MsgPack (LsMsgPack)
NUGET · LSMSGPACK.MCP
Decodes MsgPack (LsMsgPack schemas, type ids) as text and reads it from variables while debugging.
Available components
Last scanned (2 hours ago)
Scores higher than 47% of NuGet servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance not yet verified. View diagnostics → Unverified
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 6 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability59
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1972 tokens (~281/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 14 Oct 26 +28
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- First check of Tool coverage: 100 functional
- 13 Oct 26 +1
- Security disclosure: unverified → pass ▲ functional
- 12 Oct 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed nuget/LsMsgPack.Mcp@2026.10.11.1
Provenance Inconclusive
We could not complete the check, so nothing is claimed either way. This is a gap on our side, not a finding about the package.
| Result | Inconclusive |
|---|---|
| Ecosystem | nuget |
| Reason | Signature present, unverified |
Signer
| Signed as | Repository signature, names nuget.org |
|---|---|
| Subject | CN=NuGet.org Repository by Microsoft,O=NuGet.org Repository by Microsoft,L=Redmond,ST=Washington,C=US |
| Issuer | CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US |
| Valid from | 23 Feb 2024 |
| Valid until | 18 May 2027 |
| Service index | https://api.nuget.org/v3/index.json |
| Owners | mlsomers |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
Registry declarations For information only
What the registry and the package's own manifest say about this version. The publisher or the registry writes these, nothing here is verified, and none of it affects the score.
| Repository | https://github.com/mlsomers/LsMsgPack |
|---|---|
| Repository type | git |
| Commit | 9a32a60589b3a526a7210cfd557555ac36371036 |
| Project URL | https://github.com/mlsomers/LsMsgPack |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
msgpack_debug_locals MsgPack: variables of the paused frame ~112
The variables of the stack frame selected in the debugger (locals, arguments, this), with their types. Variables that can hold MsgPack bytes (byte[], Stream, Memory<byte>, List<byte>, HttpContent, Uint8Array, bytes...) are marked with *.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Also the variables that cannot hold bytes (default: true, marked ones first). |
| ide | string | – | Which IDE when several run: its pid, "vscode" or "visualstudio". Optional. |
No output schema declared.
No examples provided.
msgpack_debug_read MsgPack: read bytes from the debugger ~527
Reads the bytes of an expression in the paused program (byte[], MemoryStream and other streams (seekable ones are put back at their position), Memory<byte>, List<byte>, ArraySegment<byte>, HttpContent, a base64 or hex string; JavaScript Uint8Array/Buffer; Python bytes/BytesIO) and decodes them as msgpack_decode does. The result gets a document id for follow-up calls. By default the IDE only accepts variable and member paths (e.g. buffer, this._payload, response.Content, items[2].Data): no method calls.
| Name | Type | Req | Description |
|---|---|---|---|
| continueOnError | boolean | – | Keep reading after an error, the rest is a best guess (default true). |
| endian | string | – | Byte order (default: the specification's). |
| expression | string | yes | The variable or member path holding the bytes, evaluated in the selected stack frame. |
| from | string|integer | – | Items view: only items holding bytes from this offset (number or 0x hex). |
| ide | string | – | Which IDE when several run: its pid, "vscode" or "visualstudio". Optional. |
| issues | string | – | Which validation issues to list: errors (default, with security vulnerabilities such as properties declared as object), all (also warnings such as larger encodings than needed), none. |
| maxBytes | integer | – | Read at most this many bytes (default 16 MiB). |
| maxNodes | integer | – | The most values or items written (default 1000), the rest is summarized. |
| maxString | integer | – | Longer strings are cut (default 200 chars). |
| offsets | boolean | – | Objects view: add the offset of every value. |
| path | string | – | Only this part of the objects, as the objects view writes paths (e.g. "Lines[2]", "Customer.Address"). |
| saveTo | string | – | Also write the bytes to this file (e.g. to keep them as a test fixture). |
| schemaStore | string | – | A path to the LsMsgPack SchemaStore of the program (e.g. _options.SchemaStore): read when the payload refers to a cached schema (WriteSchemaReference) so the property names are known. |
| to | string|integer | – | Items view: only items holding bytes up to this offset (number or 0x hex). |
| view | string | – | objects: the values as JSON with comments (default). items: the MsgPack items with offsets and encodings (for encoding problems). both. |
No output schema declared.
No examples provided.
msgpack_debug_status MsgPack: debugger status ~78
Lists the IDEs (VS Code, Visual Studio) with the MsgPack Explorer extension, their debug sessions and where the program is paused. Call it first when the bytes are in a program being debugged.
| Name | Type | Req | Description |
|---|---|---|---|
| ide | string | – | Which IDE when several run: its pid, "vscode" or "visualstudio". Optional. |
No output schema declared.
No examples provided.
msgpack_decode MsgPack: decode ~493
Decodes MsgPack data into JSON-like text with comments for what JSON does not tell (types from type ids or the LsMsgPack indexed schema, timestamps, decimals, bin, extensions, errors with offsets), or into the MsgPack items with their offsets and encodings (view "items"). Give data (hex, base64, a list of byte values), a file, or the id of a document decoded before (to see another view or part).
| Name | Type | Req | Description |
|---|---|---|---|
| continueOnError | boolean | – | Keep reading after an error, the rest is a best guess (default true). |
| data | string | – | The bytes as text: hex ("82 a4 4e 61...", "0x82a4..."), base64, decimal byte values ("130, 164, ...") or a Python bytes literal. |
| doc | string | – | The id of a document decoded before (e.g. "doc1"). |
| endian | string | – | Byte order (default: the specification's). |
| file | string | – | A file holding the bytes (relative to the working directory of the server). |
| from | string|integer | – | Items view: only items holding bytes from this offset (number or 0x hex). |
| issues | string | – | Which validation issues to list: errors (default, with security vulnerabilities such as properties declared as object), all (also warnings such as larger encodings than needed), none. |
| maxNodes | integer | – | The most values or items written (default 1000), the rest is summarized. |
| maxString | integer | – | Longer strings are cut (default 200 chars). |
| offsets | boolean | – | Objects view: add the offset of every value. |
| path | string | – | Only this part of the objects, as the objects view writes paths (e.g. "Lines[2]", "Customer.Address"). |
| schemas | string | – | Schemas the data may refer to (LsMsgPack WriteSchemaReference): a file, or bytes as text, holding a SchemaStore export (SchemaStore.Export) or one schema. |
| to | string|integer | – | Items view: only items holding bytes up to this offset (number or 0x hex). |
| view | string | – | objects: the values as JSON with comments (default). items: the MsgPack items with offsets and encodings (for encoding problems). both. |
No output schema declared.
No examples provided.
msgpack_explain_offset MsgPack: explain an offset ~109
What the byte at an offset of a decoded document is: the items holding it (outermost first), the object member it belongs to, the header and content bytes of its item, and the bytes around it. Use it at the offset of an error.
| Name | Type | Req | Description |
|---|---|---|---|
| doc | string | yes | The id of a decoded document (e.g. "doc1"). |
| offset | string|integer | yes | The offset: a number, or hex with 0x ("0x1F"). |
No output schema declared.
No examples provided.
msgpack_read_as_class MsgPack: read into a .NET class and report what does not match ~415
Deserializes MsgPack data into a class of a compiled .NET assembly (the program's or library's .dll, e.g. bin/Debug/net8.0/MyApp.dll) with LsMsgPack, and reports what does not match the classes: properties the data has and the class does not (with "did you mean" for misspelled names and the properties left at their default), values that do not convert (a string where an int is declared, an overflow, an unknown enum name), classes without an entry in the indexed schema, type ids that are not found; each with the paths of the objects. Also shows the object that was read as JSON. Use it when an object deserialized from MsgPack has missing, null or wrong values, or to check data against the classes (any writer: LsMsgPack, LtMsgPack, MessagePack-CSharp...). Give data, a file or a document id as msgpack_decode. Runs the class's constructors and setters, in a separate process.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | The compiled assembly with the class: a .dll of the build output (relative to the working directory of the server). Build the project first. |
| data | string | – | The bytes as text: hex, base64, decimal byte values or a Python bytes literal. |
| doc | string | – | The id of a document decoded before (e.g. "doc1"). |
| file | string | – | A file holding the bytes (relative to the working directory of the server). |
| schemas | string | – | Schemas the data may refer to (LsMsgPack WriteSchemaReference): a file, or bytes as text, holding a SchemaStore export (SchemaStore.Export) or one schema. |
| type | string | yes | The class to read into: its full name (MyApp.Models.Order) or its name when only one class has it, also in the assemblies of the build output it references. Order[] for an array of them. |
No output schema declared.
No examples provided.
msgpack_search MsgPack: search ~99
Finds the items of a decoded document that hold a text (strings containing it) or a value it converts to (numbers, booleans, timestamps, Guids), with their offsets and object paths.
| Name | Type | Req | Description |
|---|---|---|---|
| doc | string | yes | The id of a decoded document (e.g. "doc1"). |
| matchCase | boolean | – | Match upper and lower case (default false). |
| text | string | yes | The text or value to find. |
No output schema declared.
No examples provided.
How do I install the MsgPack (LsMsgPack) MCP server?
MsgPack (LsMsgPack) runs locally as a NuGet package, launched with dnx LsMsgPack.Mcp@2026.10.11.1 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · LsMsgPack.Mcp
claude mcp add mlsomers-lsmsgpack -- dnx LsMsgPack.Mcp@2026.10.11.1 --yes
What is the MsgPack (LsMsgPack) MCP server?
MsgPack (LsMsgPack) is an MCP server listed in the public MCP registry as io.github.mlsomers/lsmsgpack. Decodes MsgPack (LsMsgPack schemas, type ids) as text and reads it from variables while debugging. This page covers its NuGet package (LsMsgPack.Mcp).
Is the MsgPack (LsMsgPack) MCP server safe to use?
MsgPack (LsMsgPack) scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MsgPack (LsMsgPack) MCP server expose?
MsgPack (LsMsgPack) exposes 7 tools: msgpack_debug_status, msgpack_debug_locals, msgpack_debug_read, msgpack_decode, msgpack_read_as_class, and 2 more. Their descriptions and schemas cost roughly 1,833 tokens of context every time the server is loaded.
Is the MsgPack (LsMsgPack) MCP server still maintained?
MsgPack (LsMsgPack) is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the MsgPack (LsMsgPack) MCP server under?
MsgPack (LsMsgPack) declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.