Corvus

io.github.Albasha0x0Published by GitHub account Albasha0x0v2.12.0Updated Nov 7, 2026

Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Corvus is a local MCP server that lets an assistant decompile, inspect, compare and patch .NET and native binaries for reverse engineering and security…

What you can do
  • Decompile and inspect .NET assemblies: C#, IL, references, call graphs and patches
  • Disassemble native PE, ELF and Mach-O binaries: functions, cross-references, types and patches
  • Read NativeAOT, ReadyToRun, Il2Cpp, WebAssembly, containers, installers and firmware
  • Inspect documents, scripts, packages before install, network captures and crash dumps
  • Review in-memory edits as a diff and save a patched copy
  • Optionally add pseudocode via IDA or Ghidra, and observe running programs via Frida
When to use it
Useful when you need to understand how a compiled program works, audit a binary or package before installing it, compare builds, or produce a patched copy, with the assistant citing the methods it read.
Requirements
Runs as a local process on the desktop, installed from a self-contained binary for Windows, Linux or macOS (x64 and ARM64 builds). No accounts, API keys or environment variables are declared. Optional features need IDA 9 or Ghidra 12 for native pseudocode, JADX and adb for Android, and Frida for running programs.
Before you install
Patching writes a modified copy of the binary, so review the diff before saving. Analyzing running programs is off by default and requires Frida. Only analyze software you own or may analyze; licenses and local law can restrict decompiling, patching and redistribution. Tools and output may change between releases.

Installation

In SourceWeft

  1. Open Corvus in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Corvus

English · 简体中文 · 日本語

MCP server for reverse engineering and security analysis of compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries.

[Release] [CI] [License: Apache-2.0]

  • One self-contained binary. Nothing is uploaded; nothing it reads is executed by default.
  • Tools and output can change between releases; see the release notes.

Quick start

Windows (PowerShell):

powershell
irm https://github.com/Albasha0x0/Corvus/releases/latest/download/install.ps1 | iex

Linux and macOS:

sh
curl -fsSL https://github.com/Albasha0x0/Corvus/releases/latest/download/install.sh | sh

The installer verifies the download and registers Corvus with the MCP clients it finds. Restart the client and ask:

Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.

  • Plugin, container image and other clients: installation.
  • From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
  • Builds: win-x64, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64.

How it works

  • The agent calls Corvus over MCP; every result is bounded, every list pages, every error names the next step.
  • Corvus's own engine reads native code (x86, x64, ARM32, ARM64); IDA or Ghidra, when installed, add pseudocode.
  • Edits happen in memory; the agent reviews the diff and saves a patched copy.

What it reads

InputShowsNeeds
.NET assembliesC#, IL, references, call graphs, patchesnothing
Native PE, ELF, Mach-Ofunctions, disassembly, cross-references, types, patchesnothing
Native pseudocodedecompiled functions, engine types, scriptsIDA 9 or Ghidra 12
NativeAOT, ReadyToRun, Il2Cppmethod names and addresses, stringsnothing
WebAssemblymodules, components, disassemblynothing
Containerssingle-file bundles, APK, IPA, installers, disk images, firmwarenothing
Documents and scriptsOffice macros, PDF actions, deobfuscated scriptsnothing
Packages before installnpm, PyPI, RubyGems and extension packagesnothing
Network capturespcap streams, HTTP objects, TLS with a key lognothing
Androidmanifest, resources, DEX, JavaJADX for Java, adb for devices
Crash dumpsminidumps, core dumps, stacks, .NET heapnothing
Running programsstop points, call recording, code coverageFrida 17.24.3 to 17.24.x and 17.25.1 to 17.25.x; off by default

All 165 tools and 15 prompts: features, tool reference.

Guides: first session · decode and patch · new build.

Documentation

Installation · Configuration · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes · All pages

Responsible use

Analyze only software you own or may analyze. Licenses and local law can restrict decompiling, patching and redistribution.

Contributing · Security · Apache-2.0 license

Source: README.md at commit fe886d0

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

11
  1. v2.12.0LatestNov 7, 2026
  2. v2.11.1Nov 6, 2026
  3. v2.11.0Nov 5, 2026
  4. v2.10.0Nov 3, 2026
  5. v2.7.3Oct 29, 2026
  6. v2.6.0Oct 25, 2026
  7. v2.5.1Oct 23, 2026
  8. v2.4.0Oct 18, 2026
  9. v2.3.0Oct 15, 2026
  10. v2.2.0Oct 15, 2026
  11. v2.0.2Oct 14, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts