Reads Android manifests, resources, DEX, and Java, with JADX for Java analysis and adb for connected devices.
Analyzes .NET assemblies, exposing C#, IL, references, call graphs, and patches; also inspects .NET heap data in crash dumps.
Inspects npm packages before installation for security analysis.
Inspects PyPI packages before installation for security analysis.
Inspects RubyGems packages before installation for security analysis.
Reads WebAssembly modules and components, including disassembly for analysis.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
MCP server for reverse engineering and security analysis of compiled programs: .NET assemblies and native PE, ELF and Mach-O binaries.
One self-contained binary. Nothing is uploaded; nothing it reads is executed by default.
Tools and output can change between releases; see the release notes.
Windows (PowerShell):
irm https://github.com/Albasha0x0/Corvus/releases/latest/download/install.ps1 | iexLinux and macOS:
curl -fsSL https://github.com/Albasha0x0/Corvus/releases/latest/download/install.sh | shThe installer verifies the download and registers Corvus with the MCP clients it finds. Restart the client and ask:
Load app.dll with Corvus and explain how it builds its export file. Cite the methods you read.
Plugin, container image and other clients: installation.
From a terminal: corvus decompile_member --load app.dll member=Ns.Type::Method (command line).
Builds: win-x64, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64.
Related MCP server: REA
The agent calls Corvus over MCP; every result is bounded, every list pages, every error names the next step.
Corvus's own engine reads native code (x86, x64, ARM32, ARM64); IDA or Ghidra, when installed, add pseudocode.
Edits happen in memory; the agent reviews the diff and saves a patched copy.
Input | Shows | Needs |
.NET assemblies | C#, IL, references, call graphs, patches | nothing |
Native PE, ELF, Mach-O | functions, disassembly, cross-references, types, patches | nothing |
Native pseudocode | decompiled functions, engine types, scripts | IDA 9 or Ghidra 12 |
NativeAOT, ReadyToRun, Il2Cpp | method names and addresses, strings | nothing |
WebAssembly | modules, components, disassembly | nothing |
Containers | single-file bundles, APK, IPA, installers, disk images, firmware | nothing |
Documents and scripts | Office macros, PDF actions, deobfuscated scripts | nothing |
Packages before install | npm, PyPI, RubyGems and extension packages | nothing |
Network captures | pcap streams, HTTP objects, TLS with a key log | nothing |
Android | manifest, resources, DEX, Java | JADX for Java, adb for devices |
Crash dumps | minidumps, core dumps, stacks, .NET heap | nothing |
Running programs | stop points, call recording, code coverage | Frida 17.24.3 to 17.24.x and 17.25.1 to 17.25.x; off by default |
All 165 tools and 15 prompts: features, tool reference.
Guides: first session · decode and patch · new build.
Installation · Configuration · Features · Tool reference · Command line · Errors · Troubleshooting · FAQ · Release notes · All pages
Analyze only software you own or may analyze. Licenses and local law can restrict decompiling, patching and redistribution.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Evidence-oriented REA + Ghidra static-analysis workflows, read-only PE32 and Delphi VMT tools.
Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
