# Corvus

Lets an agent decompile and patch compiled programs, .NET or native, without executing them by default.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 8
- Author: Albasha0x0
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Albasha0x0/Corvus
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/corvus

## What it does

Corvus gives an agent read access to compiled code: .NET assemblies and native files in PE, ELF and Mach-O formats. It decompiles methods to C#, shows IL, follows call graphs, diffs two builds and applies patches that land in a saved copy. Whatever it opens is not executed by default, and nothing gets uploaded.

The installer script drops a single self-contained binary with 165 tools and 15 prompts. The plugin route needs the .NET 10 SDK. A built-in engine handles x86, x64, ARM32 and ARM64 code.

Native pseudocode is the catch: without IDA 9 or Ghidra 12 you only get disassembly and cross-references. Live process sessions rely on Frida 17.24.3 or a newer 17.x and are off by default. The project changes quickly, so tool parameters can shift between releases.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- trace how a .NET assembly builds its export file
- diff two builds of the same program
- unpack a single-file .NET app without running it
- vet an npm or PyPI package before installing it
- find where a native binary gets a crypto constant

## Example prompts
- With Corvus, open `app.dll` and walk me through the code that produces the export file, listing the methods you read
- Use Corvus to compare the old and new `app.dll` builds and show what changed in the logic
- Ask Corvus to inspect this npm package before I install it and flag install scripts or suspicious patterns

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md