Make BinlogMcp feed-neutral and configure eval NuGet source (#984)

* Revert "Resolve binlog MCP from the dnceng dotnet-public feed"

This reverts commit 805a42a675.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3b2899e9-48f8-4a2a-a19f-1827d08cbfc4

* ci(eval): configure NuGet source explicitly

Install a repository-owned NuGet configuration at the runner user level so temporary Vally workspaces resolve packages from nuget.org without plugin-specific source arguments.

* build: use dotnet-public for repository NuGet configs

Route evaluation and version-stamping tool restores through the locked-down dotnet-public source mapping.

* fix(msbuild): enable prerelease BinlogMcp versions

Match the Roslyn LSP dnx configuration and keep all mirrored MCP manifests consistent.

---------

Co-authored-by: Jan Krivanek <jankrivanek@microsoft.com>
Copilot-Session: 3b2899e9-48f8-4a2a-a19f-1827d08cbfc4

.claude-plugin/marketplace.json

@@ -36,8 +36,7 @@
             "dnx",
             "Microsoft.AITools.BinlogMcp",
             "--yes",
-            "--source",
-            "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"
+            "--prerelease"
           ],
           "tools": ["*"]
         }

.github/workflows/evaluation-run.yml

@@ -190,6 +190,11 @@ jobs:
           ref: ${{ inputs.head_sha || '' }}
           persist-credentials: false
 
+      - name: Configure NuGet for evaluations
+        run: |
+          mkdir -p "$HOME/.nuget/NuGet"
+          cp eng/evaluation/nuget.config "$HOME/.nuget/NuGet/NuGet.Config"
+
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

eng/allowed-external-deps.txt

@@ -24,5 +24,5 @@ script:migrate-nullable-references:scripts/Get-NullableReadiness.ps1
 tool-ref:msbuild:#tool:web/fetch
 tool-ref:msbuild:#tool:agent/runSubagent
 
-# dotnet-msbuild plugin: Microsoft.AITools.BinlogMcp server (binlog analysis MCP from dotnet-public feed)
+# dotnet-msbuild plugin: Microsoft.AITools.BinlogMcp server (binlog analysis MCP)
 mcp-server:dotnet-msbuild:binlog

eng/evaluation/nuget.config

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <!-- Evaluation workspaces are created outside the repository, so the workflow
+       installs this as the runner's user-level configuration. -->
+  <packageSources>
+    <clear />
+    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="dotnet-public">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

eng/version/nuget.config

@@ -9,7 +9,7 @@
     PR author added to remap the nbgv package source to a malicious feed and
     achieve code execution in the privileged context. Pointing `dotnet` at this
     file with its configfile option makes NuGet use ONLY these settings (no
-    hierarchical discovery), and source mapping pins every package to nuget.org.
+    hierarchical discovery), and source mapping pins every package to dotnet-public.
 
     IMPORTANT: keep this comment free of a doubled hyphen. XML forbids the two
     hyphen sequence inside a comment, so a phrase like the configfile flag written
@@ -19,10 +19,10 @@
   -->
   <packageSources>
     <clear />
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
   </packageSources>
   <packageSourceMapping>
-    <packageSource key="nuget.org">
+    <packageSource key="dotnet-public">
       <package pattern="*" />
     </packageSource>
   </packageSourceMapping>

plugins/dotnet-msbuild/.claude-plugin/plugin.json

@@ -16,8 +16,7 @@
         "dnx",
         "Microsoft.AITools.BinlogMcp",
         "--yes",
-        "--source",
-        "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"
+        "--prerelease"
       ],
       "tools": ["*"]
     }

plugins/dotnet-msbuild/.codex-plugin/.mcp.json

@@ -7,8 +7,7 @@
         "dnx",
         "Microsoft.AITools.BinlogMcp",
         "--yes",
-        "--source",
-        "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"
+        "--prerelease"
       ],
       "tools": ["*"]
     }

plugins/dotnet-msbuild/plugin.json

@@ -16,8 +16,7 @@
         "dnx",
         "Microsoft.AITools.BinlogMcp",
         "--yes",
-        "--source",
-        "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"
+        "--prerelease"
       ],
       "tools": ["*"]
     }

plugins/dotnet-msbuild/skills/binlog-failure-analysis/SKILL.md

@@ -33,7 +33,7 @@ Use the available MCP server tools to query the binary log for:
 ## Fallback workflow — text-log replay (when MCP is unavailable)
 
 Use this only when the MCP server cannot be started (for example, on an older
-SDK or in an offline environment without access to the `dotnet-public` NuGet feed).
+SDK or in an offline environment).
 
 ### Replay the binlog to text logs