diff --git a/NuGetMcpBenchmarks/.gitignore b/NuGetMcpBenchmarks/.gitignore
new file mode 100644
index 0000000..cd42ee3
--- /dev/null
+++ b/NuGetMcpBenchmarks/.gitignore
@@ -0,0 +1,2 @@
+bin/
+obj/
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs
new file mode 100644
index 0000000..fb7e06a
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs
@@ -0,0 +1,44 @@
+using Xunit;
+using VulnerableApp;
+
+namespace VulnerableApp.Tests;
+
+public class UserDataServiceTests
+{
+ [Fact]
+ public void SerializeUser_ProducesValidJson()
+ {
+ var service = new UserDataService();
+ var user = new User("Alice", "alice@example.com", 30);
+
+ var json = service.SerializeUser(user);
+
+ Assert.NotNull(json);
+ Assert.Contains("Alice", json);
+ Assert.Contains("alice@example.com", json);
+ }
+
+ [Fact]
+ public void DeserializeUser_RoundTrips()
+ {
+ var service = new UserDataService();
+ var user = new User("Alice", "alice@example.com", 30);
+
+ var result = service.DeserializeUser(service.SerializeUser(user));
+
+ Assert.NotNull(result);
+ Assert.Equal(user.Name, result.Name);
+ Assert.Equal(user.Email, result.Email);
+ Assert.Equal(user.Age, result.Age);
+ }
+
+ [Fact]
+ public void DeserializeUser_ReturnsNull_ForNullJson()
+ {
+ var service = new UserDataService();
+
+ var result = service.DeserializeUser("null");
+
+ Assert.Null(result);
+ }
+}
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj
new file mode 100644
index 0000000..6d824ae
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj
@@ -0,0 +1,17 @@
+
+
+ net8.0
+ enable
+ enable
+ false
+
+
+
+
+
+ runtime; build; native; contentfiles; analyzers; buildtransitive
+ all
+
+
+
+
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs
new file mode 100644
index 0000000..92f00ec
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs
@@ -0,0 +1,12 @@
+using Newtonsoft.Json;
+
+namespace VulnerableApp;
+
+public class UserDataService
+{
+ public string SerializeUser(User user) => JsonConvert.SerializeObject(user);
+
+ public User? DeserializeUser(string json) => JsonConvert.DeserializeObject(json);
+}
+
+public record User(string Name, string Email, int Age);
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj
new file mode 100644
index 0000000..5fcef26
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj
@@ -0,0 +1,10 @@
+
+
+ net8.0
+ enable
+ enable
+
+
+
+
+