Dotnet DNLib MCP

What is Dotnet DNLib MCP?

Dotnet DNLib MCP is a .NET reverse engineering toolkit implemented as a Model Context Protocol (MCP) server. It uses the dnlib library to load and analyze .NET assemblies, extract metadata, inspect code structures, and perform tasks like decompilation and patching through the MCP communication protocol. It is aimed at security researchers, developers, and reverse engineers working with .NET binaries.

How to use Dotnet DNLib MCP?

Clone the repository, build with dotnet build, then run with dotnet run. The server communicates over standard input/output using JSON‑RPC. Connect any MCP‑compatible client and call LoadAssembly first, then use tools like ListTypesRegex, Decompile_Method_By_RID, or UpdateMethodInstructions. Example commands are provided in the README.

Key features of Dotnet DNLib MCP

• Load and examine .NET assemblies via MCP API calls
• Search and enumerate types using regex patterns
• List methods, analyze IL code, and extract control flow graphs
• Find method usages, dependencies, and references
• Locate literal strings embedded in assemblies
• Detect reflection, dynamic code, and serialization usage
• Decompile IL code back to C# for easier analysis
• Modify method instructions for testing and debugging

Use cases of Dotnet DNLib MCP

• Reverse engineer .NET malware or proprietary binaries for threat analysis
• Debug and understand complex .NET applications by inspecting IL and decompiled code
• Automate security audits of .NET assemblies through MCP‑enabled toolchains
• Patch assemblies for testing or educational purposes without recompilation
• Extract string constants and method dependencies during penetration testing

FAQ from Dotnet DNLib MCP

What dependencies does Dotnet DNLib MCP require?

.NET 9.0 or later, plus the libraries dnlib, ICSharpCode.Decompiler, and ModelContextProtocol.

How does the server communicate with clients?

The server uses the Model Context Protocol over standard input/output, exchanging JSON‑RPC messages. No network ports are opened by default.

Can I modify an assembly and save it?

Yes. Use the UpdateMethodInstructions tool to patch IL code, then save the modified assembly with the SaveAssembly tool.

What is the recommended workflow for analyzing a large assembly?

Always start by calling LoadAssembly. For discovery use ListTypesRegex or SearchTypes; for analysis use specialized tools. Pagination (offset, pageSize) is supported to handle large result sets.

Is this tool intended only for legitimate purposes?

Yes. The README states it is for educational and debugging purposes only, and users must respect intellectual property and license restrictions.