·
Last changedVersion:
This version passed the hardening gate. Hardening applied 9 targeted changes and preserved all other text. Classified findings before hardening: 23. Classified findings closed: 16. Classified findings remaining: 7. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 13.
6
13
4
5
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/deployment.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
references/cli-reference.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
references/deployment.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
references/cli-reference.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
SKILL.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Medium | Closed | |
references/cli-reference.md | Supply Chain & Install-Time Trust | Install-time download and execute | Medium | Closed |
23 findings
Aspire is a code-first, polyglot toolchain for building observable, production-ready distributed applications. It orchestrates containers, executables, and cloud resources from a single AppHost project — regardless of whether the workloads are C#, Python, JavaScript/TypeScript, Go, Java, Rust, Bun, Deno, or PowerShell.
Detailed reference material lives in the references/ folder — load on demand.
| Reference | When to load |
|---|---|
Command flags, options, or detailed usage | |
Setting up MCP for AI assistants, available tools | |
Discovering integrations via MCP tools, wiring patterns | |
Method signatures, chaining options, language-specific patterns | |
DCP internals, resource model, service discovery, networking, telemetry | |
Dashboard features, standalone mode, GenAI Visualizer | |
Docker, Kubernetes, Azure Container Apps, App Service | |
Integration tests against the AppHost | |
Diagnostic codes, common errors, and fixes |
The Aspire team ships an MCP server that provides documentation tools directly inside your AI assistant. See MCP Server for setup details.
If running Aspire CLI 13.2 or later (aspire --version), the MCP server includes docs search tools:
| Tool | Description |
|---|---|
| Lists all available documentation from aspire.dev |
| Performs weighted lexical search across indexed documentation |
| Retrieves a specific document by its slug |
These tools were added in PR #14028.
On 13.1, the MCP server provides integration lookup but not docs search:
| Tool | Description |
|---|---|
| Lists available Aspire hosting integrations |
| Gets documentation for a specific integration package |
For general docs queries on 13.1, use Context7 as your primary source (see below).
Use Context7 (mcp_context7) when the Aspire MCP docs tools are unavailable (13.1) or the MCP server isn't running:
Step 1 — Resolve the library ID (one-time per session):
Call mcp_context7_resolve-library-id with libraryName: ".NET Aspire".
| Rank | Library ID | Use when |
|---|---|---|
1 |
| Primary source. Guides, integrations, CLI reference, deployment. |
2 |
| API internals, source-level implementation details. |
3 |
| Non-Microsoft polyglot integrations (Go, Java, Node.js, Ollama). |
Step 2 — Query docs:
Search the official docs repo on GitHub:
microsoft/aspire.dev — path: src/frontend/src/content/docs/dotnet/aspiredotnet/aspire-samplesCommunityToolkit/Aspire| Requirement | Details |
|---|---|
.NET SDK | 10.0+ (required even for non-.NET workloads — the AppHost is .NET) |
Container runtime | Docker Desktop, Podman, or Rancher Desktop |
IDE (optional) | VS Code + C# Dev Kit, Visual Studio 2022, JetBrains Rider |
| Template | Command | Description |
|---|---|---|
aspire-starter |
| ASP.NET Core/Blazor starter + AppHost + tests |
aspire-ts-cs-starter |
| ASP.NET Core/React starter + AppHost |
aspire-py-starter |
| FastAPI/React starter + AppHost |
aspire-apphost-singlefile |
| Empty single-file AppHost |
The AppHost orchestrates all services. Non-.NET workloads run as containers or executables.
For complete API signatures, see Polyglot APIs.
| Concept | Key point |
|---|---|
Run vs Publish |
|
Service discovery | Automatic via env vars: |
Resource lifecycle | DAG ordering — dependencies start first. |
Resource types |
|
Integrations | 144+ across 13 categories. Hosting package (AppHost) + Client package (service). |
Dashboard | Real-time logs, traces, metrics, GenAI visualizer. Runs automatically with |
MCP Server | AI assistants can query running apps and search docs via CLI (STDIO). |
Testing |
|
Deployment | Docker, Kubernetes, Azure Container Apps, Azure App Service. |
Valid commands in Aspire CLI 13.1:
| Command | Description | Status |
|---|---|---|
| Create from template | Stable |
| Initialize in existing project | Stable |
| Start all resources locally | Stable |
| Add an integration | Stable |
| Generate deployment manifests | Preview |
| Manage configuration settings | Stable |
| Manage disk cache | Stable |
| Deploy to defined targets | Preview |
| Execute a pipeline step | Preview |
| Update integrations (or | Preview |
| Configure MCP for AI assistants | Stable |
| Start the MCP server | Stable |
Full command reference with flags: CLI Reference.
Add*App() or AddProject<T>().WithReference().WaitFor() if neededaspire runaspire new aspire-apphost-singlefile (empty AppHost)docker-compose service with an Aspire resourcedepends_on → .WithReference() + .WaitFor()ports → .WithHttpEndpoint()environment → .WithEnvironment() or .WithReference()| Resource | URL |
|---|---|
Documentation | |
Runtime repo | |
Docs repo | |
Samples | |
Community Toolkit | |
Dashboard image |
|
Discord | |
Get started with chainctlchainctl skill install public/github/aspire:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/aspire:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/architecture.md
references/cli-reference.md
references/dashboard.md
references/deployment.md
references/integrations-catalog.md
references/mcp-server.md
references/polyglot-apis.md
references/testing.md
references/troubleshooting.md