
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
al-mcp-server
Advanced tools
Model Context Protocol (MCP) server providing intelligent AL (Application Language) code assistance for Microsoft Dynamics 365 Business Central development.
Give AI assistants complete visibility into your AL dependencies and symbols.
AI coding assistants can't see compiled AL packages or understand Business Central object relationships. This creates a blind spot when helping with AL development.
The AL MCP Server bridges this gap by exposing your AL workspace's compiled symbols (.app files) directly to AI assistants through the Model Context Protocol.
Verify your setup:
dotnet --version # Should show 8.0 or higher
The AL MCP Server installs automatically via npx - no manual installation needed.
claude mcp add al-mcp-server -- npx al-mcp-server
Or via VS Code settings:
{
"claude.mcpServers": {
"al-symbols-mcp": {
"command": "npx",
"args": ["al-mcp-server"]
}
}
}
Create .vscode/mcp.json in your workspace:
{
"servers": {
"al-symbols-mcp": {
"type": "stdio",
"command": "npx",
"args": ["al-mcp-server"]
}
}
}
Add to Cursor settings (Settings → Features → Model Context Protocol):
{
"al-symbols-mcp": {
"command": "npx",
"args": ["al-mcp-server"]
}
}
Add to ~/.continue/config.json:
{
"mcpServers": {
"al-symbols-mcp": {
"command": "npx",
"args": ["al-mcp-server"]
}
}
}
Add to VS Code settings:
{
"cody.mcpServers": {
"al-symbols-mcp": {
"command": "npx",
"args": ["al-mcp-server"]
}
}
}
Use these connection details:
npx["al-mcp-server"]stdioAsk your AI assistant:
Search for Customer table in my AL project
The server will auto-start and provide intelligent AL assistance!
The AL MCP Server provides 6 token-optimized tools for AL code analysis:
al_search_objects
al_get_object_definition
al_find_references
al_search_object_members
al_get_object_summary
al_packages
AL MCP Server
├── Symbol Extraction Layer
│ └── AL CLI integration for .app file parsing
├── Streaming Parser
│ └── Efficient handling of large symbol files (50MB+)
├── In-Memory Database
│ └── Optimized indices for sub-100ms queries
├── MCP Protocol Handler
│ └── JSON-RPC communication with AI assistants
└── Auto-Discovery Engine
└── Smart .alpackages directory detection
Performance Features:
Runtime:
Project Structure:
Supported AL Packages:
The server analyzes compiled AL symbols, not raw .al source files.
AL CLI not found
dotnet --versionNU1100 error
dotnet nuget add source https://api.nuget.org/v3/index.json -n nuget.orgNo sources found
dotnet nuget list sourceNo packages found
al_auto_discover tool to search for packagesServer not responding
Need Help?
Once configured, ask your AI assistant:
"Show me all Sales-related codeunits"
"Find all references to the Customer table"
"What procedures are in the Sales-Post codeunit?"
"Search for all pages that use the Item table"
"Give me a summary of the Gen. Journal-Post Batch codeunit"
The AI assistant will use the MCP tools to provide accurate, context-aware responses based on your actual AL packages.
MIT License - see LICENSE file for details.
Transform AL development with AI assistants that truly understand your codebase.
FAQs
Model Context Protocol (MCP) server providing intelligent AL (Application Language) code assistance for Microsoft Dynamics 365 Business Central development.
The npm package al-mcp-server receives a total of 279 weekly downloads. As such, al-mcp-server popularity was classified as not popular.
We found that al-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.