dnSpy MCP Server (C#)

MCP server for .NET reverse engineering workflows (dnSpy/ILSpy ecosystem), built in C#.

What’s implemented

Modular architecture (Core, Transport, Tools, Services)
Reflection-based tool registration via attributes
Auto-generated tool JSON schemas from C# method signatures
MCP stdio transport (Claude Code / Codex / OpenCode compatible)
MCP resources/list + resources/read
Structured tool outputs (structuredContent) + plain text content
Single-file publish profiles (win-x64 / linux-x64)

For full implementation details, see AGENT.md.

Project layout

dnspy-mcp.slnx
Directory.Build.props
publish.ps1
src/DnSpyMcpServer/Program.cs
src/DnSpyMcpServer/Core/*
src/DnSpyMcpServer/Transport/*
src/DnSpyMcpServer/Tools/*
src/DnSpyMcpServer/Services/*
src/DnSpyMcpServer/Properties/PublishProfiles/*

Tools

list_types
decompile_type
decompile_method (supports overload targeting)
get_method_il (supports overload targeting)
search_members
list_methods (helper for overload signatures)
find_string_references (find string-literal references in IL)
format_dnspy_jump (turn tokens/IL offsets into direct dnSpy navigation steps)
patch_replace_string_literal (patch one IL string literal)
patch_nop_instructions (NOP one/many IL instructions)

Navigation-friendly output: search/method/reference results include metadata tokens (TypeDef, MethodDef, etc.) so you can jump directly in dnSpy by token.

Patch safety: patch tools always create a backup before writing changes.

All tools return:

content (text)
structuredContent (JSON object for programmatic clients)

Resources

resources/list returns:
- dnspy://assemblies
- cached assembly resources, e.g. dnspy://assembly?path=...&view=summary
- cached assembly resources, e.g. dnspy://assembly?path=...&view=types
resources/read supports:
- dnspy://assemblies
- dnspy://assembly?path=<absolute-or-relative>&view=summary
- dnspy://assembly?path=<absolute-or-relative>&view=types

Note: assembly resources are cache-driven. Cache is populated when tools are called with assemblyPath.

Build

dotnet build src/DnSpyMcpServer/DnSpyMcpServer.csproj -c Release

Run

dotnet run --project src/DnSpyMcpServer/DnSpyMcpServer.csproj -c Release

Publish (single-file)

PowerShell helper:

./publish.ps1 -Runtime win-x64
./publish.ps1 -Runtime linux-x64

Or directly:

dotnet publish src/DnSpyMcpServer/DnSpyMcpServer.csproj -c Release -p:PublishProfile=win-x64
dotnet publish src/DnSpyMcpServer/DnSpyMcpServer.csproj -c Release -p:PublishProfile=linux-x64

Quick start (copy/paste)

Build:

dotnet build src/DnSpyMcpServer/DnSpyMcpServer.csproj -c Release

Use this server command in your MCP client:

{
  "mcpServers": {
    "dnspy": {
      "command": "dotnet",
      "args": [
        "C:/Tools/Cooking/Reverse/dnSpy/dnspy-mcp/src/DnSpyMcpServer/bin/Release/net8.0/win-x64/DnSpyMcpServer.dll"
      ]
    }
  }
}

Restart your MCP client.

Prebuilt config files

Ready-to-copy templates are in:

configs/claude-code.mcp.json
configs/codex.mcp.json
configs/opencode.mcp.json

If your local path differs, edit the executable path in the selected file (args[0] for stdio clients, command[0] for OpenCode local MCP).

Client-specific config snippets

Claude Code

Add/update your MCP config with:

{
  "mcpServers": {
    "dnspy": {
      "command": "dotnet",
      "args": [
        "C:/Tools/Cooking/Reverse/dnSpy/dnspy-mcp/src/DnSpyMcpServer/bin/Release/net8.0/win-x64/DnSpyMcpServer.dll"
      ]
    }
  }
}

Codex

Use the same MCP server entry:

{
  "mcpServers": {
    "dnspy": {
      "command": "dotnet",
      "args": [
        "C:/Tools/Cooking/Reverse/dnSpy/dnspy-mcp/src/DnSpyMcpServer/bin/Release/net8.0/win-x64/DnSpyMcpServer.dll"
      ]
    }
  }
}

OpenCode (Windows)

OpenCode uses this config file:

%USERPROFILE%\.config\opencode\opencode.json

Add this block under mcp:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dnspy": {
      "type": "local",
      "enabled": true,
      "command": [
        "dotnet",
        "C:/Tools/Cooking/Reverse/dnSpy/dnspy-mcp/src/DnSpyMcpServer/bin/Release/net8.0/win-x64/DnSpyMcpServer.dll"
      ]
    }
  }
}

(Template file: configs/opencode.mcp.json)

Optional: run from project instead of DLL

{
  "mcpServers": {
    "dnspy": {
      "command": "dotnet",
      "args": [
        "run",
        "--project",
        "C:/Tools/Cooking/Reverse/dnSpy/dnspy-mcp/src/DnSpyMcpServer/DnSpyMcpServer.csproj",
        "-c",
        "Release"
      ]
    }
  }
}

First actions to test in your client

After restart, ask your client to call:

list_types

{ "assemblyPath": "C:/path/to/target.dll" }

list_methods

{ "assemblyPath": "C:/path/to/target.dll", "typeFullName": "MyApp.Services.AuthService" }

decompile_method

{
  "assemblyPath": "C:/path/to/target.dll",
  "typeFullName": "MyApp.Services.AuthService",
  "methodName": "Login",
  "parameterTypeNames": ["System.String", "System.String"]
}

resources/list then resources/read with dnspy://assemblies
find_string_references

{
  "assemblyPath": "C:/Program Files (x86)/Cato Networks/Cato Client/CatoClient.exe",
  "text": "Screenshot 2026-03-11 082704.png",
  "caseSensitive": false,
  "maxResults": 200
}

Tip: also search fragments like Pictures\\Screenshots or just Screenshot.

format_dnspy_jump

{
  "assemblyPath": "C:/Program Files (x86)/Cato Networks/Cato Client/CatoClient.exe",
  "typeDefToken": "0x02000058",
  "methodDefToken": "0x060005C1",
  "ilOffset": "IL_01D2"
}

patch_replace_string_literal (always creates backup)

{
  "assemblyPath": "C:/Program Files (x86)/Cato Networks/Cato Client/CatoClient.exe",
  "methodDefToken": "0x060005C1",
  "ilOffset": "IL_01D2",
  "newText": "[patched text]",
  "inPlace": false
}

patch_nop_instructions (always creates backup)

{
  "assemblyPath": "C:/Program Files (x86)/Cato Networks/Cato Client/CatoClient.exe",
  "methodDefToken": "0x060005C1",
  "ilOffset": "IL_01DD",
  "count": 1,
  "inPlace": false
}

Overload targeting example

{
  "assemblyPath": "C:/path/target.dll",
  "typeFullName": "MyApp.Services.AuthService",
  "methodName": "Login",
  "parameterTypeNames": ["System.String", "System.String"]
}

If parameterTypeNames is omitted and overloads exist, the server returns an ambiguity error with available signatures.

MCP Servers