Skip to content

Security guarantees and evidence

Roslyn Workbench treats the connected local MCP client as authorised. These controls reduce mistakes, misfires, stale assumptions and unexpectedly broad operations; they are not an operating-system sandbox and do not defend against hostile code already running with the same authority.

Enforced invariants

Published operations expose bounded Host resource controls

Actor: Roslyn Workbench Host

Collection defaults, Code Action reference lifetime and concurrent query count are fixed by Host configuration and reported without exposing sensitive configuration.

Boundary: These bounds apply to the corresponding Roslyn Workbench caches, references and query scheduling.

Residual risk: Trusted Roslyn providers and build inputs can still consume substantial resources while an allowed operation executes.

Covered surface
  • status-field:codeActionReferenceLifetime
  • status-field:defaultMaxResults
  • status-field:maxConcurrentQueries
Automated evidence

Optional compiler-impact validation fails closed

Actor: Roslyn Workbench transaction pipeline

When configured, commit is blocked by new compiler errors or incomplete compiler evaluation relative to the transaction baseline.

Boundary: The validation covers the projects and compilations affected by the staged transaction at commit time.

Residual risk: It does not prove behavioural correctness, run all analysers or replace repository builds and tests.

Covered surface
  • compiler-error-identity:compiler-error-identity-v1
  • error:CompilerValidationIncomplete
  • error:CompilerValidationUnavailable
  • error:NewCompilerErrors
Automated evidence

Interrupted persistence retains versioned recovery evidence

Actor: Roslyn Workbench commit and recovery services

Commit persistence uses versioned durable evidence, reports unfinished states, and preserves unsupported versions rather than guessing how to recover them.

Boundary: The guarantee covers recovery artifacts created and read by Roslyn Workbench in its configured state directory.

Residual risk: Operating-system or storage failure can still make evidence incomplete; status reports that condition for manual resolution.

Covered surface
  • error:CommitRecoveryCapacityReached
  • recovery-format:1
  • recovery-operation:create
  • recovery-operation:delete
  • recovery-operation:replace
  • recovery-state:applying
  • recovery-state:committed
  • recovery-state:prepared
  • recovery-state:recovery-conflict
  • recovery-state:recovery-incomplete
  • recovery-state:restored
  • recovery-status:RecoveryVersionUnsupported
Automated evidence

Actor: Roslyn Workbench error-reporting pipeline

External reports use versioned bounded payloads, reviewed projection and redaction, and the configured consent policy before dispatch.

Boundary: The guarantee covers data prepared and submitted through the built-in reporting tools and configured dispatcher.

Residual risk: An approved report intentionally leaves the local machine; the selected provider and operating environment govern it after dispatch.

Covered surface
  • error-report-format:2
  • error-report-schema:2
  • policy:error-report-consent:always
  • policy:error-report-consent:never
  • policy:error-report-consent:prompt
  • status-field:errorReporting
Automated evidence

Generated-looking source follows explicit mutation policy

Actor: Roslyn Workbench transaction pipeline

Generated-looking checked-in source produces a bounded warning or is denied according to startup policy and reviewed path exceptions.

Boundary: Classification applies to source paths selected for supported transaction mutations.

Residual risk: Path and source heuristics cannot identify every generated file; maintainers remain responsible for repository-specific exceptions and review.

Covered surface
  • error:GeneratedSourceMutationDenied
  • policy:generated-source:deny
  • policy:generated-source:warn
  • status-field:generatedSourceExceptionCount
  • status-field:generatedSourcePolicy
  • warning:generated-source-mutation
Automated evidence

External plugin loading is explicit and mode-constrained

Actor: Roslyn Workbench Host

External plugin discovery is disabled by default and fixed at startup. Plugin mutation tools are published only when the resolved operational policy enables source mutation.

Boundary: The Host controls discovery and publication. Once loaded, trusted plugins execute in process with Host authority.

Residual risk: Plugins, analysers and Code Action providers are trusted code rather than sandboxed tenants and can perform effects outside MCP tool contracts.

Covered surface
  • plugin-api:1.0
  • plugin-loading:default
  • plugin-publication:approval-required
  • plugin-publication:autonomous-trusted
  • plugin-publication:inspection-only
  • plugin-publication:transactional
  • status-field:externalPluginsEnabled
Automated evidence

Agent-facing failure, status and continuation contracts are baseline-locked

Actor: Roslyn Workbench Host and Workspace services

The generated compatibility baseline records the exact failure envelope, public error codes, status graph, enum values, required-action values and continuation mappings used by authorised clients.

Boundary: The contract covers the shared structured failure envelope and error-code catalogue, the models reachable from server and workspace status, and the structured required-action and continuation values returned by supported operations.

Residual risk: The code describes the detected condition; clients must still present and follow the accompanying recovery guidance correctly.

Covered surface
  • contract-enum:roslyn-workbench-mcp-contracts-server-tooloutputschemamode:full
  • contract-enum:roslyn-workbench-mcp-contracts-server-tooloutputschemamode:omit
  • contract-enum:roslyn-workbench-mcp-protocol-results-toolcontinuationkind:call-tool
  • contract-enum:roslyn-workbench-mcp-protocol-results-toolcontinuationkind:choose-tool
  • contract-enum:roslyn-workbench-mcp-protocol-results-toolcontinuationkind:resolve-externally
  • contract-enum:roslyn-workbench-mcp-protocol-results-toolcontinuationkind:retry-request
  • contract-enum:roslyn-workbench-mcp-protocol-results-toolcontinuationkind:revise-request
  • contract-enum:roslyn-workbench-mcp-workspace-results-diagnosticseverity:error
  • contract-enum:roslyn-workbench-mcp-workspace-results-diagnosticseverity:hidden
  • contract-enum:roslyn-workbench-mcp-workspace-results-diagnosticseverity:info
  • contract-enum:roslyn-workbench-mcp-workspace-results-diagnosticseverity:warning
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:applying
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:committed
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:prepared
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:recovery-conflict
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:recovery-incomplete
  • contract-enum:roslyn-workbench-mcp-workspace-results-recoverystate:restored
  • contract-enum:roslyn-workbench-mcp-workspace-results-workspacelifecyclestate:ready
  • contract-enum:roslyn-workbench-mcp-workspace-results-workspacelifecyclestate:transaction-active
  • contract-enum:roslyn-workbench-mcp-workspace-results-workspacelifecyclestate:transaction-conflicted
  • contract-enum:roslyn-workbench-mcp-workspace-results-workspacelifecyclestate:workspace-out-of-date
  • contract-shape:roslyn-workbench-mcp-contracts-server-componentstatus
  • contract-shape:roslyn-workbench-mcp-contracts-server-pluginstatus
  • contract-shape:roslyn-workbench-mcp-contracts-server-serverconfiguration
  • contract-shape:roslyn-workbench-mcp-contracts-server-serverstatusdata
  • contract-shape:roslyn-workbench-mcp-contracts-server-workspaceexternalchangedata
  • contract-shape:roslyn-workbench-mcp-contracts-server-workspacestatusdata
  • contract-shape:roslyn-workbench-mcp-errorreporting-contracts-errorreportingstatusdata
  • contract-shape:roslyn-workbench-mcp-protocol-results-toolcontinuation
  • contract-shape:roslyn-workbench-mcp-protocol-results-toolerror
  • contract-shape:roslyn-workbench-mcp-workspace-results-diagnosticinfo
  • contract-shape:roslyn-workbench-mcp-workspace-results-recoverystatus
  • contract-shape:roslyn-workbench-mcp-workspace-results-transactioninfo
  • contract-shape:roslyn-workbench-mcp-workspace-results-warninginfo
  • contract-shape:roslyn-workbench-mcp-workspace-results-workspaceidentity
  • contract-shape:roslyn-workbench-mcp-workspace-results-workspaceinstanceinfo
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-canonicallocationselector
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-documentreference
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-documentselector
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-projectselector
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-resolvedlocation
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-snapshotprecondition
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-textspanrange
  • contract-shape:roslyn-workbench-mcp-workspace-selectors-textspanselector
  • error:ActionAmbiguous
  • error:ActionExpired
  • error:ActionReferenceCapacityExceeded
  • error:ActionUnavailable
  • error:AnalysisLimitExceeded
  • error:ApprovalUnavailable
  • error:CodeActionDocumentPathUnavailable
  • error:CodeActionLocationUnavailable
  • error:CodeActionProjectionFailed
  • error:CodeActionsUnavailable
  • error:CodeFixUnavailable
  • error:CommitFailed
  • error:CommitLockFailed
  • error:CommitPreparationFailed
  • error:DocumentSelectorInvalid
  • error:ErrorDetailsUnavailable
  • error:ErrorReportCapacityReached
  • error:ErrorReportNotApproved
  • error:ErrorReportPayloadTooLarge
  • error:ErrorReportSubmissionInProgress
  • error:ErrorReportingUnavailable
  • error:FixAllLimitExceeded
  • error:FixAllUnavailable
  • error:InvalidApprovalResponse
  • error:InvalidExceptionMessageHandling
  • error:InvalidMutationProposal
  • error:InvalidPreparedErrorReport
  • error:InvalidRange
  • error:LocationAmbiguous
  • error:LocationNotFound
  • error:LocationSelectorInvalid
  • error:PreparedReportUnavailable
  • error:ProjectAmbiguous
  • error:ProjectNotFound
  • error:ProjectSelectorInvalid
  • error:ProjectStructureUnavailable
  • error:RecoveryOutsideWorkspaceAuthority
  • error:RecoveryPending
  • error:SentryCaptureRejected
  • error:SymbolAmbiguous
  • error:SymbolNotFound
  • error:SymbolSelectorInvalid
  • error:TransactionCommitNotApproved
  • error:TransactionOpen
  • error:TransactionOwnershipChanged
  • error:TransactionReceiptUnavailable
  • error:UnhandledException
  • error:UnsupportedActionOperation
  • error:UnsupportedChange
  • error:WorkspaceMsBuildPropertiesInvalid
  • error:WorkspacePathInvalid
  • error:WorkspacePathNotAllowed
  • error:WorkspaceReloadBlocked
  • error:WorkspaceReloadNotRequired
  • error:WorkspaceRootInvalid
  • error:WorkspaceRootNotAllowed
  • error:WorkspaceSelectorInvalid
  • error:WorkspaceSelectorMismatch
  • error:WorkspaceSelectorNotFound
  • error:WorkspaceSelectorRequired
  • failure-envelope:standard
  • required-action:commit-or-rollback
  • required-action:narrow-request
  • required-action:open-workspace
  • required-action:reduce-transaction-history
  • required-action:reload-workspace
  • required-action:resolve-recovery
  • required-action:resolve-target-again
  • required-action:retry
  • required-action:review-transaction
  • required-action:rollback-transaction
  • required-action:start-transaction
  • success-envelope:all-published-tools
Automated evidence

Startup policy fixes the published capability surface

Actor: Roslyn Workbench Host

The startup-selected operational mode resolves to immutable policy primitives, and only tools permitted by that effective policy are published.

Boundary: Enforcement begins during Host composition and applies to the built-in tools published by that process. MCP requests cannot widen the startup policy.

Residual risk: An authorised operator can restart the Host with different settings. External plugin code runs within the separately documented plugin boundary.

Covered surface
  • configuration:inspection-only:no-new-compiler-errors
  • effective-policy:approval-required:no-new-compiler-errors
  • effective-policy:approval-required:none
  • effective-policy:autonomous-trusted:no-new-compiler-errors
  • effective-policy:autonomous-trusted:none
  • effective-policy:inspection-only:none
  • effective-policy:transactional:no-new-compiler-errors
  • effective-policy:transactional:none
  • operational-mode:approval-required
  • operational-mode:autonomous-trusted
  • operational-mode:inspection-only
  • operational-mode:transactional
  • policy:commit-authorisation:confirmation
  • policy:commit-authorisation:none
  • policy:commit-authorisation:receipt-approval
  • policy:commit-validation:no-new-compiler-errors
  • policy:commit-validation:none
  • policy:source-mutation:disabled
  • policy:source-mutation:enabled
  • status-field:commitConfirmationRequired
  • status-field:compilerValidationRequired
  • status-field:operationalMode
  • status-field:receiptApprovalRequired
  • status-field:sourceMutationEnabled
  • status-field:toolOutputSchemaMode
  • tool:analyze-async
  • tool:analyze-control-flow
  • tool:analyze-data-flow
  • tool:analyze-disposables
  • tool:analyze-nullability
  • tool:find-callees
  • tool:find-callers
  • tool:find-dependency-cycles
  • tool:find-derived-types
  • tool:find-duplicate-code
  • tool:find-implementations
  • tool:find-overloads
  • tool:find-overrides
  • tool:find-references
  • tool:find-unused-symbols
  • tool:format-document
  • tool:get-api-surface
  • tool:get-change-impact
  • tool:get-code-context
  • tool:get-control-flow-graph
  • tool:get-dependency-graph
  • tool:get-diagnostics
  • tool:get-document-options
  • tool:get-document-outline
  • tool:get-error-details
  • tool:get-operation-tree
  • tool:get-partial-declarations
  • tool:get-project-details
  • tool:get-solution-structure
  • tool:get-symbol-attributes
  • tool:get-symbol-dependencies
  • tool:get-symbol-dependents
  • tool:get-symbol-info
  • tool:get-symbol-members
  • tool:get-test-impact
  • tool:get-type-hierarchy
  • tool:go-to-definition
  • tool:list-code-actions
  • tool:prepare-error-report
  • tool:prepare-fix-all
  • tool:rename-symbol
  • tool:resolve-symbol
  • tool:search-symbols
  • tool:server-status
  • tool:stage-code-action
  • tool:submit-error-report
  • tool:transaction-commit
  • tool:transaction-history
  • tool:transaction-preview
  • tool:transaction-review
  • tool:transaction-rollback
  • tool:transaction-start
  • tool:transaction-validate
  • tool:workspace-close
  • tool:workspace-list
  • tool:workspace-open
  • tool:workspace-reload
  • tool:workspace-status
Automated evidence

Mutations remain transaction-, snapshot- and approval-bound

Actor: Roslyn Workbench transaction pipeline

Source mutations require an active transaction, stale snapshots are rejected, and approval-required commits use a one-use receipt bound to the exact reviewed persistence set.

Boundary: The guarantee covers mutations and commits routed through the supported transaction tools and lower-level transaction service.

Residual risk: A user or authorised client can approve an undesirable but accurately represented change; repository review remains necessary.

Covered surface
  • continuation:call-tool
  • continuation:choose-tool
  • continuation:resolve-externally
  • continuation:retry-request
  • continuation:revise-request
  • error:DocumentAmbiguous
  • error:DocumentNotFound
  • error:InvalidRequest
  • error:LinkedDocumentConflict
  • error:MutationCandidateChanged
  • error:NoActiveTransaction
  • error:RevisionCapacityReached
  • error:SnapshotMismatch
  • error:SourceMutationDisabled
  • error:TransactionAlreadyActive
  • error:TransactionConflicted
  • error:TransactionHistoryUnavailable
  • error:TransactionOwnedByWorkspace
  • error:TransactionReceiptMismatch
  • error:TransactionReceiptRequired
  • error:TransactionReviewUnavailable
  • error:WorkspaceAlreadyOpen
  • error:WorkspaceBusy
  • error:WorkspaceNotOpen
  • receipt-digest:sha256-rwcs-v1
  • status-field:clientSupportsElicitation
  • status-field:commitConfirmationState
  • status-field:maxTransactionRevisions
Automated evidence

Workspace authority constrains admitted and mutable files

Actor: Roslyn Workbench Host

Workspace admission, external-document handling and mutation containment are evaluated against Host-owned authority rather than client assertions.

Boundary: The guarantee covers workspaces and transaction persistence performed through Roslyn Workbench.

Residual risk: Other local processes and trusted build inputs can change files outside this Host and can require a workspace reload.

Covered surface
  • error:WorkspaceAuthorityChanged
  • error:WorkspaceCapacityReached
  • error:WorkspaceChangedDuringLoad
  • error:WorkspaceExternalDocumentRejected
  • error:WorkspaceInputEvaluationFailed
  • error:WorkspaceLoadFailed
  • error:WorkspaceNotSupported
  • error:WorkspaceOutOfDate
  • error:WorkspaceProjectOutsideRoot
  • policy:external-document:allow-read-only
  • policy:external-document:reject-workspace
  • status-field:allowedWorkspaceRootCount
  • status-field:externalDocumentPolicy
  • status-field:workspaceAdmission
Automated evidence

Delegated responsibilities

The client and user remain responsible for intent and review

Actor: Authorised MCP client and user

The client should use inspection before mutation, convey elicitation failures accurately, review previews or receipts and keep each transaction to a coherent change.

Boundary: Roslyn Workbench supplies bounded tools, structured continuations and exact review data; it cannot determine the user's true intent.

Residual risk: A mistaken but authorised approval can persist an undesirable change that satisfies all mechanical safeguards.

Workspace mutation requires coordinated local ownership

Actor: Authorised MCP client, user and other local workspace editors

Callers wait for recovery initialisation and avoid concurrent file edits or workspace-topology changes while non-cancellable commit application or recovery is in progress. A second Host instance sharing the same workspace remains advisory or query-only.

Boundary: Roslyn Workbench detects many stale-input and external-change conditions, but it does not hold an operating-system lock over every workspace file or coordinate independent Host processes.

Residual risk: Uncoordinated local writers can invalidate assumptions during the narrow persistence boundary and can require recovery or manual reconciliation.

Limitations

Roslyn Workbench is not a hostile-code sandbox

Actor: Operating environment and repository owner

Workspaces, builds, analysers, generators, Code Action providers and enabled plugins must be trusted for local execution.

Boundary: The server is local and stdio-based, but trusted extensions and build inputs execute with the Host process authority.

Residual risk: Hostile code with the same operating-system authority can bypass application-level controls and access local data directly.

Covered surface
  • plugin-loading:execution-boundary

Public-surface appendix

Inspect the complete code-derived surface or the machine-readable guarantees and evidence when you need detailed verification.