MMCPMarkets
AC

albasha0x0/corvus

Developer tools

このページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る

9 stars 1 forks 品質 73 トレンド 28Apache-2.0
Repository Install

Reverse-engineering MCP server for AI agents: .NET and native PE/ELF/Mach-O analysis, decompilation, cross-references and patching. IDA and Ghidra optional.

概要

Corvus is an MCP server that lets your agent read, trace, compare and patch compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries. One self-contained binary, no runtime to install, nothing executed, nothing uploaded. Corvus is under active development. Tools, parameters and output can change between releases; breaking changes are listed in the release notes. Bug reports and feedback are welcome in issues. The installer verifies the download against the release's SHA256SUMS and registers Corvus with the MCP clients it finds. As a plugin (server and skill; needs the .NET 10 SDK): /plugin install corvus --marketplace Albasha0x0/Corvus in Claude Code, codex plugin marketplace add Albasha0x0/Corvus then corvus in /plugins in Codex (installation). Restart your client and ask: Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read. From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).

README

以下は原文 README の抜粋です。原文を見る。

Corvus

English · 简体中文 · 日本語

MCP server for reverse engineering and security analysis of compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries.

  • One self-contained binary. Nothing is uploaded; nothing it reads is executed by default.
  • Tools and output can change between releases; see the release notes.

Quick start

Windows (PowerShell):

irm https://github.com/Albasha0x0/Corvus/releases/latest/download/install.ps1 | iex

Linux and macOS:

curl -fsSL https://github.com/Albasha0x0/Corvus/releases/latest/download/install.sh | sh

The installer verifies the download and registers Corvus with the MCP clients it finds. Restart the client and ask:

Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.

  • Plugin, container image and other clients: installation.
  • From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
  • Builds: win-x64, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64.

How it works

  • The agent calls Corvus over MCP; every result is bounded, every list pages, every error names the next step.
  • Corvus’s own engine reads native code (x86, x64, ARM32, ARM64); IDA or Ghidra, when installed, add pseudocode.
  • Edits happen in memory; the agent reviews the diff and saves a patched copy.

What it reads

Input Shows Needs
.NET assemblies C#, IL, references, call graphs, patches nothing
Native PE, ELF, Mach-O functions, disassembly, cross-references, types, patches nothing
Native pseudocode decompiled functions, engine types, scripts IDA 9 or Ghidra 12
NativeAOT, ReadyToRun, Il2Cpp method names and addresses, strings nothing
WebAssembly modules, components, disassembly nothing
Containers single-file bundles, APK, IPA, installers, disk images, firmware nothing
Documents and scripts Office macros, PDF actions, deobfuscated scripts nothing
Packages before install npm, PyPI, RubyGems and extension packages nothing
Network captures pcap streams, HTTP objects, TLS with a key log nothing
Android manifest, resources, DEX, Java JADX for Java, adb for devices
Crash dumps minidumps, core dumps, stacks, .NET heap nothing
Running programs stop points, call recording, code coverage Frida 17.24.3 or newer 17.x; off by default
GitHub で README 全文を見る

インストール

This server does not publish a one-line install command.

Open the repository installation guide MCP 初心者？mcpskill.org のガイドから始めましょう →