Corvus
NUGET · CORVUSRE
Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.
Available components
Last scanned (3 hours ago)
Scores higher than 59% of NuGet servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security88
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Install-script risk not yet assessed.Unverified
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance not yet verified. View diagnostics → Unverified
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 28245 tokens (~170/item across 166 items; 165 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability check failed: the tool surface changed between 2.3.0 and 2.11.0: 4 tool removals, 0 breaking changes, 13 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 167 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 81% → 100% ▲ functional
- Package version: 2.10.0 → 2.11.0 functional
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 61 to 64.
- 3 Nov 26 +1
- Package version: 2.7.3 → 2.10.0 functional
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 51.
- 29 Oct 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 2.7.2 → 2.7.3 functional
- 28 Oct 26 +15
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 2.7.0 → 2.7.2 functional
- Package version: 2.7.0 → 2.7.1 functional
- 27 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.37 → fail ▼ security
- Schema quality: 182 → 163 ▲ functional
- Package version: 2.6.0 → 2.7.0 functional
- 25 Oct 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.30 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Licence: MIT → Apache-2.0 functional
- Package version: 2.5.1 → 2.6.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed nuget/CorvusRE@2.11.0
Provenance Inconclusive
We could not complete the check, so nothing is claimed either way. This is a gap on our side, not a finding about the package.
| Result | Inconclusive |
|---|---|
| Ecosystem | nuget |
| Reason | Package not fetched |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_members_csharp Add members to a type (C#) ~102
Add C# members to a class or struct; private members are accessible. No field or property initializers. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Assembly id, name, path; omit: all. |
| code | string | yes | C# member declarations. |
| dryRun | boolean | – | true previews; false applies. |
| type | string | yes | Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
No examples provided.
add_search_directory Add reference search directory ~32
Add a folder where unloaded referenced assemblies are resolved; subfolders excluded.
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | yes | Directory path. |
| Name | Type | Req | Description |
|---|---|---|---|
| searchDirectories | array | – | – |
| suggested | array | – | – |
No examples provided.
add_types_csharp Add new types (C#) ~80
Add C# types (with namespace) to an assembly; they see its internal types; patch_method_csharp can call them. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| code | string | yes | C# source declaring the new types. |
| dryRun | boolean | – | true previews; false applies. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
No examples provided.
analyze_js Analyze a JavaScript bundle ~205
Read a JavaScript bundle, Hermes or Ark bytecode statically: modules, source map, endpoints, secrets and data flow.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | See line. |
| limit | integer | – | Rows: flow 50, react 200. |
| line | integer | – | position (original source), flow: 1-based generated line. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Char offset; flow, origins: flow index. |
| path | string | yes | A .js, Hermes or Ark file or package. |
| query | string | – | Module id; search filter; function #id|name; flow: name, quoted literal, sinks, sink:KIND, module:ID; beautify: a=b, a@line:col=b, auto; react/jsx: name. |
| source | string | – | source: path or index; diff: old bundle. |
| view | string | – | View. |
| Name | Type | Req | Description |
|---|---|---|---|
| diff | object | – | – |
| endpoints | array | – | – |
| flow | object | – | – |
| functions | array | – | – |
| hermes | object | – | – |
| modules | array | – | – |
| position | object | – | – |
| runtime | object | – | – |
| secrets | array | – | – |
| summary | object | – | – |
| total | integer | – | – |
| view | string | – | – |
No examples provided.
analyze_native_function Native function dossier ~212
Everything known about one native function, in sections: identity, signature, frame, callers, callees, data, flow, annotations; constants, params and pseudocode on request. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | In the function; up to 16 comma-separated (a dossier each): Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| component | boolean | – | Several addresses: one component view (internal calls, shared data, interface). |
| engine | string | – | Pseudocode engine (default auto). |
| image | string | yes | Image id, name, path. |
| maxItems | integer | – | Facts per section (1-500). |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Character offset (nextOffset). |
| pseudocode | boolean | – | Add the pseudocode section. |
| sections | string | – | Comma-separated sections (default all but constants, params, pseudocode). |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| batch | array | – | – |
| component | object | – | – |
| end | string | – | – |
| image | string | – | – |
| name | string | – | – |
| next | array | – | – |
| sections | array | – | – |
| size | integer | – | – |
No examples provided.
apply_edits Apply an edit script ~133
Replay an export_edits script, with each edit's outcome. Another build needs targetBuild=other. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Target assembly; omit for the one named in the script. |
| continueOnError | boolean | – | Apply the edits that succeed; default: roll all back on the first failure. |
| dryRun | boolean | – | true: apply every edit, report, roll back; false keeps them. |
| path | string | yes | The .json edit script. |
| targetBuild | string | – | same: the script build only; other: another build, symbols by name. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
| items | array | – | – |
| pushedTo | array | – | – |
No examples provided.
apply_metadata_names Name native code from its metadata ~106
Name the functions and data of an AOT binary as Ns_Type__Method from its dummy assemblies, script.json and stringliteral.json. User and PDB names win; names are saved per file hash and reapplied on load. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Dummy assemblies to use; omit for every loaded one with metadata. |
| clear | boolean | – | Remove the metadata names and saved copy instead. |
| image | string | yes | Image id, name, path. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| assemblies | string | – | – |
| functions | integer | – | – |
| image | string | – | – |
| labels | integer | – | – |
| metadataSlots | integer | – | – |
| methodInfoSlots | integer | – | – |
| misses | integer | – | – |
| removed | integer | – | – |
| saved | boolean | – | – |
| sharedFunctions | integer | – | – |
| strings | integer | – | – |
| suffixed | integer | – | – |
| userNamesKept | integer | – | – |
No examples provided.
bucket_minidumps Group crash dumps ~257
Group a folder of minidumps by crash signature (exception code, faulting function, top frames), by name so rebases do not split a bucket. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| budgetSeconds | integer | – | Seconds parsing new dumps (1-3000). |
| folder | string | yes | Folder of .dmp or core files. |
| imageDirectories | string | – | Program binary folders, ;-separated. |
| limit | integer | – | Max rows. |
| managed | string | – | auto: managed signatures through a local DAC; off: native only. |
| maxDumps | integer | – | Most dumps bucketed, newest first. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| pattern | string | – | File patterns, ;-separated (default *.dmp;*.mdmp;*.core;core.*). |
| recursive | boolean | – | Search subfolders. |
| skipModules | string | – | More frames to skip, ;-separated: module or module!function, * wildcards. |
| splitByVersion | boolean | – | Add the faulting module version to the signature. |
| topFrames | integer | – | Signature frames after the faulting one. |
| Name | Type | Req | Description |
|---|---|---|---|
| dumps | object | – | – |
| failed | array | – | – |
| folder | string | – | – |
| items | array | – | – |
| notes | array | – | – |
No examples provided.
comment_native Comment a native address ~242
Comment a native address; undoable and pushed to the engines. append adds a line; empty clears. items: many in one push. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| append | boolean | – | Add text as a new line of the comment; a line it has is skipped. |
| dryRun | boolean | – | true previews; false applies. |
| engine | string | – | Engine to push to now (default: the one with this image open, else next use). |
| image | string | yes | Image id, name, path. |
| items | string | – | Lines address = text, or JSON [{address, text, scope?, append?}]. |
| repeatLine | boolean | – | With append: add the line even if the comment has it. |
| scope | string | – | line: repeatable, shown where referenced; auto (default): function at its start, else line and pseudocode. |
| stopOnError | boolean | – | Stop at the first failing item. |
| text | string | – | Comment text; empty clears. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
| items | array | – | – |
| pushedTo | array | – | – |
No examples provided.
compare_assemblies Compare two builds ~268
Compare two builds of an assembly: renamed, moved, changed, added and removed types and members, and capabilities added or removed. oldResult / newResult compare two kept results instead. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| changes | array | – | Kinds to list (unknown: unpaired for lack of evidence); default all but address. |
| includeCompilerGenerated | boolean | – | Also compiler-generated types and members (closures, state machines). |
| limit | integer | – | Changes per page. |
| maxTokens | integer | – | Page size in tokens. |
| namespace | string | – | Only types whose old or new full name starts with this. |
| newAssembly | string | – | New build: id, name or path. |
| newResult | string | – | The new side, from the same tool. |
| offset | integer | – | Rows to skip. |
| oldAssembly | string | – | Old build: id, name or path. |
| oldResult | string | – | Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...). |
| tokenMap | boolean | – | Keep the whole old-to-new token map as a result (tokenMapResultId). |
| typeCountsOnly | boolean | – | Count added and removed types, not listed. |
| Name | Type | Req | Description |
|---|---|---|---|
| ambiguousMembers | integer | – | – |
| changes | array | – | – |
| evidence | object | – | – |
| hiddenCompilerGenerated | integer | – | – |
| items | array | – | – |
| matchedTypes | integer | – | – |
| memberChanges | array | – | – |
| memberMatches | array | – | – |
| new | object | – | – |
| newSkippedBodies | integer | – | – |
| old | object | – | – |
| oldSkippedBodies | integer | – | – |
| oldTypes | integer | – | – |
| tokenMapEntries | integer | – | – |
| tokenMapResultId | string | – | – |
| typeChanges | array | – | – |
No examples provided.
compare_folders Compare two folders or packages ~216
Compare two folders, zip-family archives or files: modified, added, removed and moved entries, binary versions, text diffs and package findings. oldResult / newResult compare two kept results instead. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| caseSensitive | boolean | – | Default: false on Windows and macOS. |
| change | string | – | Entries listed. |
| exclude | array | – | Path globs to skip. |
| limit | integer | – | Entries per page. |
| maxEntries | integer | – | Per side; past it, incomplete. |
| newPath | string | – | New folder, archive or file. |
| newResult | string | – | The new side, from the same tool. |
| noDiffs | boolean | – | Leave out text diffs. |
| offset | integer | – | Rows to skip. |
| oldPath | string | – | Old folder, archive or file. |
| oldResult | string | – | Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...). |
| Name | Type | Req | Description |
|---|---|---|---|
| caseSensitive | boolean | – | – |
| changes | array | – | – |
| counts | object | – | – |
| entries | array | – | – |
| evidence | object | – | – |
| hashBasis | string | – | – |
| new | object | – | – |
| notes | array | – | – |
| old | object | – | – |
| view | string | – | – |
No examples provided.
compare_native_images Compare native builds ~266
Match functions of two native builds (x86, x64, ARM64): pairs, changed, unmatched, ambiguous, capabilities. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| codeOnly | boolean | – | Match by code, not names. |
| engine | string | – | ida or ghidra: compare oldImage's file with that engine's memory. |
| limit | integer | – | Max rows. |
| maxComparisons | integer | – | Fuzzy comparison cap, 1-1e9. |
| maxTokens | integer | – | Page size in tokens. |
| minScore | number | – | Least fuzzy score (0-1). |
| newImage | string | – | New build: image id or path. |
| newResult | string | – | The new side, from the same tool. |
| offset | integer | – | Rows to skip. |
| oldImage | string | – | Old build: image id or path. |
| oldResult | string | – | Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...). |
| tier | integer | – | Only tier 1 (name, bytes) .. 5 (fuzzy); 0 all. |
| view | string | – | changed: code differs; ambiguous: candidates; wasm: interface. |
| Name | Type | Req | Description |
|---|---|---|---|
| ambiguous | integer | – | – |
| changed | integer | – | – |
| changes | array | – | – |
| evidence | object | – | – |
| identical | integer | – | – |
| items | array | – | – |
| matched | integer | – | – |
| newFunctions | integer | – | – |
| newImage | string | – | – |
| newVersion | string | – | – |
| notes | array | – | – |
| oldFunctions | integer | – | – |
| oldImage | string | – | – |
| oldVersion | string | – | – |
| tiers | array | – | – |
| unmatchedNew | integer | – | – |
| unmatchedOld | integer | – | – |
| view | string | – | – |
No examples provided.
convert_number Convert a number ~115
Convert numbers exactly: signed and unsigned decimal, hex, binary, octal, LE and BE bytes with their ASCII, and the bits as float or double.
| Name | Type | Req | Description |
|---|---|---|---|
| numbers | array | yes | Decimal, 0x or h-suffixed hex, 0b, 0o, C suffixes, 'ABCD' (C char constant) or "text" (memory order). |
| size | integer | – | Width in bytes: 1, 2, 4 or 8 (default: smallest that fits). |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
No examples provided.
declare_native_types Declare C types in the engine ~241
Declare C types in the engine, replacing same-named ones; an engine error saves nothing. typeName edits one enum, struct or union; delete and rename take any named type. Kept in annotations. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| declarations | string | – | C declarations; named types must exist or be declared too. |
| delete | string | – | A type to delete. |
| engine | string | – | Default auto. |
| fields | string | – | Struct or union: name: type; name@0x10: type; @0x10: type (or lines); name: removes; +name@0x10: type inserts. |
| image | string | yes | Image id, name, path. |
| members | string | – | Enum: NAME=value, ... (hex or decimal; or lines); NAME= removes. |
| nameGaps | boolean | – | Struct: name unnamed gaps gap_OFFSET. |
| rename | string | – | Old=New; kept edits naming it follow. |
| resize | string | – | Struct: new size (hex or decimal); goes alone. |
| typeName | string | – | Enum, struct or union to edit. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
No examples provided.
decompile_java Decompile Java ~258
Java source of a class or method via JADX (CORVUS_JAVA_DECOMPILER, JDK 17+), or a jar or .class via Vineflower (engine=vineflower, CORVUS_JAVA_DECOMPILER2). simplified=true replaces each decoder call with a known value by its string literal. Without either: disassemble_dex. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | jadx (default) or vineflower (class files only). |
| javaOnly | boolean | – | Partial Java where JADX fails; default: smali there. |
| mapping | string | – | R8/ProGuard mapping.txt: shows and accepts original names; kept per package. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Character offset (nextOffset). |
| path | string | yes | An .apk, .aab or split set, a .dex, a jar or a .class. |
| simplified | boolean | – | Show string decoder calls as their decoded literals; a header counts unknown calls. |
| symbol | string | yes | Class (pkg.C, Lpkg/C;) or method (Lpkg/C;->m(I)V, pkg.C::m, pkg.C::m(int)). |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| totalChars | integer | – | – |
No examples provided.
decompile_member Decompile to C# ~165
Decompile a member or a whole type to C#; every overload unless a parameter list picks one. Code the decompiler fails on shows as IL.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Assembly id, name, path; omit: all. |
| kind | string | – | Restrict to this kind (default any). |
| maxTokens | integer | – | Page size in tokens. |
| member | string | yes | Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token. |
| offset | integer | – | Character offset (nextOffset). |
| provenance | boolean | – | Start with build-pinning comments: SHA-256, MVID, tokens, IL hashes. |
| simplified | boolean | – | Show the code as simplify_methods would leave it, assembly unchanged. |
| Name | Type | Req | Description |
|---|---|---|---|
| bodies | array | – | – |
| code | string | – | – |
| language | string | – | – |
| methods | array | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| symbols | array | – | – |
| totalChars | integer | – | – |
No examples provided.
decompile_native Decompile native function ~319
C pseudocode of a native function from IDA or Ghidra, with the names, comments and types made here; address= on x64 adds the method behind slot-indexed virtual calls. The first call analyzes the image; functions= decompiles several per request. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| addresses | boolean | – | Prefix lines with their source address. |
| callersOf | string | – | Instead of address: decompile this function's callers (engine references). |
| engine | string | – | Default auto; all: each installed engine in turn. |
| functions | array | – | Instead of address: several addresses or names. |
| image | string | yes | Image id, name, path. |
| maxFunctions | integer | – | With functions: most decompiled (1-200); the rest follow. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Character offset; with functions/callersOf the first input (nextInput). |
| perFunctionSeconds | integer | – | With functions: seconds per function (1-600). |
| refs | boolean | – | With address: a footer of the globals, functions, strings and imports used. |
| timeoutSeconds | integer | – | Seconds per engine request (1-600); Ghidra retries once with 4x. |
| view | string | – | c, or pcode (Ghidra high p-code per block). |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| engine | string | – | – |
| engineNote | string | – | – |
| failed | integer | – | – |
| image | string | – | – |
| inputs | integer | – | – |
| items | array | – | – |
| nextInput | integer | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| skipped | integer | – | – |
| succeeded | integer | – | – |
| totalChars | integer | – | – |
No examples provided.
define_native Redefine code or data in the engine ~194
Redefine an address in the engine as code, a function, data or undefined, up to end or along the flow. data and undefine drop a global's user type. Kept in annotations. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| end | string | – | Exclusive end address (same forms as address). |
| engine | string | – | Default auto. |
| image | string | yes | Image id, name, path. |
| kind | string | yes | function with end moves a function end; flow (Ghidra): type branch, call, call_return or return, else clears. |
| type | string | – | kind=data: byte, word, dword, qword, float, double, string, string16 (UTF-16), a C type; dword[8] arrays. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
No examples provided.
diff_edits Diff edits (before/after C#) ~80
Unified diff of the decompiled C# of each member the edits (or one) touched.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| maxTokens | integer | – | Page size in tokens. |
| number | integer | – | Only this edit (list_edits number). |
| offset | integer | – | Character offset (nextOffset). |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| totalChars | integer | – | – |
No examples provided.
diff_function Diff a function between builds ~282
Diff one function between two builds: aligned instruction rows, or a unified pseudocode diff with view=pseudocode. oldResult / newResult diff kept code. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | In the function: Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| addresses | array | – | Instead of address: up to 20 functions, one summary each. |
| codeOnly | boolean | – | Match by code, not names. |
| context | integer | – | Unchanged rows around each change (0-50). |
| engine | string | – | view=pseudocode: the engine. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| newImage | string | – | New build: image id or path. |
| newResult | string | – | Same tool; or one result plus the other image and address. |
| offset | integer | – | Rows to skip. |
| oldImage | string | – | Old build: image id or path. |
| oldResult | string | – | Instead: old code as a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...). |
| side | string | – | Which build the address is in. |
| view | string | – | pseudocode needs an engine. |
| Name | Type | Req | Description |
|---|---|---|---|
| added | integer | – | – |
| basis | string | – | – |
| candidates | array | – | – |
| changed | integer | – | – |
| evidence | object | – | – |
| functions | array | – | – |
| items | array | – | – |
| newAddress | string | – | – |
| newFunction | string | – | – |
| newImage | string | – | – |
| notes | array | – | – |
| oldAddress | string | – | – |
| oldFunction | string | – | – |
| oldImage | string | – | – |
| removed | integer | – | – |
| same | integer | – | – |
| score | number | – | – |
| summary | string | – | – |
| tier | integer | – | – |
| view | string | – | – |
No examples provided.
disassemble Disassemble native code ~200
MASM disassembly of the function at an address, with references named and call arguments recovered; outside a function, maxInstructions from the address. Names the method behind slot-indexed virtual calls on x64 and AArch64 images. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| collapse | string | – | runtime: fold lazy-init, write-barrier and static-base code to one comment line. Default none. |
| engine | string | – | auto (default): IDA or Ghidra if analyzed, else ours. |
| fromAddress | boolean | – | maxInstructions from the address, not the containing function. |
| image | string | yes | Image id, name, path. |
| maxInstructions | integer | – | Max instructions. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Character offset (nextOffset). |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| code | string | – | – |
| engine | string | – | – |
| function | string | – | – |
| image | string | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| totalChars | integer | – | – |
No examples provided.
disassemble_dex Disassemble DEX ~169
Smali of a DEX method or class; format=annotated adds code offsets, simplified the string each decoder call returns. A jar or .class: the javap -c -p listing.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output layout; default smali. |
| mapping | string | – | R8/ProGuard mapping.txt: shows and accepts original names; kept per package. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Character offset (nextOffset). |
| path | string | yes | An Android package, .dex, jar or .class. |
| symbol | string | yes | Method (Lpkg/C;->m(I)V, pkg.C::m, pkg.C::m(int)) or class (pkg.C, Lpkg/C;). |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| totalChars | integer | – | – |
No examples provided.
dump_heap .NET heap of a dump or session ~180
List the .NET GC heap of a dump or session: per-type counts and sizes, or matching objects (first 100000 paged). Needs heap memory in the dump, else heap_not_captured. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| dump | string | yes | A .dmp path, open_minidump's id or a session id (live-1): its program, read while it runs. |
| limit | integer | – | Max rows. |
| maxObjects | integer | – | Max objects walked. |
| maxTokens | integer | – | Page size in tokens. |
| minSize | integer | – | Min object size in bytes. |
| mode | string | – | stats (per type) or objects (one row each). |
| offset | integer | – | Rows to skip. |
| type | string | – | Type full name, * ? wildcards; default all. |
| Name | Type | Req | Description |
|---|---|---|---|
| dump | string | – | – |
| items | array | – | – |
| matchedBytes | integer | – | – |
| mode | string | – | – |
| notes | array | – | – |
| type | string | – | – |
| walked | integer | – | – |
No examples provided.
dump_object .NET object of a dump or session ~123
Read one .NET object of a dump or session: type, size, fields, a string's or boxed value, or array elements.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Hex address of the object. |
| depth | integer | – | Reference levels expanded (up to 3). |
| dump | string | yes | A .dmp path, open_minidump's id or a session id (live-1): its program, read while it runs. |
| maxArrayItems | integer | – | Max array elements. |
| maxFields | integer | – | Max fields, nested included. |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| assembly | string | – | – |
| buildCheck | string | – | – |
| dump | string | – | – |
| fields | array | – | – |
| length | integer | – | – |
| notes | array | – | – |
| size | integer | – | – |
| token | string | – | – |
| truncated | boolean | – | – |
| type | string | – | – |
| value | string | – | – |
No examples provided.
dump_stack Crash dump stack ~206
Walk the call stack of a dump thread, naming frames from loaded images, PDBs or exports. .NET frames add token, IL offset and C# statement.
| Name | Type | Req | Description |
|---|---|---|---|
| dump | string | yes | A .dmp path or open_minidump's id. |
| dumpTimeContext | boolean | – | Faulting thread: its context at dump time, not the exception's (.ecxr). |
| imageDirectories | string | – | Program binary folders (';'-separated), kept for the dump, plus its own. |
| limit | integer | – | Max rows. |
| managed | string | – | auto: .NET frames via the DAC; off: native only. |
| maxFrames | integer | – | Max frames walked (up to 1024). |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| thread | string | – | Thread id, '#index', name or 'exception' (default: faulting, else first). |
| Name | Type | Req | Description |
|---|---|---|---|
| architecture | string | – | – |
| context | string | – | – |
| dump | string | – | – |
| items | array | – | – |
| managed | string | – | – |
| notes | array | – | – |
| registers | string | – | – |
| scannedFrames | integer | – | – |
| stop | string | – | – |
| threadId | integer | – | – |
| threadName | string | – | – |
No examples provided.
emulate_native Emulate native code ~387
Emulate native code from an address: return value, registers and written strings. resume= continues a run a budget stopped, saved best-effort under the data folder. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| args | string | – | Per calling convention: integer, address or pointer to 'text', u'text', buf:N (zeros) or hex:41A0. |
| candidates | string | – | Argument sets, ;-separated, each as args; one timeoutSeconds covers all. |
| engine | string | – | auto: Ghidra, else ours; ours: x86/x64/ARM64 integer code; speakeasy: a whole program. |
| image | string | yes | Image id, name, path. |
| maxInstructions | integer | – | Instruction budget (1-50000000). |
| memory | string | – | ADDR=VALUE: 'text', u'text', hex:.., zero:N, u32:5, ptr:..; outside the image va:0x10000000. |
| read | string | – | Shown after the run: ADDR or register, space or :, length (rcx 64). |
| registers | string | – | rcx=0x10, rdx='key' (values as args). |
| resume | string | – | Run id from Next, also after a restart; address is ignored. |
| stopAt | string | – | Addresses to stop at. |
| stubs | string | – | Calls not run: name=value (GetTickCount=5, kernel32!Sleep=0; *=0 calls outside the image). |
| timeoutSeconds | integer | – | Time budget, s (1-300). |
| trace | integer | – | Last instructions listed (0-2000). |
| Name | Type | Req | Description |
|---|---|---|---|
| apiCalls | array | – | – |
| callCount | integer | – | – |
| calls | array | – | – |
| candidates | array | – | – |
| engine | string | – | – |
| filesWritten | array | – | – |
| image | string | – | – |
| instructions | integer | – | – |
| nullPageWrites | object | – | – |
| reads | array | – | – |
| regionSet | string | – | – |
| registers | array | – | – |
| returnRegister | string | – | – |
| returnValue | string | – | – |
| stop | string | – | – |
| stoppedAt | string | – | – |
| trace | array | – | – |
| written | array | – | – |
No examples provided.
export_edits Export edits as a script ~71
Save an assembly's edits as a JSON script bound to its build (SHA-256, MVID) for apply_edits.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| outputPath | string | yes | Output .json path. |
| overwrite | boolean | – | Overwrite outputPath. |
| Name | Type | Req | Description |
|---|---|---|---|
| edits | integer | – | – |
| identity | string | – | – |
| mvid | string | – | – |
| outputPath | string | – | – |
| sha256 | string | – | – |
No examples provided.
export_engine_database Export the engine database ~130
Write the engine database of a native image, with the names, comments and types made here, to open in IDA (.i64) or Ghidra (.gzf); written whole or not at all. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | Default: the engine of the extension, else IDA. |
| image | string | yes | Image id, name, path. |
| outputPath | string | yes | The .i64 (IDA), .gzf, or Ghidra types alone as .h or .gdt. |
| overwrite | boolean | – | Overwrite outputPath. |
| Name | Type | Req | Description |
|---|---|---|---|
| bytes | integer | – | – |
| engine | string | – | – |
| image | string | – | – |
| note | string | – | – |
| path | string | – | – |
No examples provided.
export_method_symbols Export IDA/Ghidra scripts ~122
Export dummy-assembly metadata as IDA Python and Ghidra scripts that create, name and comment every function, a C header of struct layouts and a script.json. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Assembly id, name, path; omit: all. |
| baseName | string | – | Base name of the generated files. |
| formats | string | – | Comma-separated: ida, ghidra, header, json or all. |
| outputDirectory | string | yes | Output directory. |
| overwrite | boolean | – | Replace same-named files. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | – |
| functions | integer | – | – |
| structs | integer | – | – |
No examples provided.
export_native_annotations Export native annotations ~98
Write the image's names, comments and user types as IDAPython, a Ghidra script, JSON or a C header. objc-header writes the Objective-C and Swift declarations of a Mach-O. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Default json. |
| image | string | yes | Image id, name, path. |
| outputPath | string | yes | Output file path. |
| overwrite | boolean | – | Overwrite outputPath. |
| Name | Type | Req | Description |
|---|---|---|---|
| bytes | integer | – | – |
| comments | integer | – | – |
| format | string | – | – |
| imported | integer | – | – |
| names | integer | – | – |
| outputPath | string | – | – |
| pseudoComments | integer | – | – |
| sha256 | string | – | – |
| types | integer | – | – |
No examples provided.
export_native_patches Export native patches ~102
Write the image's byte patches as an IDAPython script, an IDA .dif, IPS or a JSON set for migrate_native_patches. Relocation edits and the PE checksum are included.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Default json; ips takes offsets below 16 MB. |
| image | string | yes | Image id, name, path. |
| outputPath | string | yes | Output file path. |
| overwrite | boolean | – | Overwrite outputPath. |
| Name | Type | Req | Description |
|---|---|---|---|
| bytes | integer | – | – |
| changedBytes | integer | – | – |
| checksumUpdated | boolean | – | – |
| format | string | – | – |
| image | string | – | – |
| notes | array | – | – |
| originalSha256 | string | – | – |
| outputPath | string | – | – |
| patches | integer | – | – |
| records | integer | – | – |
| relocationEdits | integer | – | – |
No examples provided.
export_project Export C# project ~91
Decompile an assembly into a C# project on disk; an .apk or .aab gives a Gradle project. Written whole or not at all; a repeat joins a running export. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| outputDirectory | string | yes | Empty or new output directory. |
| overwrite | boolean | – | Replace a previous export in outputDirectory. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| failedTypes | array | – | – |
| files | integer | – | – |
| outputDirectory | string | – | – |
| projectFile | string | – | – |
| renamedFiles | array | – | – |
| replaced | boolean | – | – |
| source | string | – | – |
No examples provided.
extract_embedded Extract embedded content ~202
Embedded content of an assembly, container or native PE (resources, byte arrays, literals, inner PEs), decoded (hex, base64, compression, XOR) to an image, archive or text with its encoding chain; save=true writes them.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | A loaded assembly; this or path. |
| includeMedia | boolean | – | Also list and save images (else counted). |
| limit | integer | – | Max rows. |
| load | boolean | – | Load .NET assemblies found (implies save). |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| outputDirectory | string | – | Empty directory or an earlier extraction; default: temp. |
| path | string | – | An assembly or container file, read without loading. |
| save | boolean | – | Write the items to disk. |
| xorText | boolean | – | Also try 1-16 byte XOR keys (slower). |
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | – |
| items | array | – | – |
| outputDirectory | string | – | – |
No examples provided.
How do I install the Corvus MCP server?
Corvus runs locally as a NuGet package, launched with dnx CorvusRE@2.11.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · CorvusRE
claude mcp add albasha0x0-corvus -- dnx CorvusRE@2.11.0 --yes
What is the Corvus MCP server?
Corvus is an MCP server listed in the public MCP registry as io.github.Albasha0x0/corvus. Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch. This page covers its NuGet package (CorvusRE).
Is the Corvus MCP server safe to use?
Corvus scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Corvus MCP server expose?
Corvus exposes 165 tools: get_engine_status, export_edits, list_types, resolve_call_targets, search_constants, and 160 more. Their descriptions and schemas cost roughly 27,723 tokens of context every time the server is loaded.
Is the Corvus MCP server still maintained?
Corvus is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Corvus MCP server under?
Corvus declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.