Dotnet DNLib MCP Server

What is Dotnet DNLib MCP?

Dotnet DNLib MCP is a .NET reverse engineering toolkit implemented as a Model Context Protocol (MCP) server. It uses the dnlib library to load and analyze .NET assemblies, extract metadata, inspect code structures, and perform tasks like decompilation and patching through the MCP communication protocol. It is aimed at security researchers, developers, and reverse engineers working with .NET binaries.

How to use Dotnet DNLib MCP?

Clone the repository, build with dotnet build, then run with dotnet run. The server communicates over standard input/output using JSON‑RPC. Connect any MCP‑compatible client and call LoadAssembly first, then use tools like ListTypesRegex, Decompile_Method_By_RID, or UpdateMethodInstructions. Example commands are provided in the README.

Key features of Dotnet DNLib MCP

• Load and examine .NET assemblies via MCP API calls
• Search and enumerate types using regex patterns
• List methods, analyze IL code, and extract control flow graphs
• Find method usages, dependencies, and references
• Locate literal strings embedded in assemblies
• Detect reflection, dynamic code, and serialization usage
• Decompile IL code back to C# for easier analysis
• Modify method instructions for testing and debugging

Use cases of Dotnet DNLib MCP

• Reverse engineer .NET malware or proprietary binaries for threat analysis
• Debug and understand complex .NET applications by inspecting IL and decompiled code
• Automate security audits of .NET assemblies through MCP‑enabled toolchains
• Patch assemblies for testing or educational purposes without recompilation
• Extract string constants and method dependencies during penetration testing