Corvus

English · 简体中文 · 日本語

MCP server for reverse engineering and security analysis of compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries.

• One self-contained binary. Nothing is uploaded; nothing it reads is executed by default.
• Tools and output can change between releases; see the release notes.

Quick start

Windows (PowerShell):

irm https://github.com/Albasha0x0/Corvus/releases/latest/download/install.ps1 | iex

Linux and macOS:

curl -fsSL https://github.com/Albasha0x0/Corvus/releases/latest/download/install.sh | sh

The installer verifies the download and registers Corvus with the MCP clients it finds. Restart the client and ask:

Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.

• Plugin, container image and other clients: installation.
• From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
• Builds: win-x64, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64.

How it works

• The agent calls Corvus over MCP; every result is bounded, every list pages, every error names the next step.
• Corvus's own engine reads native code (x86, x64, ARM32, ARM64); IDA or Ghidra, when installed, add pseudocode.
• Edits happen in memory; the agent reviews the diff and saves a patched copy.

What it reads

| Input | Shows | Needs | |---|---|---| | .NET assemblies | C#, IL, references, call graphs, patches | nothing | | Native PE, ELF, Mach-O | functions, disassembly, cross-references, types, patches | nothing | | Native pseudocode | decompiled functions, engine types, scripts | IDA 9 or Ghidra 12 | | NativeAOT, ReadyToRun, Il2Cpp | method names and addresses, strings | nothing | | WebAssembly | modules, components, disassembly | nothing | | Containers | single-file bundles, APK, IPA, installers, disk images, firmware | nothing | | Documents and scripts | Office macros, PDF actions, deobfuscated scripts | nothing | | Packages before install | npm, PyPI, RubyGems and extension packages | nothing | | Network captures | pcap streams, HTTP objects, TLS with a key log | nothing | | Android | manifest, resources, DEX, Java | JADX for Java, adb for devices | | Crash dumps | minidumps, core dumps, stacks, .NET heap | nothing | | Running programs | stop points, call recording, code coverage | Frida 17.24.3 to 17.24.x; off by default |

All 165 tools and 15 prompts: features, tool reference.

Guides: first session · decode and patch · new build.

Documentation

Installation · Configuration · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes · All pages

Responsible use

Analyze only software you own or may analyze. Licenses and local law can restrict decompiling, patching and redistribution.

Contributing · Security · Apache-2.0 license