NuGet is the package-management system used by .NET applications.
When building AI applications with C#, NuGet provides packages for almost every layer of the AI stack:
AI Provider SDKs
|
v
AI Abstractions
|
v
Embeddings
|
v
Vector Databases
|
v
Document Ingestion
|
v
RAG
|
v
Evaluation
|
v
Agents
|
v
MCP
|
v
Machine Learning
For a traditional .NET application, adding a package might simply mean installing a database or logging library.
For AI applications, package selection becomes more architectural because different NuGet packages may represent entirely different layers of the AI stack.
The modern .NET AI ecosystem includes Microsoft.Extensions.AI, vector-data libraries, data-ingestion libraries, evaluation libraries, Semantic Kernel, Microsoft Agent Framework, MCP, provider SDKs, and ML.NET. Microsoft currently recommends starting with Microsoft.Extensions.AI for many application-level AI scenarios and adding other libraries according to the application's requirements.
What Is NuGet?
NuGet is the package manager for the .NET ecosystem.
A package can contain:
C# assemblies
Dependencies
Native libraries
Build tools
Analyzers
Source generators
Configuration
Documentation
For example:
dotnet add package OpenAI
adds the official OpenAI .NET client library to a project.
The project then records the dependency in its project file.
Your Project
|
v
.csproj
|
v
NuGet
|
v
OpenAI package
Why NuGet Is Important for AI Development
Modern AI applications are rarely built from a single package.
A chatbot might require:
Microsoft.Extensions.AI
OpenAI
Microsoft.Extensions.AI.OpenAI
A RAG application might additionally require:
Microsoft.Extensions.VectorData
Microsoft.Extensions.DataIngestion
An agent application might additionally require:
Microsoft.Agents.AI
Microsoft.Agents.AI.OpenAI
An MCP application may use:
ModelContextProtocol
ModelContextProtocol.AspNetCore
The package system therefore becomes part of the architecture.
AI NuGet Package Categories
It is useful to divide AI packages into several categories.
| Category | Examples |
|---|---|
| AI abstractions | Microsoft.Extensions.AI |
| OpenAI | OpenAI, Microsoft.Extensions.AI.OpenAI |
| Azure OpenAI | Azure.AI.OpenAI |
| Local AI | OllamaSharp |
| Vector data | Microsoft.Extensions.VectorData.Abstractions |
| Data ingestion | Microsoft.Extensions.DataIngestion |
| AI evaluation | Microsoft.Extensions.AI.Evaluation |
| Traditional ML | Microsoft.ML |
| AI orchestration | Microsoft.SemanticKernel |
| Agents | Microsoft.Agents.AI |
| MCP | ModelContextProtocol |
These packages do not all solve the same problem.
The Most Important AI NuGet Packages
As of September 27, 2026, the NuGet pages currently show the following versions for several important packages:
| Package | Current version shown | Purpose |
|---|---|---|
Microsoft.Extensions.AI | 10.10.0 | Core AI abstractions and utilities |
Microsoft.Extensions.AI.OpenAI | 10.10.0 | OpenAI adapter for Microsoft.Extensions.AI |
OpenAI | 2.14.0 | Official OpenAI .NET SDK |
Azure.AI.OpenAI | 2.1.0 | Azure OpenAI SDK |
OllamaSharp | 5.4.30 | Ollama client for .NET |
Microsoft.Extensions.VectorData.Abstractions | 10.10.0 | Vector-store abstractions |
Microsoft.Extensions.DataIngestion | 10.10.0-preview.1.26459.2 | Document ingestion and processing |
Microsoft.Extensions.AI.Evaluation | 10.10.0 | AI evaluation infrastructure |
Microsoft.Extensions.AI.Evaluation.Quality | 10.10.0 | Quality evaluators |
Microsoft.SemanticKernel | 1.80.1 | AI orchestration framework |
Microsoft.Agents.AI | 1.22.0 | Agent Framework core |
ModelContextProtocol | 2.2.0 | MCP C# SDK |
Microsoft.ML | 5.0.0 | Traditional machine learning |
These versions can change after publication, so production projects should always resolve versions from NuGet rather than assuming an article's version number remains current.
Microsoft.Extensions.AI
The most important general-purpose package in the modern .NET AI stack is:
Microsoft.Extensions.AI
Install it with:
dotnet add package Microsoft.Extensions.AI
The current NuGet package provides a unified approach to representing generative-AI components and includes functionality around chat clients, embedding generators, function invocation, telemetry, caching, and middleware patterns. Its abstractions include IChatClient and IEmbeddingGenerator<TInput,TEmbedding>.
The package currently shown by NuGet is version 10.10.0.
Microsoft.Extensions.AI.Abstractions
There is also:
Microsoft.Extensions.AI.Abstractions
This package contains the core exchange types and interfaces.
For example:
IChatClient
IEmbeddingGenerator
The higher-level Microsoft.Extensions.AI package depends on this abstractions package. Most application projects normally reference Microsoft.Extensions.AI rather than manually adding the abstractions package unless they specifically need only the interfaces.
The NuGet gallery currently shows Microsoft.Extensions.AI.Abstractions version 10.10.1, which also illustrates why manually pinning transitive packages unnecessarily can create version-management work.
OpenAI
The official OpenAI .NET package is:
OpenAI
Install:
dotnet add package OpenAI
The official OpenAI repository currently documents the package as the official .NET library for the OpenAI API. It includes clients organized by API capability and its current examples target .NET 10.
The current release shown by the official repository is:
OpenAI 2.14.0
released September 15, 2026.
OpenAI NuGet Package Example
A direct provider SDK example is:
using OpenAI.Chat;
string apiKey =
Environment.GetEnvironmentVariable("OPENAI_API_KEY")
?? throw new InvalidOperationException(
"OPENAI_API_KEY is not configured.");
ChatClient client =
new(
model: "your-model-name",
apiKey: apiKey);
ChatCompletion completion =
await client.CompleteChatAsync(
"Explain dependency injection in ASP.NET Core.");
Console.WriteLine(
completion.Content[0].Text);
The important point is that:
OpenAI
is a provider-specific package.
Your application is directly aware that it is communicating with OpenAI.
Microsoft.Extensions.AI.OpenAI
Another important package is:
Microsoft.Extensions.AI.OpenAI
It connects the OpenAI client to the common Microsoft.Extensions.AI abstractions.
Install:
dotnet add package Microsoft.Extensions.AI.OpenAI
The current NuGet version shown is 10.10.0.
The architectural relationship is:
ASP.NET Core
|
v
IChatClient
|
v
Microsoft.Extensions.AI.OpenAI
|
v
OpenAI
|
v
OpenAI API
This is different from calling OpenAI.Chat.ChatClient throughout the application.
OpenAI and Microsoft.Extensions.AI Together
A common setup is:
using Microsoft.Extensions.AI;
using OpenAI;
string apiKey =
Environment.GetEnvironmentVariable("OPENAI_API_KEY")
?? throw new InvalidOperationException(
"OPENAI_API_KEY is not configured.");
IChatClient chatClient =
new OpenAIClient(apiKey)
.GetChatClient("your-model-name")
.AsIChatClient();
ChatResponse response =
await chatClient.GetResponseAsync(
"Explain dependency injection in C#.");
Console.WriteLine(response.Text);
The provider-specific package remains underneath the common interface.
Azure.AI.OpenAI
For Azure OpenAI applications, the important provider package is:
Azure.AI.OpenAI
Install:
dotnet add package Azure.AI.OpenAI
The current NuGet package shown is version 2.1.0.
Azure OpenAI applications commonly combine this package with:
Azure.Identity
for identity-based authentication.
Conceptually:
ASP.NET Core
|
v
Azure.AI.OpenAI
|
v
Azure OpenAI
|
v
Model Deployment
OllamaSharp
For local AI using Ollama, an important .NET package is:
OllamaSharp
The current NuGet page shows version 5.4.30.
Install it with:
dotnet add package OllamaSharp
A basic architecture is:
.NET Application
|
v
OllamaSharp
|
v
Ollama
|
v
Local Model
This is especially useful for local development and applications where the model is hosted on infrastructure controlled by the application owner.
Microsoft.Extensions.VectorData
For vector databases, the modern abstraction is:
Microsoft.Extensions.VectorData.Abstractions
The current NuGet package is 10.10.0.
This package provides abstractions for:
Collections
Records
Vector similarity search
Filtering
Hybrid search
Embedding integration
Microsoft documents VectorStore and VectorStoreCollection<TKey,TRecord> as major types.
The important architecture is:
Application
|
v
VectorStore
|
+---- Provider A
+---- Provider B
+---- Provider C
The application can therefore remain less tightly coupled to a specific vector database.
VectorData Is Usually an Abstraction Layer
An important detail is that:
Microsoft.Extensions.VectorData.Abstractions
does not itself represent a complete vector database.
Actual implementations are provided separately.
The NuGet documentation specifically describes the package as containing abstractions while implementations are supplied by other packages.
Therefore, a real vector application normally uses:
VectorData Abstraction
+
Vector Store Provider
Microsoft.Extensions.DataIngestion
RAG applications need to process documents before they can search them.
The package:
Microsoft.Extensions.DataIngestion
provides document-ingestion abstractions and higher-level utilities.
The current NuGet version is:
10.10.0-preview.1.26459.2
and NuGet explicitly marks it as prerelease.
Install it with:
dotnet add package Microsoft.Extensions.DataIngestion --prerelease
The package provides types and pipeline components for:
Document representation
Chunking
Chunk processing
Enrichment
Vector storage
Telemetry
The documentation identifies implementations such as Microsoft.Extensions.DataIngestion.MarkItDown and Microsoft.Extensions.DataIngestion.Markdig.
Why DataIngestion Is Important for RAG
A typical RAG pipeline is:
PDF / Word / Text
|
v
Data Ingestion
|
v
Document
|
v
Chunking
|
v
Embedding
|
v
Vector Store
Without good ingestion, even a powerful LLM may receive poor context.
AI Evaluation Packages
Another important category is AI evaluation.
The main package is:
Microsoft.Extensions.AI.Evaluation
with specialized evaluation packages such as:
Microsoft.Extensions.AI.Evaluation.Quality
The current NuGet pages show 10.10.0 for both packages.
Quality evaluators include concepts such as:
Relevance
Truth
Completeness
Fluency
Coherence
Retrieval
Equivalence
Groundedness
The evaluation package exists because AI applications cannot always be tested only with deterministic expected strings.
ML.NET
Not all AI applications are generative AI applications.
For traditional machine learning, the major Microsoft package is:
Microsoft.ML
The current NuGet version shown is:
5.0.0
and the package is the core ML.NET framework for building machine-learning applications in .NET.
Install it with:
dotnet add package Microsoft.ML
Typical workloads include:
Classification
Regression
Recommendation
Anomaly detection
Prediction
Clustering
Semantic Kernel
Semantic Kernel provides a higher-level AI application framework.
The main package is:
Microsoft.SemanticKernel
The current NuGet page shows version 1.80.1.
Install:
dotnet add package Microsoft.SemanticKernel
It is useful for concepts such as:
Plugins
Functions
AI services
Prompt orchestration
Memory
Agent capabilities
It sits at a higher abstraction level than a basic provider SDK.
Microsoft Agent Framework
For more advanced agentic applications, the current Microsoft Agent Framework packages include:
Microsoft.Agents.AI
Microsoft.Agents.AI.OpenAI
Microsoft.Agents.AI.Workflows
The current Microsoft.Agents.AI NuGet page shows version 1.22.0.
A simplified architecture is:
Application
|
v
Agent Framework
|
+---+---+---+
| | | |
Tool RAG Memory
|
v
AI Model
Microsoft's current ecosystem guidance recommends moving toward Agent Framework when a problem becomes genuinely multi-step and agentic rather than forcing a simple prompt application into an agent architecture.
ModelContextProtocol
For MCP applications, the current official C# package is:
ModelContextProtocol
The NuGet page currently shows version 2.2.0.
Install:
dotnet add package ModelContextProtocol
For HTTP-based MCP servers:
dotnet add package ModelContextProtocol.AspNetCore
The official SDK documentation describes:
ModelContextProtocol.Core
ModelContextProtocol
ModelContextProtocol.AspNetCore
as different package layers, with ModelContextProtocol being the main package for most projects and ModelContextProtocol.AspNetCore adding HTTP server support.
AI Package Categories in One Architecture
All of these packages can fit into a single enterprise application:
Client
|
v
ASP.NET Core API
|
v
Application Layer
|
+--------------+--------------+
| | |
v v v
AI Service RAG Service Agent Service
| | |
v v v
Extensions.AI DataIngestion Agent Framework
| |
| v
| VectorData
| |
+------+-------+
|
v
Provider SDK
|
+---------+---------+
| | |
OpenAI Azure Ollama
MCP can sit beside the agent/tool layer:
Agent
|
v
MCP Client
|
v
MCP Server
|
+---- Database
+---- API
+---- Files
+---- Tools
Microsoft's current ecosystem documentation describes combinations such as MEAI + DataIngestion + VectorData for RAG, MEAI + Agent Framework + Aspire for multi-agent systems, and MEAI + MCP for tool interoperability.
Installing a NuGet Package
The simplest installation command is:
dotnet add package Microsoft.Extensions.AI
This modifies the project file and restores dependencies.
You can also specify a version:
dotnet add package Microsoft.Extensions.AI --version 10.10.0
For the current OpenAI library:
dotnet add package OpenAI --version 2.14.0
For the current MCP C# SDK:
dotnet add package ModelContextProtocol --version 2.2.0
Pinning a version gives you a known direct dependency instead of leaving the version selection implicit.
PackageReference in the Project File
The CLI ultimately adds a PackageReference.
For example:
<ItemGroup>
<PackageReference
Include="Microsoft.Extensions.AI"
Version="10.10.0" />
<PackageReference
Include="Microsoft.Extensions.AI.OpenAI"
Version="10.10.0" />
<PackageReference
Include="OpenAI"
Version="2.14.0" />
</ItemGroup>
NuGet uses these direct package references as inputs and resolves the complete dependency graph, including transitive dependencies.
Direct vs Transitive Packages
Suppose you explicitly install:
Microsoft.Extensions.AI
That package itself depends on additional packages.
Your project may therefore contain:
Direct dependency
|
+-- Microsoft.Extensions.AI
|
+-- Microsoft.Extensions.AI.Abstractions
+-- Other dependencies
The packages below the directly referenced package are transitive dependencies.
This distinction matters when troubleshooting:
Version conflicts
Security vulnerabilities
Unexpected dependencies
Package upgrades
Why You Should Not Add Every Transitive Package Manually
Suppose:
Microsoft.Extensions.AI
|
v
Microsoft.Extensions.AI.Abstractions
You generally do not need:
<PackageReference
Include="Microsoft.Extensions.AI.Abstractions"
Version="..." />
in addition to:
<PackageReference
Include="Microsoft.Extensions.AI"
Version="..." />
unless your architecture specifically calls for the direct abstraction package.
The higher-level package already expresses the required dependency relationship.
Installing an Exact Version
For reproducible application development:
dotnet add package OpenAI --version 2.14.0
is clearer than relying on whatever version is current when the command is executed.
This is particularly useful for:
Production applications
Tutorials
CI/CD
Enterprise repositories
Long-lived applications
Package Versions and Floating Versions
NuGet supports version ranges.
For example:
<PackageReference
Include="Some.Package"
Version="[10.0.0]" />
means exact version selection.
Other version-range expressions can permit upgrades within a range.
For production applications, uncontrolled floating dependencies are generally undesirable because the resolved dependency graph can change between restores. Microsoft documents that floating versions are one situation where NuGet may not produce the same dependency closure automatically.
A safer pattern is:
Controlled versions
|
v
Explicit update
|
v
Test
|
v
Commit
rather than:
Floating version
|
v
Unexpected update
|
v
Build changes
Updating AI NuGet Packages
In .NET 10, the current command form is:
dotnet package list --outdated
The .NET 10 SDK introduced the noun-first dotnet package list form; older SDKs use:
dotnet list package --outdated
The command can also include prerelease packages:
dotnet package list --outdated --include-prerelease
Microsoft's current CLI documentation describes --outdated, --include-prerelease, --include-transitive, --vulnerable, and JSON output options.
Checking Installed Packages
Run:
dotnet package list
Example:
Project 'DotNetAI.Api' has the following package references
Top-level Package
Microsoft.Extensions.AI
Microsoft.Extensions.AI.OpenAI
OpenAI
To inspect a particular project:
dotnet package list --project DotNetAI.Api.csproj
Checking Transitive Packages
Run:
dotnet package list --include-transitive
This is useful when investigating:
Dependency conflicts
Security issues
Unexpected packages
Package version resolution
Checking Vulnerable Packages
Modern NuGet tooling includes package vulnerability auditing.
Run:
dotnet package list --vulnerable
For transitive dependencies:
dotnet package list \
--vulnerable \
--include-transitive
.NET 10 changed the default audit behavior so transitive packages are audited by default during restore, whereas earlier versions generally focused on direct references by default. Microsoft documents NuGetAuditMode as the setting that controls this behavior.
This is particularly important for AI applications because a large AI package can bring many dependencies.
NuGet Audit in CI/CD
A production pipeline should not simply execute:
dotnet build
and ignore dependency warnings.
A stronger pipeline is:
Restore
|
v
Security Audit
|
v
Build
|
v
Unit Tests
|
v
Integration Tests
|
v
AI Evaluation
|
v
Deployment
NuGet can audit packages against known vulnerability information during restore, and Microsoft documents NuGetAuditLevel values such as low, moderate, high, and critical.
Removing a NuGet Package
To remove a package:
dotnet remove package Microsoft.Extensions.AI
Then restore/build the project.
Removing unused dependencies is good maintenance.
Restoring Packages
Use:
dotnet restore
This restores:
Direct packages
Transitive packages
Dependency graph
The current dotnet restore command supports options including:
--locked-mode
--use-lock-file
--force
--force-evaluate
--no-http-cache
and vulnerability auditing is integrated into package restoration.
Cleaning the NuGet Cache
Sometimes package problems come from local caches.
You can inspect caches:
dotnet nuget locals all --list
Clear them:
dotnet nuget locals all --clear
Then restore:
dotnet restore
This can help when diagnosing:
Corrupt package cache
Incorrect package content
Strange restore behavior
Package Lock Files
For production applications, reproducible dependency resolution can be important.
Enable a lock file:
<PropertyGroup>
<RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>
Then:
dotnet restore
creates:
packages.lock.json
The lock file records the resolved dependency graph. Microsoft recommends checking lock files into source control for application projects when reproducible package resolution is desired.
Locked Restore Mode
CI/CD can use:
dotnet restore --locked-mode
In locked mode, NuGet will fail instead of changing the package graph when the lock file no longer matches the project's declared dependencies.
This gives:
Developer
|
v
Approved package graph
|
v
Git
|
v
CI
|
v
Exact dependency graph
rather than allowing CI to silently resolve a different graph.
Central Package Management
A large solution may contain:
DotNetAI.Api
DotNetAI.Application
DotNetAI.Infrastructure
DotNetAI.Tests
DotNetAI.Worker
Managing package versions in every project individually can become difficult.
Central Package Management solves this by putting package versions in:
Directory.Packages.props
Microsoft describes Central Package Management as a way to manage package versions in one place across a solution.
Directory.Packages.props
Example:
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
<PackageVersion
Include="Microsoft.Extensions.AI"
Version="10.10.0" />
<PackageVersion
Include="Microsoft.Extensions.AI.OpenAI"
Version="10.10.0" />
<PackageVersion
Include="OpenAI"
Version="2.14.0" />
<PackageVersion
Include="Microsoft.Extensions.AI.Evaluation"
Version="10.10.0" />
</ItemGroup>
</Project>
Then the individual project can contain:
<ItemGroup>
<PackageReference
Include="Microsoft.Extensions.AI" />
<PackageReference
Include="Microsoft.Extensions.AI.OpenAI" />
<PackageReference
Include="OpenAI" />
</ItemGroup>
The versions are centralized.
Why Central Package Management Helps AI Projects
AI solutions can easily have many related packages:
Microsoft.Extensions.AI
Microsoft.Extensions.AI.OpenAI
Microsoft.Extensions.AI.Evaluation
Microsoft.Extensions.VectorData.Abstractions
Microsoft.Agents.AI
Microsoft.Agents.AI.OpenAI
Keeping versions synchronized reduces the chance of accidentally mixing incompatible versions.
For example:
Directory.Packages.props
|
+---- Microsoft.Extensions.AI
+---- Microsoft.Extensions.AI.OpenAI
+---- Evaluation
+---- VectorData
+---- Agent Framework
AI Packages and Version Compatibility
AI packages often have closely related versions.
For example:
Microsoft.Extensions.AI
10.10.x
Microsoft.Extensions.AI.OpenAI
10.10.x
VectorData
10.10.x
This does not mean every package must always share the exact same version.
It means you should check the declared dependencies and compatibility rather than arbitrarily combining versions.
NuGet itself resolves dependency requirements, but you should still test the resulting graph.
Stable Packages vs Prerelease Packages
This is especially important in the AI ecosystem.
For example:
Microsoft.Extensions.AI
10.10.0
is currently a stable package.
But:
Microsoft.Extensions.DataIngestion
10.10.0-preview.1.26459.2
is explicitly prerelease.
Do not treat prerelease APIs as if they are guaranteed to remain unchanged.
Installing Prerelease Packages
To install a prerelease package:
dotnet add package Microsoft.Extensions.DataIngestion --prerelease
or specify the exact version:
dotnet add package Microsoft.Extensions.DataIngestion \
--version 10.10.0-preview.1.26459.2
The current NuGet page explicitly documents --prerelease for this package.
Why Prerelease AI Packages Need Extra Care
A prerelease package can introduce:
API changes
Renamed types
Changed constructors
Changed extension methods
Changed configuration
Behavior changes
Therefore:
Prototype
|
v
Preview package
|
v
Validate
|
v
Production decision
is preferable to assuming the API is permanent.
Deprecated Packages
Package status matters just as much as version.
For example, the NuGet page for:
Microsoft.SemanticKernel.Connectors.InMemory
currently identifies that package as deprecated and recommends:
CommunityToolkit.VectorData.InMemory
because the functionality was moved to a provider that is independent of Semantic Kernel.
This is an excellent example of why developers should check the NuGet package page before adding an unfamiliar package from an old tutorial.
A tutorial might say:
dotnet add package Microsoft.SemanticKernel.Connectors.InMemory
but the current ecosystem may have moved that capability elsewhere.
Avoid Copying Old AI Tutorials Blindly
AI development changes quickly.
A blog published a year ago may contain:
Old package
Old package version
Old API
Old model name
Old namespace
Deprecated connector
Preview API
Therefore, before copying a tutorial, check:
NuGet package page
Official documentation
Release notes
Target framework
API reference
Package deprecation status
The current OpenAI repository, for example, has a detailed release history showing frequent additions and API changes during 2026.
NuGet Package Search
You can search packages through NuGet.org or Visual Studio's NuGet Package Manager.
For example, search for:
Microsoft.Extensions.AI
Then verify:
Publisher
Version
Target framework
Dependencies
License
Release history
Deprecation
Downloads
For Microsoft packages, the owner/publisher should normally correspond to the Microsoft-maintained package.
For the OpenAI SDK, the official repository identifies:
OpenAI
as the official .NET package and links to its NuGet package.
Never Choose a Package Only by Download Count
Download counts can be useful context, but they are not enough to establish whether a package is correct for your application.
A package could have:
Many downloads
Old API
Different purpose
Deprecated status
Limited maintenance
Instead examine:
Purpose
Maintainer
Documentation
Release activity
Dependencies
Compatibility
License
Security
Package Ownership Matters
For important infrastructure packages, identify the publisher.
For example:
Microsoft.Extensions.AI
is owned by Microsoft.
The official:
OpenAI
package is maintained in the OpenAI openai-dotnet repository.
The MCP C# SDK package is published by the Model Context Protocol project and is the official C# SDK described on its NuGet page.
Package Licenses
Packages have licenses.
For example, the OpenAI .NET repository is licensed under the MIT License.
The MCP ModelContextProtocol package currently shows Apache-2.0 on NuGet.
For enterprise software, licensing should be reviewed as part of dependency approval.
Do not assume:
Open source = no license obligations
Package Source Configuration
Most applications use:
https://api.nuget.org/v3/index.json
as the public package source.
An enterprise organization might additionally have:
Private NuGet feed
Azure Artifacts
GitHub Packages
Internal package registry
A nuget.config file can control package sources.
Why Package Sources Matter
Imagine:
Public NuGet
+
Private Company Feed
Your application could restore:
Company.AI.Security
Internal.Logging
OpenAI
Microsoft.Extensions.AI
from their respective sources.
In enterprise environments, package-source configuration becomes a security and governance concern.
Package Source Mapping
Large organizations can restrict which packages are allowed from which source.
Conceptually:
nuget.org
|
+---- Microsoft.*
+---- OpenAI
private-feed
|
+---- Company.*
This reduces the possibility of accidentally resolving an internal package name from the wrong repository.
AI Packages and Security
AI packages introduce the same dependency risks as other software libraries.
Potential problems include:
Known vulnerabilities
Abandoned package
Malicious package
Compromised dependency
Outdated transitive dependency
Unsafe native dependency
NuGet's current audit infrastructure can check packages against vulnerability information. In .NET 10, transitive package auditing is enabled by default for restore unless changed through configuration.
Vulnerability Management
A useful command is:
dotnet package list --vulnerable
For transitive details:
dotnet package list \
--vulnerable \
--include-transitive
For CI, decide what severity should fail the build.
For example:
Low -> Warning
Moderate -> Review
High -> Fail
Critical -> Fail
The exact policy belongs to the organization.
AI Packages and Supply-Chain Security
A production AI project should treat NuGet dependencies as part of the software supply chain.
A useful process is:
Select Package
|
v
Verify Publisher
|
v
Check License
|
v
Check Vulnerabilities
|
v
Check Maintenance
|
v
Pin Version
|
v
Test
|
v
Commit Lock File
This is particularly useful for enterprise applications.
A Minimal AI Project
Create a project:
dotnet new webapi -n DotNetAI
cd DotNetAI
Install:
dotnet add package Microsoft.Extensions.AI --version 10.10.0
dotnet add package Microsoft.Extensions.AI.OpenAI --version 10.10.0
dotnet add package OpenAI --version 2.14.0
The project file becomes similar to:
<Project Sdk="Microsoft.NET.Sdk.Web">
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
<ItemGroup>
<PackageReference
Include="Microsoft.Extensions.AI"
Version="10.10.0" />
<PackageReference
Include="Microsoft.Extensions.AI.OpenAI"
Version="10.10.0" />
<PackageReference
Include="OpenAI"
Version="2.14.0" />
</ItemGroup>
</Project>
These versions reflect the package versions currently shown by NuGet at the time of writing.
Configuring the API Key
Initialize user secrets:
dotnet user-secrets init
Store the key:
dotnet user-secrets set \
"AI:ApiKey" \
"YOUR_API_KEY"
Store the model:
dotnet user-secrets set \
"AI:Model" \
"your-model-name"
The application source code should not contain the real key.
Using the Package from Program.cs
using Microsoft.Extensions.AI;
using OpenAI;
var builder =
WebApplication.CreateBuilder(args);
string apiKey =
builder.Configuration["AI:ApiKey"]
?? throw new InvalidOperationException(
"AI:ApiKey is not configured.");
string model =
builder.Configuration["AI:Model"]
?? throw new InvalidOperationException(
"AI:Model is not configured.");
IChatClient chatClient =
new OpenAIClient(apiKey)
.GetChatClient(model)
.AsIChatClient();
builder.Services.AddSingleton(chatClient);
var app =
builder.Build();
app.MapGet(
"/api/ai",
async (
IChatClient client,
CancellationToken cancellationToken) =>
{
ChatResponse response =
await client.GetResponseAsync(
"Explain NuGet in .NET.",
cancellationToken:
cancellationToken);
return Results.Ok(new
{
response = response.Text
});
});
app.Run();
This project uses three important packages:
Microsoft.Extensions.AI
|
v
IChatClient
Microsoft.Extensions.AI.OpenAI
|
v
OpenAI integration
OpenAI
|
v
Provider SDK
Checking the Dependency Graph
Run:
dotnet package list
Then:
dotnet package list --include-transitive
This lets you understand what the AI packages actually bring into the application.
You should periodically inspect this because a single high-level AI package can introduce multiple transitive dependencies.
Creating a Central Package Management Setup
For a solution with several projects, create:
Directory.Packages.props
at the solution root.
Example:
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>
true
</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
<PackageVersion
Include="Microsoft.Extensions.AI"
Version="10.10.0" />
<PackageVersion
Include="Microsoft.Extensions.AI.OpenAI"
Version="10.10.0" />
<PackageVersion
Include="OpenAI"
Version="2.14.0" />
</ItemGroup>
</Project>
Then:
<ItemGroup>
<PackageReference
Include="Microsoft.Extensions.AI" />
<PackageReference
Include="Microsoft.Extensions.AI.OpenAI" />
<PackageReference
Include="OpenAI" />
</ItemGroup>
This gives a centralized version-management model across the solution.
A Larger .NET AI Solution
Consider:
DotNetAI.sln
DotNetAI.Api
DotNetAI.Application
DotNetAI.Domain
DotNetAI.Infrastructure
DotNetAI.Worker
DotNetAI.Tests
The package distribution could be:
Api
|
+---- ASP.NET Core packages
Application
|
+---- Microsoft.Extensions.AI.Abstractions
Infrastructure
|
+---- Microsoft.Extensions.AI
+---- OpenAI
+---- Microsoft.Extensions.AI.OpenAI
+---- VectorData
+---- DataIngestion
Worker
|
+---- DataIngestion
+---- AI
+---- VectorData
Tests
|
+---- AI Evaluation
+---- Test framework
The domain project may have no AI NuGet package at all.
That is often a good sign.
Keeping the Domain Independent
Avoid:
Domain
|
+---- OpenAI
+---- Semantic Kernel
+---- VectorData
Prefer:
Domain
|
+---- Business entities
Application
|
+---- Interfaces
Infrastructure
|
+---- AI NuGet packages
This means provider-specific packages remain infrastructure concerns.
Package Naming Conventions
NuGet package names often reveal their purpose.
For example:
Microsoft.Extensions.AI
means a Microsoft.Extensions-based AI library.
Microsoft.Extensions.AI.OpenAI
means an integration between the AI abstraction and OpenAI.
Microsoft.Agents.AI.OpenAI
means an Agent Framework integration with OpenAI.
Microsoft.Extensions.VectorData.Abstractions
indicates a vector-data abstraction rather than a specific provider implementation.
Learning to read package names can help you understand the ecosystem faster.
Meta-Packages and Integration Packages
Some packages are designed mainly to connect two technologies.
For example:
Microsoft.Extensions.AI.OpenAI
is not a replacement for:
OpenAI
Instead, conceptually:
OpenAI SDK
|
v
Integration Package
|
v
IChatClient
Likewise, a vector provider package can connect:
VectorData abstraction
|
v
Specific vector database
Understanding this prevents unnecessary package duplication.
.jpg "AI NuGet Packages for .NET")
AI NuGet Packages for OpenAI
A typical OpenAI-based project may contain:
OpenAI
Microsoft.Extensions.AI
Microsoft.Extensions.AI.OpenAI
Architecture:
Application
|
v
IChatClient
|
v
Microsoft.Extensions.AI.OpenAI
|
v
OpenAI
This is a useful architecture when application-level provider independence matters.
AI NuGet Packages for Azure OpenAI
A typical Azure OpenAI application may use:
Azure.AI.OpenAI
Azure.Identity
Microsoft.Extensions.AI
and depending on integration style:
Microsoft.Extensions.AI
can sit above the provider client.
Architecture:
Application
|
v
IChatClient
|
v
Azure.AI.OpenAI
|
v
Azure OpenAI
AI NuGet Packages for Ollama
A local-AI application may use:
OllamaSharp
Microsoft.Extensions.AI
Architecture:
Application
|
v
IChatClient
|
v
OllamaSharp
|
v
Ollama
The current NuGet package for OllamaSharp shown is 5.4.30.
AI NuGet Packages for RAG
A typical modern RAG stack can use:
Microsoft.Extensions.AI
Microsoft.Extensions.DataIngestion
Microsoft.Extensions.VectorData.Abstractions
Provider SDK
Vector Provider
Architecture:
Document
|
v
DataIngestion
|
v
Chunks
|
v
IEmbeddingGenerator
|
v
VectorData
|
v
Vector Store
|
v
IChatClient
|
v
Answer
Microsoft's current ecosystem guidance explicitly describes this combination for RAG applications.
AI NuGet Packages for Agents
A modern agent application might contain:
Microsoft.Extensions.AI
Microsoft.Agents.AI
Microsoft.Agents.AI.OpenAI
and possibly:
Microsoft.Extensions.VectorData
ModelContextProtocol
depending on the architecture.
The resulting system could be:
User
|
v
Agent
|
+---- LLM
|
+---- Tools
|
+---- RAG
|
+---- MCP
|
v
Final response
AI NuGet Packages for MCP
A simple MCP project can use:
dotnet add package ModelContextProtocol
For an ASP.NET Core MCP server:
dotnet add package ModelContextProtocol.AspNetCore
The current MCP SDK documentation identifies these as the primary package layers.
MCP Package Architecture
ASP.NET Core
|
v
ModelContextProtocol.AspNetCore
|
v
ModelContextProtocol
|
v
ModelContextProtocol.Core
The exact set depends on whether the project is:
MCP client
MCP low-level server
MCP hosted server
ASP.NET Core MCP server
AI NuGet Packages for Evaluation
A project that needs quality measurement may use:
Microsoft.Extensions.AI.Evaluation
Microsoft.Extensions.AI.Evaluation.Quality
The package architecture is:
AI Application
|
v
AI Response
|
v
Evaluation
|
v
Quality Metrics
This is useful for:
Prompt regression testing
RAG evaluation
Agent evaluation
Model comparison
Quality monitoring
AI NuGet Packages for Traditional ML
A machine-learning application might use:
Microsoft.ML
plus additional ML.NET packages based on the algorithm or model format required.
The core model is:
Training Data
|
v
ML.NET
|
v
Model
|
v
Prediction
This is a different stack from LLM-based generation.
AI NuGet Packages and Native Dependencies
Some AI packages may eventually rely on native libraries.
This can matter when publishing:
Windows
Linux
macOS
Android
iOS
Containers
Always test:
Development machine
CI server
Production OS
Target architecture
especially for:
Local AI
Speech
Computer vision
ONNX
Native inference
GPU acceleration
A package that works on Windows development does not automatically guarantee identical runtime behavior on every production target.
AI NuGet Packages and Target Frameworks
The project target matters.
For example:
<TargetFramework>net10.0</TargetFramework>
Some AI packages may support:
net8.0
net9.0
net10.0
while other packages may have more restrictive requirements.
Check the NuGet package's supported target frameworks before installing it.
For example, the current Microsoft.Extensions.AI package supports .NET 8 and higher and also has broader compatibility targets through its package assets.
The vector-data abstractions package similarly lists .NET 8 and .NET 10 compatibility.
AI NuGet Packages and .NET MAUI
AI packages can also be used in .NET MAUI applications, but package compatibility must be checked against:
Android
iOS
Mac Catalyst
Windows
A server-side AI SDK may be better kept on the backend:
.NET MAUI
|
v
ASP.NET Core API
|
v
AI NuGet Packages
|
v
AI Provider
This is especially important when provider credentials must remain private.
AI NuGet Packages and Blazor
For Blazor WebAssembly, avoid exposing server-side provider credentials.
Preferred architecture:
Blazor WebAssembly
|
v
ASP.NET Core API
|
v
AI NuGet Packages
|
v
AI Provider
The AI packages therefore typically belong to the server-side project.
AI NuGet Packages in Background Workers
AI processing can also happen in a Worker Service.
For example:
Queue
|
v
Worker Service
|
+---- DataIngestion
|
+---- Embeddings
|
+---- VectorData
|
+---- AI
This is useful for:
Document indexing
Bulk processing
Summarization
Data enrichment
Scheduled AI jobs
AI NuGet Packages and Dependency Injection
AI packages generally work well with .NET dependency injection.
For example:
builder.Services.AddSingleton(
chatClient);
builder.Services.AddScoped<
IAIService,
AIService>();
The project therefore keeps:
Package implementation
|
v
DI registration
|
v
Application abstraction
rather than constructing SDK clients everywhere.
A Good Package Organization
A practical Infrastructure project might contain folders:
Infrastructure
AI
OpenAI
AzureOpenAI
Ollama
Embeddings
OpenAI
Vector
Qdrant
AzureAISearch
Ingestion
Documents
Evaluation
AI
Agents
OpenAI
The NuGet references then correspond to infrastructure responsibilities.
A Production-Style .csproj
For a simple OpenAI application:
<Project Sdk="Microsoft.NET.Sdk.Web">
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
<ItemGroup>
<PackageReference
Include="Microsoft.Extensions.AI"
Version="10.10.0" />
<PackageReference
Include="Microsoft.Extensions.AI.OpenAI"
Version="10.10.0" />
<PackageReference
Include="OpenAI"
Version="2.14.0" />
</ItemGroup>
</Project>
For a more advanced RAG solution, the project might additionally reference vector and ingestion components, but Microsoft.Extensions.DataIngestion is currently prerelease and should be added deliberately rather than casually.
Package Management Workflow
A disciplined workflow is:
1. Identify requirement
|
v
2. Search NuGet
|
v
3. Verify publisher
|
v
4. Check current version
|
v
5. Check compatibility
|
v
6. Check license
|
v
7. Check vulnerabilities
|
v
8. Install
|
v
9. Restore
|
v
10. Test
|
v
11. Commit dependency changes
For important applications, also use:
Central Package Management
packages.lock.json
Locked restore
NuGet audit
CI testing
Common AI NuGet Mistakes
Installing too many packages
A simple chatbot does not need:
Agent Framework
MCP
VectorData
DataIngestion
ML.NET
Evaluation
unless the application actually uses those capabilities.
Copying package names from old tutorials
Packages may be:
Renamed
Deprecated
Split
Merged
Moved
Replaced
The current NuGet page for Microsoft.SemanticKernel.Connectors.InMemory is a concrete example: NuGet marks it deprecated and points developers toward CommunityToolkit.VectorData.InMemory.
Mixing incompatible package generations
Avoid randomly combining:
Old Semantic Kernel
New Extensions.AI
Old vector connector
New Agent Framework
without checking dependencies.
Manually adding every transitive dependency
Let NuGet resolve normal transitive dependencies unless you have a specific reason to control one.
Ignoring prerelease labels
A package with:
-preview
or:
-alpha
or:
-beta
is not equivalent to a normal stable release.
Ignoring vulnerabilities
Run:
dotnet package list --vulnerable --include-transitive
regularly. NuGet's current audit tooling is designed to expose known vulnerabilities in direct and transitive dependencies.
Updating everything at once
Avoid blindly upgrading every package.
Instead:
One dependency group
|
v
Restore
|
v
Build
|
v
Unit Tests
|
v
Integration Tests
|
v
AI Evaluation
Then move to the next group.
AI Package Update Strategy
AI libraries evolve quickly.
For example, the official OpenAI .NET package has had numerous releases during 2026, with version 2.14.0 released September 15, 2026 and earlier releases adding new audio, Responses API, telemetry, and other capabilities.
Therefore, package updates should be intentional.
A good process is:
Current Version
|
v
Read Release Notes
|
v
Update
|
v
Build
|
v
Test
|
v
Evaluate AI Behavior
|
v
Deploy
AI Package Regression Testing
A normal package update can pass compilation while still changing AI behavior.
For example:
Package Update
|
v
Application Builds Successfully
|
v
AI Prompt Behavior Changed
This is why AI evaluation becomes important.
A good update process tests both:
Software correctness
and:
AI behavior
AI Packages and Semantic Versioning
Many NuGet packages use versions such as:
2.14.0
which conventionally represent:
Major.Minor.Patch
However, package behavior is governed by the package's actual compatibility policy, not by version numbers alone.
AI packages can also introduce:
Preview releases
Experimental APIs
Rapid feature additions
The OpenAI .NET repository, for example, explicitly notes that some APIs are marked experimental while their .NET design evolves.
Experimental APIs
An AI NuGet package may compile but still mark a portion of its API as experimental.
For example, the official OpenAI .NET library documents [Experimental] APIs and requires explicit suppression of the corresponding diagnostic when those APIs are used.
This tells you:
The API exists
but
The API design may continue to evolve
Do not treat such APIs as equivalent to mature stable APIs.
AI NuGet Packages and Architecture
NuGet dependencies should follow application architecture.
A useful arrangement is:
Domain
|
X AI provider packages
Application
|
+---- AI contracts
+---- Use cases
Infrastructure
|
+---- AI provider SDK
+---- AI abstractions
+---- Vector packages
+---- Ingestion packages
+---- Evaluation infrastructure
This prevents the business domain from becoming tightly coupled to the AI provider.
Practical Project: AI Chat API
Build a small ASP.NET Core API.
Install:
dotnet add package Microsoft.Extensions.AI --version 10.10.0
dotnet add package Microsoft.Extensions.AI.OpenAI --version 10.10.0
dotnet add package OpenAI --version 2.14.0
Create the service:
using Microsoft.Extensions.AI;
public interface IAIService
{
Task<string> GenerateAsync(
string prompt,
CancellationToken cancellationToken = default);
}
Implementation:
using Microsoft.Extensions.AI;
public sealed class AIService : IAIService
{
private readonly IChatClient _chatClient;
public AIService(IChatClient chatClient)
{
_chatClient = chatClient;
}
public async Task<string> GenerateAsync(
string prompt,
CancellationToken cancellationToken = default)
{
ChatResponse response =
await _chatClient.GetResponseAsync(
prompt,
cancellationToken: cancellationToken);
return response.Text;
}
}
Register:
builder.Services.AddSingleton(chatClient);
builder.Services.AddScoped<
IAIService,
AIService>();
Controller:
using Microsoft.AspNetCore.Mvc;
public sealed record GenerateRequest(
string Prompt);
[ApiController]
[Route("api/ai")]
public sealed class AIController :
ControllerBase
{
private readonly IAIService _aiService;
public AIController(
IAIService aiService)
{
_aiService = aiService;
}
[HttpPost("generate")]
public async Task<IActionResult> Generate(
GenerateRequest request,
CancellationToken cancellationToken)
{
if (string.IsNullOrWhiteSpace(
request.Prompt))
{
return BadRequest(
"Prompt is required.");
}
string result =
await _aiService.GenerateAsync(
request.Prompt,
cancellationToken);
return Ok(new
{
response = result
});
}
}
This project demonstrates:
NuGet
|
v
AI SDK
|
v
AI abstraction
|
v
Dependency Injection
|
v
ASP.NET Core API
Practical Project: RAG Package Stack
For the next level, build:
AI Knowledge Base
Use:
Microsoft.Extensions.AI
Microsoft.Extensions.DataIngestion
Microsoft.Extensions.VectorData
OpenAI integration
Vector store provider
Architecture:
PDF
|
v
DataIngestion
|
v
Chunk
|
v
IEmbeddingGenerator
|
v
VectorData
|
v
Vector Store
|
v
Search
|
v
IChatClient
|
v
Answer
The current Microsoft ecosystem specifically presents this combination as the common .NET RAG architecture.
Practical Project: AI Agent Package Stack
A more advanced project can use:
Microsoft.Extensions.AI
Microsoft.Agents.AI
Microsoft.Agents.AI.OpenAI
ModelContextProtocol
Architecture:
User
|
v
Agent
|
+---- IChatClient
|
+---- Tools
|
+---- MCP
|
+---- RAG
|
v
AI Model
This is no longer simply:
Prompt -> Response
It becomes:
Goal
|
v
Agent
|
+---- Decide
|
+---- Tool
|
+---- Observe
|
+---- Continue
|
v
Result
Practical Project: Enterprise AI Package Management
For an enterprise solution:
DotNetAI.sln
use:
Directory.Packages.props
packages.lock.json
nuget.config
and potentially:
NuGet Audit
Central Package Management
Locked Restore
Architecture:
Source Code
|
v
Directory.Packages.props
|
v
PackageReference
|
v
NuGet Restore
|
+--+----------+-----------+
| | |
v v v
Packages Audit Lock File
|
v
Build
|
v
Tests
|
v
Deployment
This turns package management into a controlled engineering process rather than an ad-hoc set of dotnet add package commands.
Package Management Checklist
Before adding an AI package, check:
Package name
Publisher
Current stable version
Prerelease status
Target frameworks
Dependencies
License
GitHub/source repository
Release history
Known vulnerabilities
Deprecation status
Documentation
Before updating an AI package, check:
Release notes
Breaking changes
Experimental APIs
Transitive dependencies
Application tests
AI evaluations
Before deploying, check:
Vulnerabilities
Locked dependencies
Production configuration
Secrets
Provider compatibility
Runtime compatibility
Frequently Asked Questions
What are AI NuGet packages?
AI NuGet packages are .NET packages that provide reusable AI capabilities such as model access, embeddings, vector search, document processing, evaluations, machine learning, agents, and MCP.
What is the main AI package for modern .NET applications?
Microsoft.Extensions.AI is a central general-purpose abstraction and integration layer in the current .NET AI ecosystem.
What NuGet package do I need for OpenAI?
The official provider package is:
OpenAI
The current release is 2.14.0 as shown by the official project release history.
For integration with IChatClient, also use:
Microsoft.Extensions.AI.OpenAI
currently shown as 10.10.0.
What package do I need for Azure OpenAI?
The main Azure SDK package is:
Azure.AI.OpenAI
The current NuGet page shows 2.1.0.
What package can I use for local Ollama AI?
A commonly used .NET client is:
OllamaSharp
The current NuGet page shows version 5.4.30.
What package is used for vector databases?
The Microsoft abstraction is:
Microsoft.Extensions.VectorData.Abstractions
currently shown as 10.10.0. Actual vector-store implementations are provided separately.
What package is used for document ingestion?
The current Microsoft package is:
Microsoft.Extensions.DataIngestion
It is currently a prerelease package.
What package is used for AI evaluation?
Use:
Microsoft.Extensions.AI.Evaluation
and, where needed:
Microsoft.Extensions.AI.Evaluation.Quality
Both currently show 10.10.0.
What package is used for traditional machine learning?
Use:
Microsoft.ML
The current NuGet page shows version 5.0.0.
What package is used for Semantic Kernel?
Use:
Microsoft.SemanticKernel
The current NuGet page shows version 1.80.1.
What package is used for Microsoft Agent Framework?
The core package is:
Microsoft.Agents.AI
The current NuGet page shows 1.22.0.
What NuGet package is used for MCP?
The current official C# SDK package is:
ModelContextProtocol
currently shown as 2.2.0. For ASP.NET Core MCP servers, the SDK also provides ModelContextProtocol.AspNetCore.
Should I install every AI NuGet package?
No.
Install packages according to application requirements.
A simple chatbot might need only:
Microsoft.Extensions.AI
Provider package
A RAG application adds:
VectorData
DataIngestion
An agent application may add:
Agent Framework
Tools
MCP
Should I manually install transitive dependencies?
Normally no.
NuGet resolves transitive dependencies automatically.
Only add them directly when your architecture has a specific reason to depend on them.
How do I check outdated AI packages?
Use:
dotnet package list --outdated
and optionally:
dotnet package list \
--outdated \
--include-prerelease
Microsoft documents these options for current .NET SDK tooling.
How do I check vulnerable packages?
Use:
dotnet package list --vulnerable
and:
dotnet package list \
--vulnerable \
--include-transitive
NuGet's current audit functionality supports vulnerability checking of package dependencies.
How do I keep package versions consistent across many projects?
Use:
Directory.Packages.props
through Central Package Management.
How do I make package restores reproducible?
Use:
packages.lock.json
and, for CI:
dotnet restore --locked-mode
NuGet documents lock files and locked restore specifically for preserving a known dependency graph.
Can AI NuGet packages be prerelease?
Yes.
For example:
Microsoft.Extensions.DataIngestion
is currently a prerelease package.
Should prerelease AI packages be used in production?
That depends on the application and the package, but they should be adopted deliberately because the API surface may still change.
Can a NuGet package be deprecated?
Yes.
For example, the current NuGet page for Microsoft.SemanticKernel.Connectors.InMemory marks it deprecated and points developers to CommunityToolkit.VectorData.InMemory.
Interview Questions
What is NuGet?
NuGet is the package-management system used by .NET applications.
What is PackageReference?
PackageReference is the project-file mechanism used to declare NuGet dependencies.
What is the difference between direct and transitive dependencies?
A direct dependency is explicitly referenced by your project.
A transitive dependency is brought in by one of your direct or other transitive dependencies.
Why are transitive dependencies important?
They affect:
Security
Version resolution
Build output
Compatibility
Licensing
What is Microsoft.Extensions.AI?
It provides common abstractions and utilities for integrating AI capabilities into .NET applications, including chat and embeddings.
What is the OpenAI NuGet package?
OpenAI is the official .NET library for the OpenAI API.
What is an integration package?
An integration package adapts one library or provider to another abstraction.
For example:
Microsoft.Extensions.AI
+
Microsoft.Extensions.AI.OpenAI
+
OpenAI
allows an OpenAI client to participate in the common IChatClient architecture.
What is Central Package Management?
It allows package versions to be defined centrally, usually in Directory.Packages.props, rather than separately in every project.
What is a NuGet lock file?
packages.lock.json records the resolved package dependency graph so restore can be made more reproducible.
What is locked-mode restore?
It prevents NuGet from changing the package graph during restore and fails when the lock file is inconsistent with the project dependencies.
What is a prerelease package?
A package version explicitly marked as preview, beta, alpha, or another prerelease status.
Why should AI package versions be controlled carefully?
AI packages evolve quickly and may introduce:
API changes
Provider changes
New abstractions
Breaking changes
Experimental features
Why should vulnerabilities in transitive packages be checked?
A vulnerability in an indirect dependency can still affect the deployed application.
Modern NuGet audit tooling can identify vulnerable transitive dependencies.
What package is used for traditional machine learning in .NET?
Microsoft.ML.
What package is used for vector-store abstractions?
Microsoft.Extensions.VectorData.Abstractions.
What package is used for document ingestion?
Microsoft.Extensions.DataIngestion, which is currently prerelease.
What package is used for AI evaluation?
Microsoft.Extensions.AI.Evaluation and related evaluator packages such as Microsoft.Extensions.AI.Evaluation.Quality.
What package is used for MCP?
ModelContextProtocol.
Exercises
Exercise 1: Inspect NuGet Dependencies
Create a .NET 10 Web API project:
dotnet new webapi -n AINuGetDemo
cd AINuGetDemo
Install:
dotnet add package Microsoft.Extensions.AI
dotnet add package OpenAI
Then run:
dotnet package list
and:
dotnet package list --include-transitive
Study the resulting dependency graph.
Exercise 2: Check for Updates
Run:
dotnet package list --outdated
Then investigate which packages have updates available.
Do not immediately update them.
Read the release notes first.
Exercise 3: Security Audit
Run:
dotnet package list \
--vulnerable \
--include-transitive
Identify any vulnerable dependency and determine whether a fixed version exists.
Exercise 4: Central Package Management
Create:
Directory.Packages.props
and move package versions into that file.
Create two projects and share the same AI package versions.
Exercise 5: Lock Dependencies
Enable:
<RestorePackagesWithLockFile>
true
</RestorePackagesWithLockFile>
Run:
dotnet restore
Commit:
packages.lock.json
Then test:
dotnet restore --locked-mode
Exercise 6: OpenAI Package
Install:
dotnet add package OpenAI
Create a simple console application that sends a prompt and prints the response.
Exercise 7: Microsoft.Extensions.AI
Add:
dotnet add package Microsoft.Extensions.AI
dotnet add package Microsoft.Extensions.AI.OpenAI
Adapt the provider client to IChatClient.
Exercise 8: Local AI
Install:
dotnet add package OllamaSharp
Connect to a locally running Ollama service.
Keep the application-level interface unchanged.
Exercise 9: RAG Package Stack
Create a project using:
Microsoft.Extensions.AI
Microsoft.Extensions.VectorData
Microsoft.Extensions.DataIngestion
Build the following pipeline:
Document
|
v
Ingestion
|
v
Chunking
|
v
Embedding
|
v
Vector Store
Exercise 10: AI Evaluation
Install:
dotnet add package Microsoft.Extensions.AI.Evaluation
dotnet add package Microsoft.Extensions.AI.Evaluation.Quality
Create several test prompts and evaluate the resulting answers.
Learning Path After AI NuGet Packages
The next roadmap topics are:
#14 AI Integration Patterns in .NET
#15 AI Application Architecture with .NET
Then the series moves into:
Large Language Models with .NET
Using LLMs in C#
Calling LLM APIs from .NET
Chat Models with .NET
Text Generation with .NET
AI Text Generation with C#
AI Chat Applications with .NET
Streaming AI Responses with .NET
Later, the package knowledge becomes important for:
OpenAI
Azure OpenAI
Semantic Kernel
RAG
Embeddings
Vector Databases
Local AI
Vision
Speech
Document AI
AI Agents
MCP
Blazor
.NET MAUI
Automation
Security
Testing
Production AI
Key Takeaways
NuGet is not simply a way to install libraries.
In a modern AI application, NuGet dependencies describe much of the application's architecture.
The most important packages to understand are:
Microsoft.Extensions.AI
OpenAI
Microsoft.Extensions.AI.OpenAI
Azure.AI.OpenAI
OllamaSharp
Microsoft.Extensions.VectorData.Abstractions
Microsoft.Extensions.DataIngestion
Microsoft.Extensions.AI.Evaluation
Microsoft.Extensions.AI.Evaluation.Quality
Microsoft.SemanticKernel
Microsoft.Agents.AI
ModelContextProtocol
Microsoft.ML
The roles are different:
AI abstraction
|
v
Microsoft.Extensions.AI
Provider SDK
|
+---- OpenAI
+---- Azure.AI.OpenAI
+---- OllamaSharp
RAG data
|
+---- DataIngestion
+---- VectorData
Evaluation
|
+---- AI.Evaluation
Traditional ML
|
+---- ML.NET
Orchestration
|
+---- Semantic Kernel
+---- Agent Framework
Tool interoperability
|
+---- MCP
The best project does not necessarily use the most packages.
The best project uses the packages appropriate to its requirements.
Conclusion
AI NuGet packages are the building blocks that turn .NET AI development from a simple API call into a complete application architecture.
A small application may need only:
Microsoft.Extensions.AI
+
Provider SDK
A RAG application can add:
DataIngestion
+
VectorData
An evaluation pipeline can add:
AI.Evaluation
A traditional machine-learning feature can add:
ML.NET
An advanced agent can add:
Agent Framework
And an interoperable tool ecosystem can add:
MCP
The most important engineering lesson is to manage these dependencies deliberately.
Use exact versions where appropriate.
Separate direct and transitive dependencies.
Use Central Package Management for larger solutions.
Use lock files for reproducibility.
Audit vulnerable dependencies.
Check whether AI packages are stable, prerelease, experimental, or deprecated.
And never assume that a package name or API shown in an old AI tutorial is still the recommended package today.
The current .NET AI ecosystem is moving toward composable layers: Microsoft.Extensions.AI for common AI interaction, DataIngestion and VectorData for application data and RAG, evaluation for quality control, Agent Framework for advanced agentic workflows, MCP for interoperability, and provider SDKs for direct model access.
That package architecture provides the foundation for the next topic in the series: AI Integration Patterns in .NET.
Post a Comment