Corvus
NUGET · CORVUSRE
Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.
Available components
Last scanned (12 hours ago)
Scores higher than 56% of NuGet servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security88
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Install-script risk not yet assessed.Unverified
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Build provenance not yet verified. View diagnostics → Unverified
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 28245 tokens (~170/item across 166 items; 165 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability check failed: the tool surface changed between 2.3.0 and 2.11.0: 4 tool removals, 0 breaking changes, 13 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 167 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 81% → 100% ▲ functional
- Package version: 2.10.0 → 2.11.0 functional
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 61 to 64.
- 3 Nov 26 +1
- Package version: 2.7.3 → 2.10.0 functional
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 51.
- 29 Oct 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 2.7.2 → 2.7.3 functional
- 28 Oct 26 +15
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 2.7.0 → 2.7.2 functional
- Package version: 2.7.0 → 2.7.1 functional
- 27 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.37 → fail ▼ security
- Schema quality: 182 → 163 ▲ functional
- Package version: 2.6.0 → 2.7.0 functional
- 25 Oct 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.30 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Licence: MIT → Apache-2.0 functional
- Package version: 2.5.1 → 2.6.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed nuget/CorvusRE@2.11.0
Provenance Inconclusive
We could not complete the check, so nothing is claimed either way. This is a gap on our side, not a finding about the package.
| Result | Inconclusive |
|---|---|
| Ecosystem | nuget |
| Reason | Package not fetched |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ghidra_script Run a Ghidra script on a native image ~249
Run a Java or Python Ghidra script on the image in one transaction: saved on return, rolled back on an exception. Off unless --ghidra-scripting (CORVUS_GHIDRA_SCRIPTING=1); runs with server rights. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| allowError | boolean | – | Return the exception as the result. |
| args | array | – | With name: script arguments (getScriptArgs). |
| background | boolean | – | Return at once; a notice reports the end. |
| code | string | – | Java (a GhidraScript class, or a run() body with imports first) or Python source. |
| engine | string | – | Default auto. |
| image | string | yes | Image id, name, path. |
| language | string | – | java (default) or python (needs CORVUS_GHIDRA_PYTHON); name *.py is Python. |
| maxTokens | integer | – | Page size in tokens. |
| name | string | – | Instead of code: a script in the Ghidra script folders or DATA/ghidra_scripts. |
| timeoutSeconds | integer | – | Seconds before it is cancelled; default 120. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| error | string | – | – |
| image | string | – | – |
| result | string | – | – |
| saved | boolean | – | – |
| stderr | string | – | – |
| stdout | string | – | – |
No examples provided.
ida_python Run IDAPython on a native image ~199
Run IDAPython on the image database; returns the last expression's value, stdout and stderr. Off unless --ida-scripting (CORVUS_IDA_SCRIPTING=1); runs with server rights, not undoable. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| allowError | boolean | – | Return the exception as the result. |
| background | boolean | – | Return at once; a notice reports the end. |
| code | string | – | Python source (or scriptPath); base is the image base. |
| engine | string | – | Default auto. |
| image | string | yes | Image id, name, path. |
| maxTokens | integer | – | Page size in tokens. |
| persist | boolean | – | Save the database afterwards. |
| reset | boolean | – | Clear globals kept from earlier calls. |
| scriptPath | string | – | A .py file to run instead of code. |
| timeoutSeconds | integer | – | Seconds before it is cancelled; default 120. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| error | string | – | – |
| image | string | – | – |
| result | string | – | – |
| saved | boolean | – | – |
| stderr | string | – | – |
| stdout | string | – | – |
No examples provided.
inspect_instruction Inspect native instructions ~144
Instruction details at a native address: encoding, operands, registers and flags read and written, memory accesses, stack change, flow and references. Walks up to 64 positions. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| engine | string | – | auto (default): IDA or Ghidra if analyzed, else ours. |
| image | string | yes | Image id, name, path. |
| limit | integer | – | Positions (1-64). |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| engineNote | string | – | – |
| image | string | – | – |
| items | array | – | – |
| notes | array | – | – |
No examples provided.
inspect_process Inspect a running process (read-only) ~278
Inspect a running Windows process read-only: summary, modules, regions, threads, stacks or windows (needs --allow-window-capture), with addresses named as in dumps. Nothing is written or suspended.
| Name | Type | Req | Description |
|---|---|---|---|
| imageDirectories | string | – | Program binary folders (';'-separated), for modules whose file is unreadable. |
| imagePath | string | – | windows: PNG of the first window. |
| limit | integer | – | Max rows. |
| maxFrames | integer | – | view=stacks: max frames walked (up to 256). |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| process | string | yes | Process id (decimal or 0x hex), name (notepad[.exe]; a shared name is refused with the ids) or session id (live-1). |
| regionFilter | string | – | view=regions filter; default committed. |
| thread | string | – | threads: only this one; stacks: the thread walked (default first). Id or name. |
| timeoutSeconds | integer | – | Time limit in seconds (up to 120). |
| view | string | – | summary, modules, regions, threads, stacks or windows. |
| yara | string | – | unbacked: YARA rules (text, file, folder, pack:name). |
| Name | Type | Req | Description |
|---|---|---|---|
| access | array | – | – |
| architecture | string | – | – |
| counts | object | – | – |
| detached | boolean | – | – |
| handlesClosed | integer | – | – |
| handlesOpened | integer | – | – |
| items | array | – | – |
| largestRegions | array | – | – |
| mainModule | object | – | – |
| name | string | – | – |
| notes | array | – | – |
| path | string | – | – |
| processId | integer | – | – |
| runtime | string | – | – |
| stackStop | string | – | – |
| startTimeUtc | string | – | – |
| stillRunning | boolean | – | – |
| thread | object | – | – |
| view | string | – | – |
| wow64 | boolean | – | – |
No examples provided.
install_android_package Install package on device ~122
Install an APK, split set or folder of APKs on a device; failures report their INSTALL_FAILED_ code. Changes the device: needs --allow-device-changes. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| downgrade | boolean | – | Allow a lower version code. |
| grantPermissions | boolean | – | Grant all requested runtime permissions. |
| keepInstalled | boolean | – | Fail if the app is installed instead of replacing it. |
| path | string | yes | An .apk, split set or folder of APKs. |
| serial | string | – | Device serial; omit if one device. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
| items | array | – | – |
| pushedTo | array | – | – |
No examples provided.
list_android_devices List Android devices ~37
Android devices and emulators: serial, state, model. adb: CORVUS_ADB, else PATH, else SDK platform-tools.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| unparsed | array | – | – |
No examples provided.
list_android_packages List installed packages ~105
Packages installed on a device (pm list packages -f -U -i): name, APK path, uid and installer.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Most packages. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| query | string | – | Only package names containing this. |
| serial | string | – | Device serial; omit if one device. |
| user | integer | – | Android user id (default: current). |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| serial | string | – | – |
No examples provided.
list_android_resources List Android resources ~148
Compiled resources of an Android package (resources.arsc or resources.pb): one row per resource and configuration, values cut at 200 characters.
| Name | Type | Req | Description |
|---|---|---|---|
| config | string | – | Only this configuration (pt-rBR, or default). |
| limit | integer | – | Most rows. |
| maxTokens | integer | – | Page size in tokens. |
| name | string | – | Only names matching this (* and ? wildcards). |
| offset | integer | – | Rows to skip. |
| path | string | yes | An .apk, .aab or split set (.apks, .xapk, .apkm). |
| type | string | – | Only this type (string, layout, xml...). |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| types | object | – | – |
No examples provided.
list_assemblies List loaded assemblies ~128
Loaded assemblies and native images: ids, versions, flags, unsaved edits, index state. With path: the assemblies or files inside a container, without extracting.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Id, name or path substring (case-insensitive). |
| limit | integer | – | Rows per page. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| path | string | – | Container file, Blazor or ClickOnce folder to list. |
| waitSeconds | integer | – | Seconds (0-600) to wait for indexes. |
| Name | Type | Req | Description |
|---|---|---|---|
| backgroundIndexing | string | – | – |
| container | object | – | – |
| items | array | – | – |
| searchDirectories | array | – | – |
No examples provided.
list_cpp_classes C++ classes from RTTI ~157
C++ classes from RTTI with bases and vftables; also Delphi / Free Pascal VMT classes and Mach-O ObjC and Swift types. engine=ida or ghidra lists that engine's classes.
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | Class source (default auto: RTTI). |
| filter | string | – | Name substring, any case. |
| image | string | yes | Image id, name, path. |
| limit | integer | – | Max classes. |
| maxTokens | integer | – | Page size in tokens. |
| namespaces | boolean | – | engine=ghidra: plain namespaces and libraries too. |
| offset | integer | – | Rows to skip. |
| slots | boolean | – | Slot addresses (Pascal: methods, fields). |
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | – | – |
| items | array | – | – |
| notes | array | – | – |
| source | string | – | – |
No examples provided.
list_dex_classes List DEX classes ~147
Classes defined in the DEX code of an Android package: descriptor, DEX file, access, superclass, member counts. Unfiltered: the largest packages.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Most classes. |
| mapping | string | – | R8/ProGuard mapping.txt: shows and accepts original names; kept per package. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| package | string | – | Only this package and its subpackages. |
| path | string | yes | An Android package, .dex or jar with classes*.dex. |
| query | string | – | Only classes whose name contains or matches (* ?) this. |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| notes | array | – | – |
| packages | array | – | – |
No examples provided.
list_edits List unsaved edits ~78
Unsaved edits of an assembly in order; numbers (editId <assembly>#<n>) stay when others are undone.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | – |
| items | array | – | – |
No examples provided.
list_exports List native exports ~94
Exported functions and data of a native image: ordinal, VA, demangled name, symbol version and forwarders.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Name substring (case-insensitive; demangled form too). |
| image | string | yes | Image id, name, path. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | – | – |
| items | array | – | – |
No examples provided.
list_functions List native functions ~253
Functions of a native image: address, size, name, flags, how found and caller count. An exact name filter adds the engine's function record. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| descending | boolean | – | Reverse the default direction of sort. |
| engine | string | – | auto (default): IDA or Ghidra if analyzed, else ours. |
| filter | string | – | Name filter: substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s). |
| from | string | – | Lowest start address. |
| hasType | boolean | – | Engines: true keeps functions with a prototype, false those without. |
| image | string | yes | Image id, name, path. |
| limit | integer | – | Max rows. |
| maxSize | integer | – | Largest size in bytes. |
| maxTokens | integer | – | Page size in tokens. |
| minSize | integer | – | Smallest size in bytes. |
| offset | integer | – | Rows to skip. |
| sort | string | – | Default address; size and callers: largest first. |
| to | string | – | Start addresses below this one. |
| view | string | – | candidates: engine code in no function, by references. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| engineNote | string | – | – |
| functions | integer | – | – |
| image | string | – | – |
| items | array | – | – |
No examples provided.
list_globals List native globals ~144
Named data of a native image outside code, from every name source, with type and size if known. An engine adds its defined data with values; get_native_type read=true reads fields. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | auto (default): IDA or Ghidra if analyzed, else ours. |
| filter | string | – | Name substring, any case. |
| image | string | yes | Image id, name, path. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| section | string | – | Only this section, e.g. .data. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| image | string | – | – |
| items | array | – | – |
No examples provided.
list_imports List native imports ~167
Imports of a native image per library, with the IAT slot code calls through; delay-loaded imports are marked. bind=true names the export each import binds to. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| bind | boolean | – | Bind each import to its export, or say why not (load_assembly loadProviders=true loads targets). |
| filter | string | – | Name substring, any case. |
| image | string | yes | Image id, name, path. |
| includeDynamic | boolean | – | Also GetProcAddress imports, marked [dynamic] (waits for the code index). |
| library | string | – | Only this library (.dll optional). |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| bindings | string | – | – |
| image | string | – | – |
| items | array | – | – |
No examples provided.
list_jni_bindings List JNI bindings ~163
Java native methods of an Android package paired with their code in lib/<abi>/*.so, by Java_ exports and RegisterNatives tables; also unbound methods and stray exports. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| abi | string | – | ABI to read, or all; default arm64-v8a, else the first. |
| class | string | – | Only rows naming this class (pkg.C or pkg/C). |
| kind | string | – | Only this kind. |
| limit | integer | – | Most rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| path | string | yes | An .apk, .aab or split set (.apks, .xapk, .apkm). |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| libraries | array | – | – |
| notes | array | – | – |
No examples provided.
list_namespaces List namespaces ~87
List namespaces with their type counts (nested types under the namespace of their outer type).
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Assembly id, name, path; omit: all. |
| filter | string | – | Substring (case-insensitive). |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
No examples provided.
list_native_edits List native edits ~122
Native edits of an image in order, each with its editId, then the name layers with counts. search lists matching names and comments instead. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | yes | Image id, name, path. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| search | string | – | Instead: matching names and comments: substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s). |
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | – | – |
| items | array | – | – |
| layers | array | – | – |
No examples provided.
list_native_types Browse the engine's types ~214
Named types of the engine database with size and member count; name= shows one as a C declaration with member offsets. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| descending | boolean | – | Reverse the order. |
| engine | string | – | Default auto. |
| filter | string | – | substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s). |
| image | string | yes | Image id, name, path. |
| kind | string | – | udt: struct or union. |
| limit | integer | – | Max rows (max 5000). |
| maxTokens | integer | – | Page size in tokens. |
| members | boolean | – | List the first 32 members of each (enums: name = value). |
| name | string | – | Show this one type in full instead of a list. |
| offset | integer | – | Rows to skip. |
| related | boolean | – | Add the types each refers to. |
| sort | string | – | Default name; ordinal: the engine's order. |
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | – |
| items | array | – | – |
No examples provided.
list_notes List notes ~164
Notes, newest first, filtered by status, kind, anchor, tag and text. A file anchor lists all its notes, an address its function's, a type its members' too.
| Name | Type | Req | Description |
|---|---|---|---|
| anchor | string | – | <image>@<address>, <assembly>:<symbol or token>, image or assembly id, dump:<id or path>, or empty (session-wide). |
| kind | string | – | Only this kind. |
| limit | integer | – | Notes per page. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| status | string | – | Default open; all for every status. |
| tag | string | – | Only notes with this tag. |
| text | string | – | Text substring (case-insensitive). |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| notes | array | – | – |
No examples provided.
list_resources List manifest resources ~88
Manifest resources (embedded, .resources, linked) with SHA-256 and file offsets; a native image lists its Win32 resources as TYPE/NAME/LANGUAGE with file ranges.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly id, name, path. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | – |
| items | array | – | – |
No examples provided.
list_types List types ~144
List types, optionally by namespace, name filter and kind.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | – | Assembly id, name, path; omit: all. |
| filter | string | – | Name substring or wildcard (*, ?), regex with regex=true, or /pattern/. |
| kind | string | – | Only this kind. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| namespace | string | – | Exact namespace ("" or <global> for the global one). |
| offset | integer | – | Rows to skip. |
| regex | boolean | – | filter is a regex. |
| topLevelOnly | boolean | – | Leave out nested types. |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | – | – |
| notEvaluated | integer | – | – |
No examples provided.
live_break Stop points in a session ~121
Set, list or clear stop points; continue resumes; wait returns the oldest held stop with its stack.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| at | string | – | set: name, module!export, address or file:line. |
| session | string | yes | Id from live_session. |
| stopPoint | string | – | clear: stop point id. |
| thread | string | – | continue: thread id; default all. |
| wait | boolean | – | Wait for a stop. |
| waitSeconds | integer | – | wait: seconds (1-300). |
| Name | Type | Req | Description |
|---|---|---|---|
| namedAddresses | array | – | – |
| session | string | – | – |
| stop | object | – | – |
| stopPoints | array | – | – |
No examples provided.
live_console Scripted console run ~189
Drive a program with a background script; status shows steps, transcript pages output.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| arguments | array | – | start: arguments. |
| cursor | string | – | transcript: cursor of a page; default the oldest line. |
| limit | integer | – | Max rows. |
| program | string | – | start: program path. |
| run | string | – | Run id (con-1; omitted: the only one). |
| script | array | – | start: steps, one per line: send TEXT, wait TEXT (output contains it), resize COLUMNS ROWS, delay MS; TEXT takes \r (Enter), \n, \t, \e, \xHH. |
| timeoutSeconds | integer | – | Seconds per wait step (1-300). |
| waitSeconds | integer | – | status: seconds to wait for the script, 0-300. |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| dropped | integer | – | – |
| items | array | – | – |
| run | object | – | – |
| runs | array | – | – |
| steps | array | – | – |
No examples provided.
live_coverage Code coverage of a session ~187
Collect code coverage in a session: which functions ran and how often; diff compares runs.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| format | string | – | report: text, or dot (call graph; offset counts characters). |
| hitLimit | integer | – | start: stops per function before it is cleared. |
| limit | integer | – | Max rows. |
| match | string | – | Names containing this; start: module!part for another module. |
| offset | integer | – | Rows to skip. |
| other | string | – | diff: second run. |
| outputPath | string | – | Save as JSON to a new file; an existing path is refused. |
| run | string | – | Run id (cov-1; omitted: the only run). |
| session | string | – | Session id; start only. |
| show | string | – | report: ran, missed or all. |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| diff | object | – | – |
| items | array | – | – |
| namedAddresses | array | – | – |
| run | object | – | – |
| runs | array | – | – |
| totalChars | integer | – | – |
No examples provided.
live_events Session events ~151
Page session events by cursor and filter; waitSeconds waits for the next.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Cursor of an earlier page; default oldest kept. |
| from | string | – | Only this watch or script id. |
| kind | string | – | Only this kind. |
| limit | integer | – | Max rows. |
| maxTokens | integer | – | Page size in tokens. |
| outputPath | string | – | Save as JSON to a new file; an existing path is refused. |
| session | string | yes | Id from live_session. |
| thread | string | – | Only this thread id. |
| waitSeconds | integer | – | Seconds to wait for an event, 1-300; 0 returns at once. |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| dropped | integer | – | – |
| items | array | – | – |
| namedAddresses | array | – | – |
| session | string | – | – |
No examples provided.
live_read Read a stopped thread ~161
Read a held thread's registers and program memory as typed values, named through the loaded images.
| Name | Type | Req | Description |
|---|---|---|---|
| length | integer | – | memory: untyped bytes, or a string's limit (max 4096). |
| memory | string | – | An address, register or name to read. |
| registers | string | – | Register names, comma-separated; default all. |
| rules | string | – | YARA rules (text, file, folder, pack:name) to scan writable memory. |
| session | string | yes | Id from live_session. |
| thread | string | – | Thread id; default the first held. |
| type | string | – | memory: int8..uint64, float, double, pointer, cstring, utf16; [n] for arrays. |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| memory | array | – | – |
| namedAddresses | array | – | – |
| nextOffset | integer | – | – |
| offset | integer | – | – |
| registers | array | – | – |
| session | string | – | – |
| thread | string | – | – |
| totalChars | integer | – | – |
No examples provided.
live_script User script in a session ~94
Load, list or unload a Frida script in a session; its messages are events (live_events from=SCRIPT). Needs --live-scripting.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| path | string | – | load: a .js file instead. |
| script | string | – | unload: script id. |
| session | string | yes | Id from live_session. |
| source | string | – | load: JavaScript source. |
| Name | Type | Req | Description |
|---|---|---|---|
| scripts | array | – | – |
| session | string | – | – |
No examples provided.
live_session Session on a program ~306
Open, list, inspect or close a session on a program; modules match to images; snapshot saves a dump; save_modules saves rebuilt modules.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| arguments | array | – | spawn: program arguments; page_diff: old, new result id. |
| base | string | – | save_modules: loaded or preferred. |
| childNames | array | – | Hold children by image name (* any). |
| device | string | – | adb serial for frida-server. |
| downloadDac | boolean | – | Download a missing DAC. |
| environment | array | – | spawn: NAME=value. |
| imports | string | – | save_modules: restore or keep. |
| layout | string | – | save_modules: file or mapped. |
| modules | string | – | save_modules: file name, 0x address, all, unlisted or code; coverage: start|take|stop. |
| outputPath | string | – | snapshot: dump file, save_modules: new or empty folder (both default temp); screenshot: PNG file. |
| overwrite | boolean | – | Overwrite outputPath. |
| program | string | – | attach: pid, name, inspector:PORT, cdp:PORT, jdwp:PORT, ttd:PATH; spawn: program path (suspended); processes: name filter; *_child: pid. |
| session | string | – | Id from live_session. |
| symbols | string | – | save_modules: none, local or download PDBs. |
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| backend | string | – | – |
| ipc | string | – | – |
| modules | array | – | – |
| processId | integer | – | – |
| processes | array | – | – |
| program | string | – | – |
| saved | object | – | – |
| session | string | – | – |
| sessions | array | – | – |
| snapshot | object | – | – |
| state | string | – | – |
No examples provided.
live_timeline Activity trace of a session ~190
Trace the files, registry keys, endpoints and child processes a program opens; report counts names, diff compares traces.
| Name | Type | Req | Description |
|---|---|---|---|
| a | string | – | diff: first timeline. |
| action | string | – | Action. |
| b | string | – | diff: second timeline. |
| category | string | – | Only file, registry, network or process. |
| cursor | string | – | list: cursor of an earlier page; default the oldest entry kept. |
| limit | integer | – | Max rows. |
| match | string | – | Names containing this. |
| offset | integer | – | Rows to skip. (report). |
| outputPath | string | – | Save as JSON to a new file; an existing path is refused. |
| run | string | – | Run id (tl-1; omitted: the only one); list without it or a filter lists runs. |
| session | string | – | Session id; start only. |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | – |
| diff | object | – | – |
| dropped | integer | – | – |
| items | array | – | – |
| names | array | – | – |
| run | object | – | – |
| runs | array | – | – |
No examples provided.
live_watch Record calls in a session ~114
Record each call of a function with arguments and result as events (live_events from=WATCH).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action. |
| arguments | integer | – | set: raw values without a prototype (0-16). |
| at | string | – | set: name, module!export or address. |
| rateLimit | integer | – | set: calls/s recorded (1-100000); the rest are counted. |
| session | string | yes | Id from live_session. |
| watch | string | – | clear: watch id. |
| Name | Type | Req | Description |
|---|---|---|---|
| namedAddresses | array | – | – |
| session | string | – | – |
| watches | array | – | – |
No examples provided.
load_assembly Load assembly ~437
Load a .NET assembly, a folder, or a native image (PE, ELF, Mach-O, wasm). An AOT build (global-metadata.dat v24-39) loads from its folder, global-metadata.dat or package as dummy assemblies with addresses and its binary. A repeat load is a no-op. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| arch | string | – | raw: x86, x64, arm, thumb, arm64; mips, ppc, riscv64, 6502 etc. via IDA or Ghidra. |
| base | string | – | raw: load address (default 0). |
| compilerSpec | string | – | Ghidra compiler spec (also the IDA compiler): windows, gcc, borlandcpp, borlanddelphi... |
| disableAnalyzers | array | – | Analyzers off at import (AF_FLIRT, "Decompiler Switch Analysis"). |
| entry | string | – | raw: entry address or file offset (default start). |
| format | string | – | auto, or raw (headerless code). |
| language | string | – | Ghidra language id: x86:LE:32:default... |
| loadProviders | boolean | – | Also load the DLLs the imports bind to (one level, at most 16). |
| path | string | yes | Absolute path: a file, a folder (native files skipped), an AOT build, package or memory dump, or a Ghidra .gzf / .gpr (copied). |
| processor | string | – | IDA processor (-p): metapc, arm, mipsl... |
| program | string | – | Program path in a .gpr, e.g. /app.exe (default: its only one). |
| recursive | boolean | – | Also load assemblies in subdirectories. |
| seeds | array | – | Starts before analysis: [function|code|label:]address[=name]. |
| slice | string | – | Mach-O slice or index (default arm64e, arm64, x86_64), or the APK ABI (default arm64-v8a). |
| Name | Type | Req | Description |
|---|---|---|---|
| discardedEdits | integer | – | – |
| entries | array | – | – |
| ids | array | – | – |
| skipped | integer | – | – |
No examples provided.
load_pdb Load native debug symbols ~236
Load PDB (GUID and age checked) or DWARF debug symbols for a native image: names, types, source lines. Searches path, the image folder, symbol paths and CORVUS_DEBUG_DIRS; local matches load automatically. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| allowMismatch | boolean | – | Use the path file even if GUID/age or build-id differs. |
| clear | boolean | – | Remove the PDB names and saved copy instead. |
| download | boolean | – | If nothing local matches: symbol server (PDB), debuginfod (ELF). |
| image | string | yes | Image id, name, path. |
| maxMegabytes | integer | – | Download size limit in MB (1-16384). |
| path | string | – | PDB or debug file, dSYM, or a folder or symbol store to look in first. |
| server | string | – | Default: _NT_SYMBOL_PATH servers, else Microsoft (PDB); CORVUS_DEBUGINFOD_URLS (DWARF). Others are refused. |
| timeoutSeconds | integer | – | Download time limit, seconds (5-3600). |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | boolean | – | – |
| changes | array | – | – |
| digest | string | – | – |
| dryRun | boolean | – | – |
| editIds | array | – | – |
| failed | integer | – | – |
No examples provided.
load_session Load a session ~164
Restore a save_session file: find each file (recorded path, relative path, else SHA-256 under searchRoots), reapply its work. A changed file is refused unless targetBuild=other. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Report only. |
| include | string | – | Comma list: edits, patches, annotations, notes, all (default). |
| limit | integer | – | Items to return (max 2000). |
| offset | integer | – | Rows to skip. |
| path | string | yes | The session file. |
| searchRoots | string | – | ;-separated folders searched recursively for moved files, by SHA-256. |
| targetBuild | string | – | Default same; other: native work needs the old build under searchRoots. |
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | – |
| items | array | – | – |
| notes | array | – | – |
| outcomes | array | – | – |
| path | string | – | – |
| targetBuild | string | – | – |
No examples provided.
make_code_pattern Make a code pattern ~248
Make a byte pattern for an address that survives a rebuild: displacements and relocated addresses as ??, unique in the executable sections. search_code_pattern finds it. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| addresses | array | – | Instead of address; up to 50. |
| anchor | string | – | auto: at the address, else at a referencing instruction; xrefs: one per reference; range: [address, end). |
| end | string | – | anchor=range: exclusive end, an address or +length. |
| engine | string | – | anchor=xrefs: ida or ghidra add engine references. |
| format | string | – | ida, x64dbg, mask (\x48\x00 x?), bitmask (0x48, 0x00 0b01) or yara (rule, compiled). |
| image | string | yes | Image id, name, path. |
| maxBytes | integer | – | Longest pattern in bytes (8-512). |
| maxPatterns | integer | – | anchor=xrefs: most signatures (1-32). |
| Name | Type | Req | Description |
|---|---|---|---|
| failed | integer | – | – |
| format | string | – | – |
| image | string | – | – |
| results | array | – | – |
No examples provided.
map_address_between_builds Map an address to a new build ~136
Map old-build addresses (functions, instructions, strings, referenced data) to the new build: new address, confidence and reason, or why not with candidates. [Long-running.]
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Old build: Hex VA/RVA (rva:/va:/off:), export, module!import, function. |
| addresses | array | – | Instead of address: up to 100. |
| codeOnly | boolean | – | Match by code, not names. |
| newImage | string | yes | New build: image id or path. |
| oldImage | string | yes | Old build: image id or path. |
| Name | Type | Req | Description |
|---|---|---|---|
| failed | integer | – | – |
| newImage | string | – | – |
| oldImage | string | – | – |
| results | array | – | – |
No examples provided.
map_java_dotnet Map Java and .NET ~140
Pairs across a Java / .NET bridge, both ways: .NET for Android wrappers ([Register], crc64 names) and Mono C# calls through AndroidJavaClass / AndroidJNI. A * / ? pattern lists pairs.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Most pairs. |
| maxTokens | integer | – | Page size in tokens. |
| offset | integer | – | Rows to skip. |
| path | string | – | Package whose assemblies to read; optional when they are loaded. |
| symbol | string | yes | Java class (Lpkg/C;, pkg.C) or method (Lpkg/C;->m(I)V), .NET symbol, or pattern. |
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | – |
| items | array | – | – |
| notes | array | – | – |
| query | string | – | – |
No examples provided.
How do I install the Corvus MCP server?
Corvus runs locally as a NuGet package, launched with dnx CorvusRE@2.11.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · CorvusRE
claude mcp add albasha0x0-corvus -- dnx CorvusRE@2.11.0 --yes
What is the Corvus MCP server?
Corvus is an MCP server listed in the public MCP registry as io.github.Albasha0x0/corvus. Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch. This page covers its NuGet package (CorvusRE).
Is the Corvus MCP server safe to use?
Corvus scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Corvus MCP server expose?
Corvus exposes 165 tools: get_engine_status, export_edits, list_types, resolve_call_targets, search_constants, and 160 more. Their descriptions and schemas cost roughly 27,723 tokens of context every time the server is loaded.
Is the Corvus MCP server still maintained?
Corvus is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Corvus MCP server under?
Corvus declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.