Corvus — Claude Code MCP server: what it does, how to install
Lets an agent decompile and patch compiled programs, .NET or native, without executing them by default.
Open on GitHubWhat Corvus does
Corvus gives an agent read access to compiled code: .NET assemblies and native files in PE, ELF and Mach-O formats. It decompiles methods to C#, shows IL, follows call graphs, diffs two builds and applies patches that land in a saved copy. Whatever it opens is not executed by default, and nothing gets uploaded.
The installer script drops a single self-contained binary with 165 tools and 15 prompts. The plugin route needs the .NET 10 SDK. A built-in engine handles x86, x64, ARM32 and ARM64 code.
Native pseudocode is the catch: without IDA 9 or Ghidra 12 you only get disassembly and cross-references. Live process sessions rely on Frida 17.24.3 or a newer 17.x and are off by default. The project changes quickly, so tool parameters can shift between releases.
What it helps with
- trace how a .NET assembly builds its export file
- diff two builds of the same program
- unpack a single-file .NET app without running it
- vet an npm or PyPI package before installing it
- find where a native binary gets a crypto constant
Example prompts for the agent
- With Corvus, open
app.dlland walk me through the code that produces the export file, listing the methods you read - Use Corvus to compare the old and new
app.dllbuilds and show what changed in the logic - Ask Corvus to inspect this npm package before I install it and flag install scripts or suspicious patterns
How to install Corvus
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Corvus
How do I install Corvus in Claude Code?
Run /plugin install corvus --marketplace Albasha0x0/Corvus, then restart the client. The plugin needs the .NET 10 SDK.
What does Corvus do?
It is an MCP server for analysing compiled programs: .NET decompilation, disassembly of PE, ELF and Mach-O files, build comparison, and patching with a saved copy. By default it runs nothing it opens.
What is required for native pseudocode?
IDA 9 (idalib) or Ghidra 12 installed alongside. Without them you still get disassembly, control-flow graphs and cross-references, and .NET decompilation works on its own.
