🔬 DnSpy MCP Server

A powerful MCP server for .NET reverse engineering, game hacking, and Il2Cpp dump analysis.

31 AI-optimized tools • Cross-References • Network Reversing • Il2Cpp Support • TCP Proxy Analysis • Multi-DLL Search

Features

• 31 MCP Tools for deep .NET assembly analysis, patching, and game reversing
• Fully async, non-blocking architecture
• Il2Cpp / Unity game dump optimized (offset search, RVA lookup, dummy detection)
• Cross-reference scanning (method callers, field references)
• Network/TCP proxy reverse engineering (packet handler discovery, crypto usage scanning)
• Hardcoded secret extraction (IPs, URLs, API keys)
• Multi-assembly search — search all DLLs in a folder at once
• dump.cs bridge — resolve dump.cs line numbers to DummyDll types
• C-struct layout export — ready for cheat engine / Frida scripts
• Default assembly auto-discovery — DNSPY_DEFAULT_ASSEMBLY env var support
• AI agent instructions — instructions.md for AI agent onboarding
• Single-file publish (win-x64 / linux-x64)
• MCP stdio transport (Claude Code / Codex / Cursor / OpenCode / Antigravity compatible)

Project Layout

src/DotNetInspectorMcp/
├── Program.cs                          # Entry point with graceful shutdown
├── Hosting/McpServerHost.cs            # Dependency wiring
├── Models/McpServer.cs                 # MCP request router
├── Communication/StdioJsonRpc.cs       # Stdio JSON-RPC transport
├── Domain/AssemblyAnalyzer.cs          # Core analysis engine
├── Domain/ResourceRegistry.cs          # MCP resources
├── Endpoints/AssemblyTools.cs          # All tool implementations
├── Endpoints/ToolRegistry.cs           # Reflection-based tool discovery
├── Endpoints/Attributes.cs             # [McpTool] / [ToolParam] attributes
├── Endpoints/ToolCallResult.cs         # Tool result model
└── Endpoints/ToolContext.cs            # DI context for tools

Tools (31 total)

Assembly Inspection

Game Dump / Il2Cpp Analysis

9b7039f949a85947fd36460a2e67b8073fd13b11 | get_struct_layout | Advanced C++ struct export with explicit padding (char _pad) computed from offsets. | | get_method_rva | Get the Il2Cpp RVA for a specific method. | | search_by_offset | Search by hex (0x16D0) or decimal offset to find fields/methods. Numeric comparison. | | find_enum_values | Find/resolve enum values by magic number, hex value, or partial name. | | find_ui_bindings | Scan a class to find all Unity UI component references and the methods modifying them. | | get_class_pointer | Parse script.json from Il2CppDumper to get static TypeInfo class pointers for memory scanning. |

Deep Reverse Engineering

Network / TCP Proxy Reversing

Multi-Assembly & Dump Bridge

Patching

Navigation

Default Assembly Path

You can avoid repeating assemblyPath on every tool call by setting:

# Environment variable
set DNSPY_DEFAULT_ASSEMBLY=C:\path\to\DummyDll\Assembly-CSharp.dll

The server also auto-discovers assemblies in common locations relative to CWD:

• DummyDll/Assembly-CSharp.dll
• Dump/DummyDll/Assembly-CSharp.dll
• Managed/Assembly-CSharp.dll

Resources

• inspector://assemblies — list cached assemblies
• inspector://assembly?path=<path>&view=summary — assembly summary
• inspector://assembly?path=<path>&view=types — all type names

Build

dotnet build src/DotNetInspectorMcp/DotNetInspectorMcp.csproj -c Release

Run

dotnet run --project src/DotNetInspectorMcp/DotNetInspectorMcp.csproj -c Release

Publish (single-file)

./publish.ps1 -Runtime win-x64
./publish.ps1 -Runtime linux-x64

MCP Client Configuration

Claude Code / Cursor / Codex

{
  "mcpServers": {
    "dnspy-mcp": {
      "command": "dotnet",
      "args": [
        "<PATH_TO>/DnSpyMCP.dll"
      ]
    }
  }
}

OpenCode (Windows)

Config file: %USERPROFILE%\.config\opencode\opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dnspy-mcp": {
      "type": "local",
      "enabled": true,
      "command": [
        "dotnet",
        "<PATH_TO>/DnSpyMCP.dll"
      ]
    }
  }
}

Using Published .exe (no dotnet runtime needed)

{
  "mcpServers": {
    "dnspy-mcp": {
      "command": "<PATH_TO>/DnSpyMCP-win-x64.exe",
      "args": []
    }
  }
}

Replace <PATH_TO> with the actual path to your built DLL or published EXE.

AI Agent Instructions

Copy configs/instructions.md to your MCP server's tool directory so AI agents automatically get usage guidance:

# Antigravity example:
copy configs\instructions.md %USERPROFILE%\.gemini\antigravity-ide\mcp\dnspy\instructions.md

Quick Start

1. Build or publish
2. Add config to your MCP client (see above)
3. Copy configs/instructions.md to your MCP tool directory
4. Restart your MCP client
5. Ask the AI to call list_types with your target assembly path

Example Workflows

Find what modifies a health field

1. search_members → find "health" field
2. find_field_references → see all methods that read/write it
3. decompile_method → inspect the logic
4. get_method_rva → get the RVA for Frida hooking

TCP Proxy / Packet Interception

1. find_network_handlers → find Send/Receive methods
2. find_crypto_usage → find encryption before packets are sent
3. scan_secrets → extract server IPs and endpoints
4. get_method_rva → get RVAs for Frida hooks

Il2Cpp Game Analysis

1. list_types (gameCodeOnly=true) → see only game scripts
2. analyze_type → get full memory layout with offsets
3. get_type_layout → export as C struct for cheat engine
4. search_by_offset 0x16D0 → find what field is at that offset
5. find_method_callers → trace who calls a specific function

Multi-DLL Discovery

1. search_workspace → search all DLLs in DummyDll folder
2. analyze_type → deep dive into the matching type
3. find_field_references → cross-reference analysis

Bridge dump.cs to DummyDll

1. resolve_dump_line → resolve a dump.cs line to a type/member
2. analyze_type → get the full analysis from DummyDll

Star History