Corvus runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 25 Oct 2026.
Reverse engineering of .NET assemblies and native binaries: decompile, search, compare, patch.
What the code does
We read the source, 1 h ago · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
new("process", "noteworthy", R(@"bash\s+-i\s*>&\s*/dev/tcp/|/dev/tcp/[\w.-]+/\d+|\bnc(?:at)?\s+(?:-\w+\s+)*-e\s+/bin/|\bos\.dup2\(\s*\w+\.fileno\(\)|\bpty\.spawn\(\s*['""]/bin/(?:ba)?sh"), "hands a shell to a network connection (reverse shell)"),
trap 'rm -rf "$work"' EXIT
new("credentials", "noteworthy", R(@"\.npmrc\b|[/\\]\.ssh[/\\]|\bid_rsa\b|\.aws[/\\]credentials|\.git-credentials|\.bash_history|/etc/(?:shadow|passwd)\b|\bLogin Data\b|Local Storage[/\\]+leveldb|\bwallet\.dat\b|\bdiscord(?:app)?\b.{0,40}\btoken|\bkeychain-db\b|\bbrowser_…
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
[GeneratedRegex(@"(?i)(?<name>\b[A-Z0-9_.-]*(PASSWORD|PASSWD|PASSPHRASE|PWD|SECRET|TOKEN|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIALS?)[A-Z0-9_.-]*)(?<sep>\s*=\s*|:\s+)(""[^""\r\n]*""|'[^'\r\n]*'|[^\s""',;&]+)")]
["IsDebuggerPresent", "CheckRemoteDebuggerPresent", "NtQueryInformationProcess", "OutputDebugString", "DebugActiveProcess", "WaitForDebugEvent",
"Software\\Microsoft\\Windows\\CurrentVersion\\Run /usr/local/bin/service --config /etc/app/config.json\n");
return Op switch { null => member, Insert => "+" + member, _ => "!" + Op };
var process = ChildProcess.Start(new ChildProcessStart(java, args) { Environment = ExternalTools.MinimalEnvironment(env), WorkingDirectory = temp });
mods[optional] = __import__(optional)
new("credentials", "noteworthy", R(@"\.npmrc\b|[/\\]\.ssh[/\\]|\bid_rsa\b|\.aws[/\\]credentials|\.git-credentials|\.bash_history|/etc/(?:shadow|passwd)\b|\bLogin Data\b|Local Storage[/\\]+leveldb|\bwallet\.dat\b|\bdiscord(?:app)?\b.{0,40}\btoken|\bkeychain-db\b|\bbrowser_…
…s?://[\w.-]+\.ngrok(?:-free)?\.(?:io|app|dev)\b|https?://[\w.-]+\.(?:oast\.(?:fun|me|pro|live|site|online)|interact\.sh|burpcollaborator\.net|oastify\.com|beeceptor\.com|dnslog\.cn|ceye\.io|requestcatcher\.com)\b|https?://(?:[\w-]+\.)*(?:requestbin\.(?:com|net)|pipedream\.net|web…
"rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLS…
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Corvus and you get told the day something new turns up.
Alternatives to Corvus
same job, measured the same wayRead-only reverse engineering of Electron apps, PE/ELF/Mach-O binaries, Go/Rust, .NET and APKs.
Query DezignWorks reverse engineering software: features, compatibility, and pricing.
Rust MCP server for binary analysis and reverse engineering.
Search npm packages, get live registry data, and compare alternatives. No API key needed.
Local MCP server: detects a game's engine and gives agents native binary analysis/patching tools.
Search and compare hourly deals on US-warehouse home, patio, gym and pet goods, plus original tees.
AI-native B2B sales research, ranking, and CRM enrichment.
MCP server for JavaScript reverse engineering and browser debugging.
Corvus — questions
Answers built from our own checks of this server.