From 299bca04049c815159868ded62e4ec50e905e8d5 Mon Sep 17 00:00:00 2001 From: Dan Moseley Date: Wed, 1 Apr 2026 17:12:53 -0600 Subject: [PATCH 1/3] Tighten known-domains allowlist Narrow broad domain entries to specific paths/subdomains actually used: - aka.ms -> aka.ms/dotnet-trace, aka.ms/perfcollect - nuget.org -> api.nuget.org, www.nuget.org/account/trustedpublishing - npmjs.com/package/@modelcontextprotocol -> pinned to inspector/v/0.21.1 Remove unused domains: fluentassertions.com, speedscope.app Update skill content to match: pin MCP Inspector link, remove FluentAssertions link, remove speedscope hyperlink. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- eng/known-domains.txt | 14 +++++++------- plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md | 2 +- plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md | 1 - .../references/dotnet-trace-collect.md | 2 +- 4 files changed, 9 insertions(+), 10 deletions(-) diff --git a/eng/known-domains.txt b/eng/known-domains.txt index 486544091c..1adc5ae7ac 100644 --- a/eng/known-domains.txt +++ b/eng/known-domains.txt @@ -16,10 +16,13 @@ microsoft.com modelcontextprotocol.io # Tools -aka.ms +aka.ms/dotnet-trace +aka.ms/perfcollect +api.nuget.org download.sysinternals.com msdl.microsoft.com -nuget.org +www.nuget.org/account/trustedpublishing +## nugettest is Microsoft owned nugettest.org dotnetcli.blob.core.windows.net @@ -57,12 +60,9 @@ github.com/yourusername github.com/username # Community -fluentassertions.com -npmjs.com/package/@modelcontextprotocol ollama.com stackoverflow.com +## Cannot pin npmjs package by hash, only version +www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.21.1 xunit.net -# UI helpers -speedscope.app - diff --git a/plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md b/plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md index 7219105572..4b09bb871f 100644 --- a/plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md +++ b/plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md @@ -209,5 +209,5 @@ builder.Logging.AddConsole(options => ## More Info -- [MCP Inspector](https://www.npmjs.com/package/@modelcontextprotocol/inspector) — Interactive debugging tool for MCP servers +- [MCP Inspector](https://www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.21.1) — Interactive debugging tool for MCP servers - [VS Code MCP documentation](https://code.visualstudio.com/docs/copilot/chat/mcp-servers) — Configuring MCP servers in VS Code diff --git a/plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md b/plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md index 08ca06a79e..0734026218 100644 --- a/plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md +++ b/plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md @@ -188,4 +188,3 @@ For the evaluation format, example questions, and detailed guidance, see [refere ## More Info - [xUnit documentation](https://xunit.net/docs/getting-started/netcore/cmdline) — Getting started with xUnit for .NET -- [FluentAssertions](https://fluentassertions.com/) — Readable assertion library for .NET diff --git a/plugins/dotnet-diag/skills/dotnet-trace-collect/references/dotnet-trace-collect.md b/plugins/dotnet-diag/skills/dotnet-trace-collect/references/dotnet-trace-collect.md index a5963e8262..9c10c94ce5 100644 --- a/plugins/dotnet-diag/skills/dotnet-trace-collect/references/dotnet-trace-collect.md +++ b/plugins/dotnet-diag/skills/dotnet-trace-collect/references/dotnet-trace-collect.md @@ -64,7 +64,7 @@ dotnet-trace collect -p --format speedscope | Format | Extension | Analysis Tool | |--------|-----------|---------------| | `nettrace` (default) | `.nettrace` | PerfView, Visual Studio, `dotnet-trace report` | -| `speedscope` | `.speedscope.json` | [Speedscope](https://www.speedscope.app/) (web) | +| `speedscope` | `.speedscope.json` | Speedscope | | `chromium` | `.chromium.json` | Chrome DevTools (chrome://tracing) | ## Container Usage From 1ded37af045547176823ac755e0ac33709dc626d Mon Sep 17 00:00:00 2001 From: Leslie Richardson Date: Wed, 1 Apr 2026 16:26:01 -0700 Subject: [PATCH 2/3] updated mcp skills codeowner --- .github/CODEOWNERS | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 7751efff58..88c68550ea 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -24,17 +24,17 @@ /plugins/dotnet/agents/optimizing-dotnet-performance.agent.md @dotnet/appmodel -/plugins/dotnet-ai/skills/mcp-csharp-create/ @leslierichardson95 @artl93 -/tests/dotnet-ai/mcp-csharp-create/ @leslierichardson95 @artl93 +/plugins/dotnet-ai/skills/mcp-csharp-create/ @leslierichardson95 @mikekistler +/tests/dotnet-ai/mcp-csharp-create/ @leslierichardson95 @mikekistler -/plugins/dotnet-ai/skills/mcp-csharp-debug/ @leslierichardson95 @artl93 -/tests/dotnet-ai/mcp-csharp-debug/ @leslierichardson95 @artl93 +/plugins/dotnet-ai/skills/mcp-csharp-debug/ @leslierichardson95 @mikekistler +/tests/dotnet-ai/mcp-csharp-debug/ @leslierichardson95 @mikekistler -/plugins/dotnet-ai/skills/mcp-csharp-publish/ @leslierichardson95 @artl93 -/tests/dotnet-ai/mcp-csharp-publish/ @leslierichardson95 @artl93 +/plugins/dotnet-ai/skills/mcp-csharp-publish/ @leslierichardson95 @mikekistler +/tests/dotnet-ai/mcp-csharp-publish/ @leslierichardson95 @mikekistler -/plugins/dotnet-ai/skills/mcp-csharp-test/ @leslierichardson95 @artl93 -/tests/dotnet-ai/mcp-csharp-test/ @leslierichardson95 @artl93 +/plugins/dotnet-ai/skills/mcp-csharp-test/ @leslierichardson95 @mikekistler +/tests/dotnet-ai/mcp-csharp-test/ @leslierichardson95 @mikekistler # dotnet-upgrade (migrating and upgrading .NET projects) /plugins/dotnet-upgrade/skills/thread-abort-migration/ @dotnet/appmodel From c14308edb4d4c61a801586e84703a50c00940751 Mon Sep 17 00:00:00 2001 From: Dan Moseley Date: Wed, 1 Apr 2026 17:26:55 -0600 Subject: [PATCH 3/3] Refine scoped known-domain entries Remove the remaining nugettest.org publish example and drop the nugettest.org allowlist entry. Also normalize path-scoped entries to omit a hardcoded www prefix so both host forms match the existing ReferenceScanner logic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- eng/known-domains.txt | 7 ++----- .../mcp-csharp-publish/references/nuget-packaging.md | 5 ----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/eng/known-domains.txt b/eng/known-domains.txt index 1adc5ae7ac..6b20bd0917 100644 --- a/eng/known-domains.txt +++ b/eng/known-domains.txt @@ -21,9 +21,7 @@ aka.ms/perfcollect api.nuget.org download.sysinternals.com msdl.microsoft.com -www.nuget.org/account/trustedpublishing -## nugettest is Microsoft owned -nugettest.org +nuget.org/account/trustedpublishing dotnetcli.blob.core.windows.net # Platforms @@ -63,6 +61,5 @@ github.com/username ollama.com stackoverflow.com ## Cannot pin npmjs package by hash, only version -www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.21.1 +npmjs.com/package/@modelcontextprotocol/inspector/v/0.21.1 xunit.net - diff --git a/plugins/dotnet-ai/skills/mcp-csharp-publish/references/nuget-packaging.md b/plugins/dotnet-ai/skills/mcp-csharp-publish/references/nuget-packaging.md index 739f485320..a56c59a55c 100644 --- a/plugins/dotnet-ai/skills/mcp-csharp-publish/references/nuget-packaging.md +++ b/plugins/dotnet-ai/skills/mcp-csharp-publish/references/nuget-packaging.md @@ -68,11 +68,6 @@ dotnet tool uninstall --global YourUsername.MyMcpServer dotnet nuget push bin/Release/*.nupkg \ --api-key YOUR_NUGET_API_KEY \ --source https://api.nuget.org/v3/index.json - -# Or push to NuGet test environment first -dotnet nuget push bin/Release/*.nupkg \ - --api-key YOUR_NUGET_API_KEY \ - --source https://apiint.nugettest.org/v3/index.json ``` ## User Configuration