
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Compiler-backed C#/.NET code intelligence for coding agents. Explore symbols and call graphs, inspect diagnostics, analyze complexity, dependencies, and impact, and safely edit and refactor solutions through MCP.
Glider gives coding agents compiler-backed C#/.NET navigation, diagnostics, analysis, and refactoring through MCP. Find definitions, references, calls, compiler errors, and safe refactors across a solution.
Prerequisite: .NET 10 SDK.
dotnet tool install --global glider
If install fails, run dotnet --version first. If dotnet is missing or below 10, install .NET 10 from:
https://dotnet.microsoft.com/download/dotnet/10.0
load, sync, reload, unloadfind_code, search_symbols, resolve_symbol, get_symbol_info, get_symbol_at_positionfind_references, find_overrides, find_implementations, get_type_hierarchy, find_callersget_diagnostics, diagnostic_hotspots, semantic_query, search_textrename_symbol, move_type, move_member, add_member, add_type, replace_member, replace_range, organize_usings, format_document, write_filereplace_member selects one declaration by symbolKey and verifies expectedText before a write.
Read get_symbol_info.replacementSpans and the corresponding file window first. Span ends are exclusive.
Use applyChanges=false for a preview. memberCode replaces the declaration without its outer trivia.
The tool checks compiler diagnostics in the replacement and preserves surrounding source bytes.
failOnErrors=true refuses compiler errors or incomplete linked-target coverage. Callers remain unchanged.
Apply awaits sync across all linked targets without a full reload. A failed sync returns success=false and applied=true. A refresh failure reports the completed disk write; sync the file instead of repeating the edit.
analyze_change_impact, get_cascade_impact, get_project_graph, find_package_usagesbatchFor general code navigation, find_code is the recommended first tool to try. The full tool reference lives at https://glidermcp.com/glider/tools.
Use replace_range for expressions, comments, imports, directives, or adjacent declarations in an existing loaded C# file.
Read a bounded get_file_contents window with includeRawContent=true. Use rawContent for exact whitespace and line endings.
The raw field includes the last returned line terminator. Request a smaller window if rawContentAvailable is false.
Positions use one-based lines and UTF-16 columns. The start is inclusive and the end is exclusive.
For int x = 1;, select line 1, column 9 through line 1, column 10 to replace 1.
Supply nonempty expectedText and exact replacementText; empty replacement text deletes the range.
Use applyChanges=false to preview. Empty ranges and boundaries inside CRLF or surrogate pairs are refused.
The tool preserves encoding, BOM, and bytes outside the range. It does not format source or update callers.
failOnErrors=true refuses any error in the edited documents, including existing errors, or incomplete linked-target checks.
Check project diagnostics after imports, declarations, signatures, or directives change; other files are outside these checks.
Apply awaits one named-file sync for every linked document. It does not reload the solution.
Never repeat a completed or uncertain write. Inspect the disk outcome and sync the file if the workspace update fails.
search_text searches all loaded project documents, including additional files and analyzer configuration files. Files outside the loaded projects are excluded.
Use Scout for repository-wide search, fuzzy filenames, code structure, and optional semantic search.
glider
glider --transport http
Default HTTP MCP endpoint: http://localhost:5001/mcp
Useful flags:
glider --default-timeout 30m
glider --build-host netframework
glider --msbuild-path "C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin"
glider --port 8080
glider --solution "C:\repos\app\src\App.sln"
glider --solution "C:\repos\app\src\App.sln" --workspace "C:\repos\app"
glider --solution "C:\repos\app\src\App.sln" --no-watch
glider --verbose
glider --help
glider --version
--default-timeout — supports ms, s, and m suffixes. Use 0 to disable the server-side timeout.
--build-host — accepts auto, netframework, and netcore. It selects the build-host family for project evaluation.
--msbuild-path — uses a specific MSBuild installation for project evaluation.
--solution — loads a .sln, .slnx, or .csproj automatically at startup, so agents don't need to call the load tool first.
load.server_status reports progress under workspaceLoading, with an ETA from this workspace's previous load time.--workspace — sets the root directory that the file watcher monitors for auto-sync.
--workspace with a narrower directory, or --no-watch, if the refreshes become too frequent.load result's fileWatcher.error.--no-watch — disables the file watcher and auto-sync for the startup load. Do not combine it with --workspace.
Use installation and host-specific setup guides on the website:
Each Glider version expires 1 month after release date.
dotnet tool update --global glider
glider is not found after install, ensure ~/.dotnet/tools is on PATH.load fails with MSBuild initialization errors, rerun with --verbose and inspect returned diagnostics.--build-host netframework when auto selects an incompatible build host.--msbuild-path to select the required MSBuild installation.All non-commercial use and work on open-source projects are free with no time limit. Commercial use is free until paid plans become available. The full terms are in the LICENSE file inside this package.
FAQs
Compiler-backed C#/.NET code intelligence for coding agents. Explore symbols and call graphs, inspect diagnostics, analyze complexity, dependencies, and impact, and safely edit and refactor solutions through MCP.
We found that glider demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.