Reverse-engineering MCP server for AI agents: .NET and native PE/ELF/Mach-O analysis, decompilation, cross-references and patching. IDA and Ghidra optional.
C#
2
1,709 commits
updated Oct 19, 2026
Reverse engineering for AI agents. Corvus is an MCP server that lets your agent read, trace, compare and patch compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries. One self-contained binary, no runtime to install, nothing uploaded; by default nothing it reads is executed.
[!NOTE] Corvus is under active development. Tools, parameters and output can change between releases; breaking changes are listed in the release notes. Bug reports and feedback are welcome in issues.
Quick start · How it works · What you can analyze · Showcases · Why Corvus · Documentation
Windows (PowerShell):
irm https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.ps1 | iex
Linux / macOS:
curl -fsSL https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.sh | sh
The installer verifies the download against the release's SHA256SUMS and registers Corvus with the MCP clients it
finds. As a plugin (server and skill; needs the .NET 10 SDK): /plugin install corvus --marketplace Albasha0x0/Corvus
in Claude Code, codex plugin marketplace add Albasha0x0/Corvus then corvus in /plugins in Codex
(installation). Restart your client and ask:
Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.
From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
Your agent calls Corvus over MCP. Corvus answers with bounded, structured results: every list pages, every error names
the next step, and long results are kept for read_result. The agent follows calls and references, explains the
behaviour, and can patch a copy and save it.
Native code is analyzed by Corvus's own engine (x86, x64, ARM32, ARM64), with IDA or Ghidra as optional decompilers when installed. Their databases and output are kept, so the second question about a binary is fast.
| Target | What you get | Needs |
|---|---|---|
| .NET assemblies | C# decompilation, IL, references, call graphs, build comparison, C# and IL patching, saving | nothing |
| Unity and Il2Cpp games | metadata, addresses, string literals, IDA / Ghidra scripts, C++ bindings | nothing |
| Native binaries (PE, ELF, Mach-O) | functions, disassembly, CFG, cross-references, values, RTTI, PDB types, similar functions | nothing |
| Native pseudocode | decompilation, engine types, frames, scripting | IDA 9 (idalib) or Ghidra 12 |
| NativeAOT and ReadyToRun | method names, MethodTables, strings, precompiled code | nothing |
| Native patching | names, comments, byte and assembly patches, patched copies, carried to new builds | nothing |
| Containers | single-file bundles, NuGet, APK, ASAR, Unity WebGL, HAR captures | nothing |
| Android packages | manifest, resources, DEX, smali, Java (JADX), JNI bindings, devices over adb | JADX for Java, adb for devices |
| Crash dumps | Windows minidumps, .NET exceptions, stacks, heap; crash text | nothing |
Full list: features and the tool reference (165 tools, 15 prompts).
sqlite3_randomness and its callers, recorded as an evidence bundle and re-verified.Each step in the showcases and guides is checked by a test.
Supported clients: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, VS Code Insiders, VSCodium, Cline, Roo Code,
Kilo Code, Visual Studio, Codex, Gemini CLI, Qwen Code, GitHub Copilot CLI, OpenCode, Crush, Zed, LM Studio,
Amazon Q, Kiro, Antigravity, Devin, Command Code, Grok Build, OMP and Pi. Any other client: corvus config.
Installation · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes
Guides: first session · decode and patch · new build.
Analyze software you own or are permitted to analyze. Decompiling, patching or redistributing third-party code can be restricted by its license and by law where you live.
Reverse-engineering MCP server for AI agents: .NET and native PE/ELF/Mach-O analysis, decompilation, cross-references and patching. IDA and Ghidra optional.
C#
2
1,709 commits
updated Oct 19, 2026
Reverse engineering for AI agents. Corvus is an MCP server that lets your agent read, trace, compare and patch compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries. One self-contained binary, no runtime to install, nothing uploaded; by default nothing it reads is executed.
[!NOTE] Corvus is under active development. Tools, parameters and output can change between releases; breaking changes are listed in the release notes. Bug reports and feedback are welcome in issues.
Quick start · How it works · What you can analyze · Showcases · Why Corvus · Documentation
Windows (PowerShell):
irm https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.ps1 | iex
Linux / macOS:
curl -fsSL https://raw.githubusercontent.com/Albasha0x0/Corvus/main/install.sh | sh
The installer verifies the download against the release's SHA256SUMS and registers Corvus with the MCP clients it
finds. As a plugin (server and skill; needs the .NET 10 SDK): /plugin install corvus --marketplace Albasha0x0/Corvus
in Claude Code, codex plugin marketplace add Albasha0x0/Corvus then corvus in /plugins in Codex
(installation). Restart your client and ask:
Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.
From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
Your agent calls Corvus over MCP. Corvus answers with bounded, structured results: every list pages, every error names
the next step, and long results are kept for read_result. The agent follows calls and references, explains the
behaviour, and can patch a copy and save it.
Native code is analyzed by Corvus's own engine (x86, x64, ARM32, ARM64), with IDA or Ghidra as optional decompilers when installed. Their databases and output are kept, so the second question about a binary is fast.
| Target | What you get | Needs |
|---|---|---|
| .NET assemblies | C# decompilation, IL, references, call graphs, build comparison, C# and IL patching, saving | nothing |
| Unity and Il2Cpp games | metadata, addresses, string literals, IDA / Ghidra scripts, C++ bindings | nothing |
| Native binaries (PE, ELF, Mach-O) | functions, disassembly, CFG, cross-references, values, RTTI, PDB types, similar functions | nothing |
| Native pseudocode | decompilation, engine types, frames, scripting | IDA 9 (idalib) or Ghidra 12 |
| NativeAOT and ReadyToRun | method names, MethodTables, strings, precompiled code | nothing |
| Native patching | names, comments, byte and assembly patches, patched copies, carried to new builds | nothing |
| Containers | single-file bundles, NuGet, APK, ASAR, Unity WebGL, HAR captures | nothing |
| Android packages | manifest, resources, DEX, smali, Java (JADX), JNI bindings, devices over adb | JADX for Java, adb for devices |
| Crash dumps | Windows minidumps, .NET exceptions, stacks, heap; crash text | nothing |
Full list: features and the tool reference (165 tools, 15 prompts).
sqlite3_randomness and its callers, recorded as an evidence bundle and re-verified.Each step in the showcases and guides is checked by a test.
Supported clients: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, VS Code Insiders, VSCodium, Cline, Roo Code,
Kilo Code, Visual Studio, Codex, Gemini CLI, Qwen Code, GitHub Copilot CLI, OpenCode, Crush, Zed, LM Studio,
Amazon Q, Kiro, Antigravity, Devin, Command Code, Grok Build, OMP and Pi. Any other client: corvus config.
Installation · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes
Guides: first session · decode and patch · new build.
Analyze software you own or are permitted to analyze. Decompiling, patching or redistributing third-party code can be restricted by its license and by law where you live.