DnSpy MCP Server

dnSpy MCP Server

A Model Context Protocol (MCP) server embedded in dnSpy that exposes full .NET assembly analysis, editing, debugging, memory-dump, and deobfuscation capabilities to any MCP-compatible AI assistant.

Version: 1.6.0 | Tools: 95 | Status: ✅ 0 errors, 0 warnings | Targets: .NET 4.8 + .NET 10.0-windows

---

Table of Contents

1. [Features](#features)
2. [Build & Install](#build--install)
3. [Client Configuration](#client-configuration)
4. [Tool Reference](#tool-reference)

• [Assembly Tools](#assembly-tools)
• [Type & Member Tools](#type--member-tools)
• [Method & Decompilation Tools](#method--decompilation-tools)
• [IL Tools](#il-tools)
• [Analysis & Cross-Reference Tools](#analysis--cross-reference-tools)
• [Edit Tools](#edit-tools)
• [Embedded Resource Tools](#embedded-resource-tools)
• [Debug Tools](#debug-tools)
• [Memory Dump & PE Tools](#memory-dump--pe-tools)
• [Static PE Analysis](#static-pe-analysis)
• [Deobfuscation Tools](#deobfuscation-tools)
• [Window / Dialog Tools](#window--dialog-tools)
• [Utility](#utility)

1. [Pattern Syntax](#pattern-syntax)
2. [Pagination](#pagination)
3. [Usage Examples](#usage-examples)
4. [Architecture](#architecture)
5. [Project Structure](#project-structure)
6. [Configuration](#configuration)
7. [Troubleshooting](#troubleshooting)

---

Features

| Category | Capabilities | |----------|-------------| | Assembly | List loaded assemblies, namespaces, type counts, P/Invoke imports | | Types | Inspect types, fields, properties, events, nested types, attributes, inheritance | | Decompilation | Decompile entire types or individual methods to C# | | IL | View IL instructions, raw bytes, local variables, exception handlers | | Analysis | Find callers/users, trace field reads/writes, call graphs, dead code, cross-assembly dependencies | | Edit | Rename members, change access modifiers, edit metadata, patch methods, inject types, save to disk | | Resources | List, read, add, remove embedded resources (ManifestResource table); extract Costura.Fody-embedded assemblies | | Debug | Manage breakpoints (with conditions), launch/attach processes, pause/resume/stop sessions, single-step (over/into/out), inspect call stacks, read locals, evaluate expressions | | Memory Dump | List runtime modules, dump .NET or native modules from memory, read/write process memory, extract PE sections | | Static PE Analysis | Scan raw PE bytes for strings; all-in-one ConfuserEx unpacker | | Deobfuscation | de4dot integration: detect obfuscator, rename mangled symbols, decrypt strings. Both in-process (deobfuscate_assembly) and external process (run_de4dot) modes available in all builds | | Window / Dialog | List active dialog/message-box windows (Win32 #32770 + WPF) in the dnSpy process; dismiss them by clicking any button by name (supports EN and ES) | | Search | Glob and regex search across all loaded assemblies |

---

Build & Install

Prerequisites

| Requirement | Version | |-------------|---------| | .NET SDK | 10.0+ (for net10.0-windows target) | | .NET Framework SDK | 4.8 (for net48 target) | | OS | Windows (WPF dependency) | | dnSpy | dnSpyEx (this repo) |

> de4dot integration — de4dot libraries are bundled in libs/de4dot/ (net48) and libs/de4dot-net8/ (net8/net10). No external dependencies required; all deobfuscation tools are available in both build targets.

Clone & Restore

git clone https://github.com/dnSpyEx/dnSpy --recursive
cd dnSpy

Build commands

# Build only the MCP Server extension (Debug)
dotnet build Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj -c Debug

# Build only the MCP Server extension (Release)
dotnet build Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj -c Release

# Build the full dnSpy solution (both targets)
dotnet build dnSpy.sln -c Debug

# Build for a specific target framework only
dotnet build Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj -c Release -f net10.0-windows
dotnet build Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj -c Release -f net48

# Restore NuGet packages without building
dotnet restore Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj

# Clean build artifacts
dotnet clean Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj

Output locations

| Target | Output path | |--------|-------------| | .NET 10.0-windows | dnSpy/dnSpy/bin/Release/net10.0-windows/dnSpy.MCP.Server.x.dll | | .NET Framework 4.8 | dnSpy/dnSpy/bin/Release/net48/dnSpy.MCP.Server.x.dll |

> The MCP Server DLL is output directly into dnSpy's bin directory so it loads automatically when you start dnSpy.

Verify the build

# Check for errors (expects "Compilación correcta" or "Build succeeded")
dotnet build Extensions/dnSpy.MCP.Server/dnSpy.MCP.Server.csproj -c Release --nologo 2>&1 | tail -5

Runtime

1. Start dnSpy — the MCP server starts automatically on http://localhost:3100
2. Verify it is running:

``bash curl http://localhost:3100/health curl -N --max-time 3 http://localhost:3100/sse # should print event: endpoint ``

1. Configure your MCP client (see next section)

---

Client Configuration

The server implements the MCP SSE transport (spec version 2024-11-05). On connect the server sends an event: endpoint with the per-session POST URL; responses are pushed back over the SSE stream.

Claude Code (CLI)

claude mcp add dnspy --transport sse http://localhost:3100/sse

Claude Desktop

{
  "mcpServers": {
    "dnspy": {
      "type": "sse",
      "url": "http://localhost:3100/sse"
    }
  }
}

Or

claude mcp add dnspy --transport sse http://localhost:3100/sse

OpenCode

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dnspy": {
      "type": "remote",
      "url": "http://localhost:3100/sse",
      "enabled": true
    }
  }
}

Kilo Code / Roo Code

{
  "mcpServers": {
    "dnspy-mcp": {
      "type": "sse",
      "url": "http://localhost:3100/sse",
      "alwaysAllow": [
        "list_assemblies", "list_tools", "search_types",
        "get_type_info", "list_methods_in_type"
      ],
      "disabled": false
    }
  }
}

Codex CLI

{
  "mcpServers": {
    "dnspy": {
      "type": "sse",
      "url": "http://localhost:3100/sse",
      "timeout": 30
    }
  }
}

Gemini CLI

mcpServers:
  dnspy:
    type: sse
    url: http://localhost:3100/sse

> SSE endpoints: GET /sse (or /events, /) opens the event stream. The server immediately sends event: endpoint\ndata: http://localhost:3100/message?sessionId=. The client then POSTs JSON-RPC requests to that URL and receives responses as event: message SSE events. POST / still accepts direct JSON-RPC for curl/scripting use.

---

Tool Reference

All tools are called over MCP as tools/call with a JSON arguments object. Parameters marked required must always be provided; all others are optional.

---

Assembly Tools

Tools for listing and inspecting .NET assemblies loaded in dnSpy.

| Tool | Description | Required params | Optional params | |------|-------------|-----------------|-----------------| | list_assemblies | List every assembly currently open in dnSpy, with version, culture, and public key token | — | — | | get_assembly_info | Detailed info for one assembly: modules, namespaces, type count | assembly_name | cursor | | list_types | List types in an assembly, with class/interface/enum flags. Supports glob and regex via name_pattern | assembly_name | namespace, name_pattern, cursor | | list_native_modules | List native DLLs imported via [DllImport], grouped by DLL name with the managed methods that use them | assembly_name | — | | load_assembly | Load a .NET assembly into dnSpy from a file on disk or from a running process by PID. Supports both normal PE layout and raw memory-layout dumps | — | file_path, memory_layout, pid, module_name | | select_assembly | Select an assembly in the dnSpy document tree and open it in the active tab; changes the current assembly context for subsequent operations | assembly_name | file_path | | close_assembly | Close (remove) a specific assembly from dnSpy | assembly_name | file_path | | close_all_assemblies | Close all assemblies currently loaded in dnSpy, clearing the document tree | — | — |

Parameter details

| Parameter | Type | Description | |-----------|------|-------------| | assembly_name | string | Short assembly name as shown in dnSpy (e.g. UnityEngine.CoreModule) | | namespace | string | Exact namespace filter (e.g. System.Collections.Generic) | | name_pattern | string | Glob or regex filter on type name — see [Pattern Syntax](#pattern-syntax) | | cursor | string | Opaque base-64 pagination cursor from nextCursor in a previous response | | file_path | string | (load_assembly) Absolute path to a .NET assembly or memory dump | | memory_layout | boolean | (load_assembly) When true, treat the file as raw memory-layout (VAs, not file offsets). Default false | | pid | integer | (load_assembly) PID of a running .NET process to dump from. Requires active debug session. | | module_name | string | (load_assembly) Module name/filename to pick when using pid. Defaults to first EXE module. | | file_path | string | (select_assembly, close_assembly) Absolute path (FilePath from list_assemblies) to disambiguate when multiple assemblies share the same short name |

---

Type & Member Tools

Tools for inspecting the internals of a specific type.

| Tool | Description | Required params | Optional params | |------|-------------|-----------------|-----------------| | get_type_info | Full type overview: visibility, base type, interfaces, fields, properties, methods (paginated) | assembly_name, type_full_name | cursor | | search_types | Search for types by name across all loaded assemblies | query | cursor | | get_type_fields | List fields matching a name pattern, with type, visibility, and readonly/const flags | assembly_name, type_full_name, pattern | cursor | | get_type_property | Full detail for a single property: getter/setter signatures, attributes | assembly_name, type_full_name, property_name | — | | list_properties_in_type | Summary list of all properties with read/write flags | assembly_name, type_full_name | cursor | | list_events_in_type | All events with add/remove method info | assembly_name, type_full_name | — | | list_nested_types | All nested types recursively (full name, visibility, kind) | assembly_name, type_full_name | — | | get_custom_attributes | Custom attributes on the type or on one of its members | assembly_name, type_full_name | member_name, member_kind | | analyze_type_inheritance | Full inheritance chain (base classes + interfaces) | assembly_name, type_full_name | — | | find_path_to_type | BFS traversal of property/field references to find how one type reaches another | assembly_name, from_type, to_type | max_depth |

Parameter details

| Parameter | Type | Description | |-----------|------|-------------| | type_full_name | string | Fully-qualified type name (e.g. MyNamespace.MyClass) | | query | string | Substring, glob, or regex matched against FullName | | pattern | string | Glob or regex for field name matching; use * to list all | | property_name | string | Exact property name (case-insensitive) | | member_name | string | Member name for attribute lookup (omit to get type-level attributes) | | member_kind | string | Disambiguates overloaded names: method, field, property, or event | | from_type | string | Full name of starting type for BFS path search | | to_type | string | Name or substring of the target type | | max_depth | integer | BFS depth limit (default 5) |

---

Method & Decompilation Tools

Tools for decompiling code and exploring method metadata.

| Tool | Description | Required params | Optional params | |------|-------------|-----------------|-----------------| | decompile_type | Decompile an entire type (class/struct/interface/enum) to C# | assembly_name, type_full_name | — | | decompile_method | Decompile a single method to C# | assembly_name, type_full_name, method_name | — | | list_methods_in_type | List methods with return type, visibility, static, virtual, parameter count. Filter by visibility or name pattern | assembly_name, type_full_name | visibility, name_pattern, cursor | | get_method_signature | Full signature for one method: parameters, return type, generic constraints | assembly_name, type_full_name, method_name | — |

Parameter details

| Parameter | Type | Description | |-----------|------|-------------| | method_name | string | Method name (first match when overloads exist; use get_method_signature to disambiguate) | | visibility | string | Filter: public, private, protected, or internal | | name_pattern | string | Glob or regex on method name (e.g. Get*, ^On[A-Z], Async$) |

---

IL Tools

Low-level IL inspection for a method body.

| Tool | Description | Required params | Optional params | |------|-------------|-----------------|-----------------| | get_method_il | IL instruction listing with offsets, opcodes, operands, and local variable table | assembly_name, type_full_name, method_name | — | | get_method_il_bytes | Raw IL bytes as a hex string and Base64 | assembly_name, type_full_name, method_name | — | | get_method_exception_handlers | try/catch/finally/fault region table (offsets and handler type) | assembly_name, type_full_name, method_name | — | | dump_cordbg_il | For each MethodDef in the paused module, reads ICorDebugFunction.ILCode.Address and ILCode.Size via the CorDebug COM API (through reflection). Reports whether IL addresses fall inside the PE image (encrypted stubs) or outside (JIT hook buffers). Useful for ConfuserEx JIT-hook analysis. Requires an active paused debug session | — | module_name, output_path, max_methods, include_bytes |

Parameter details (dump_cordbg_il)

| Parameter | Type | Description | |-----------|------|-------------| | module_name | string | Module name or filename filter (default: first EXE module) | | output_path | string | Optional path to save full JSON results to disk | | max_methods | integer | Max number of MethodDef tokens to scan (default 10000) | | include_bytes | boolean | When true, include Base64-encoded IL bytes for each method (default false) |

---

Analysis & Cross-Reference Tools

Call-graph, usage, and dependency analysis across all loaded assemblies.

| Tool | Description | Required params | Optional params | |------|-------------|-----------------|-----------------| | find_who_calls_method | Find every method whose IL contains a call/callvirt to the target | assembly_name, type_full_name, method_name | — | | find_who_uses_type | Find all types, methods, and fields that reference a type (base class, interface, field type, parameter, return type) | assembly_name, type_full_name | — | | find_who_reads_field | Find all methods that read a field via ldfld/ldsfld IL instructions | assembly_name, type_full_name, field_name | — | | find_who_writes_field | Find all methods that write to a field via stfld/stsfld IL instructions | assembly_name, type_full_name, field_name | — | | analyze_call_graph | Build a recursive call graph for a method, showing all methods it calls down to a configurable depth | assembly_name, type_full_name, method_name | max_depth | | find_dependency_chain | Find all dependency paths between two types via

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: s78910
• Source: s78910/dnSpy.MCP.Server
• License: MIT

Install and usage instructions live in the source repository linked above.