mcilspy

Decompile, search, and analyze .NET assemblies with AI assistance.

An MCP server that gives Claude (or any MCP client) the power to reverse-engineer .NET binaries — find hardcoded secrets, understand obfuscated code, recover lost source, and explore assembly internals.

Quick Start (30 seconds)

# Install
pip install mcilspy

# Add to Claude Code
claude mcp add ilspy -- python -m mcilspy.server

# Or add to Claude Desktop's config.json

{
  "mcpServers": {
    "ilspy": {
      "command": "python",
      "args": ["-m", "mcilspy.server"]
    }
  }
}

That's it. Ask Claude to analyze any .dll or .exe:

"Decompile the LoginService class from this assembly and explain what it does"

What Can You Do?

Find Hardcoded Secrets

"Search for any URLs, API keys, or connection strings in MyApp.dll"

Discovers hardcoded credentials, endpoints, and configuration that shouldn't be in code.

Reverse Engineer Unknown Binaries

"List all the types in this DLL and identify the main entry points"

Understand the structure of any .NET assembly without source code.

Recover Lost Source Code

"Decompile the entire assembly to a project I can build"

Recreate compilable C# projects from binaries when source is unavailable.

Analyze Malware Behavior

"Find all network-related methods and show me what URLs this malware contacts"

Safe static analysis of suspicious .NET executables.

Understand Third-Party Libraries

"Show me how Newtonsoft.Json handles circular references"

Learn from decompiled implementations when documentation falls short.

Features at a Glance

7 tools work immediately (via dnfile) — no .NET SDK required. 9 more tools unlock with ilspycmd for full decompilation power.

Installation Options

Option 1: Just the MCP Server (metadata tools only)

pip install mcilspy

Gives you search and metadata tools immediately.

Option 2: Full Decompilation Power

# Install the MCP server
pip install mcilspy

# Let the server install ilspycmd for you (detects your OS automatically)
# Just ask Claude: "Install ilspycmd" or call install_ilspy with install_dotnet_sdk=true

Supported platforms for auto-install:

• Arch Linux (pacman)
• Ubuntu/Debian (apt)
• Fedora/RHEL (dnf)
• macOS (homebrew)
• Windows (winget / chocolatey)

Option 3: Manual ilspycmd Setup

# Install .NET SDK from https://dotnet.microsoft.com/download
# Then:
dotnet tool install --global ilspycmd

Table of Contents

• Quick Start
• What Can You Do?
• Features at a Glance
• Installation Options
• Tool Reference
  • Decompilation & Extraction Tools
  • Metadata Tools
  • Installation Tools
• Configuration
• Troubleshooting
• License & Acknowledgments

Tool Reference

Decompilation Tools (requires ilspycmd)

{
  "assembly_path": "/path/to/MyApp.dll",
  "type_name": "MyApp.Services.AuthService",
  "use_pdb_variable_names": true
}

{
  "assembly_path": "/path/to/MyApp.dll",
  "type_name": "MyApp.Core.CyBGElaborator",
  "method_name": "DoElaborate"
}

{
  "assembly_path": "/path/to/MyApp.dll",
  "entity_types": ["class", "interface"]
}

{
  "assembly_path": "/path/to/MyApp.dll",
  "pattern": "Controller",
  "namespace_filter": "MyApp.Web"
}

{
  "assembly_path": "/path/to/MyApp.dll",
  "pattern": "api\\..*\\.com"
  "use_regex": true
}

{
  "assembly_path": "/path/to/packages/Newtonsoft.Json",
  "output_dir": "./extracted-assemblies"
}

Metadata Tools (no ilspycmd required)

These tools use direct PE/metadata parsing via dnfile and work without any .NET installation.

{
  "assembly_path": "/path/to/MyApp.dll",
  "pattern": "Handle",
  "public_only": true
}

{
  "assembly_path": "/path/to/MyApp.dll",
  "pattern": "Key|Secret|Password",
  "use_regex": true,
  "constants_only": true
}

Installation & Diagnostics

{
  "install_dotnet_sdk": true
}

Configuration

Environment Variables

Debug Mode

{
  "mcpServers": {
    "ilspy": {
      "command": "python",
      "args": ["-m", "mcilspy.server"],
      "env": {
        "LOGLEVEL": "DEBUG"
      }
    }
  }
}

Troubleshooting

"ilspycmd not found"

Ask Claude to run the installation tool:

"Install ilspycmd for me"

Or manually:

dotnet tool install --global ilspycmd
export PATH="$PATH:$HOME/.dotnet/tools"  # Add to your shell profile

"dotnet not installed"

The install_ilspy tool can install it automatically:

{"install_dotnet_sdk": true}

Or install manually from dotnet.microsoft.com/download

Assembly parsing errors

Some obfuscated or corrupted assemblies may fail to parse. The dnfile-based tools (search_methods, search_fields, etc.) are more tolerant than full decompilation.

Supported Formats

• .NET Framework assemblies (2.0 - 4.8)
• .NET Core / .NET 5-9+ assemblies
• Any PE file with .NET metadata

C# Language Versions: CSharp1 through CSharp12, Preview, Latest

License

MIT License — see LICENSE for details.

Acknowledgments

• Original project by Borealin — foundation for this MCP server
• ILSpy — the excellent open-source .NET decompiler
• dnfile — Python library for .NET metadata parsing
• Model Context Protocol — the integration standard

Built for security researchers, reverse engineers, and curious developers.