, etc.) with indentation omitted to save tokens. Essential to fully understand a specific implementation without opening files.
| Name | Type | Req | Description |
|---|---|---|---|
| fullyQualifiedSymbolName | string | yes | The fully qualified name of the symbol (type, method, property, etc.). |
No output schema declared.
No examples provided.
What is the io.github.csa7mdm/dotnetdevmcp MCP server?
io.github.csa7mdm/dotnetdevmcp is an MCP server listed in the public MCP registry as io.github.csa7mdm/dotnetdevmcp. MCP server for .NET: Roslyn code navigation and refactoring, build, and affected-test selection. This page covers its NuGet package (DotNetDevMCP).
Is the io.github.csa7mdm/dotnetdevmcp MCP server safe to use?
io.github.csa7mdm/dotnetdevmcp scores 57 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.csa7mdm/dotnetdevmcp MCP server expose?
io.github.csa7mdm/dotnetdevmcp exposes 37 tools: dotnet_test_discover, configure_resource_limits, dotnet_analyze_project, dotnet_build_with_properties, SharpTool_LoadSolution, and 32 more. Their descriptions and schemas cost roughly 3,780 tokens of context every time the server is loaded.
Is the io.github.csa7mdm/dotnetdevmcp MCP server still maintained?
io.github.csa7mdm/dotnetdevmcp is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.csa7mdm/dotnetdevmcp MCP server under?
io.github.csa7mdm/dotnetdevmcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.