Changelog

All notable changes to mcilspy are documented here. This project follows Keep a Changelog conventions.

0.5.0 2026-02-11

Output truncation guard — new max_output_chars parameter on decompile_assembly (default 100,000 characters). When decompiled output exceeds the limit, the full text is saved to a temp file and the tool returns a truncated preview with the file path. Set to 0 to disable truncation.
Method-level decompilation — new decompile_method tool extracts a single method from a type by name. Supports both C# and IL output, handles overloads, and works via post-processing of ilspycmd’s type-level output.
Tool count increased from 15 to 16.

PDB generation — generate_pdb flag on decompile_assembly produces a portable PDB file alongside the decompiled source.
PDB variable names — use_pdb_variable_names flag recovers original variable names from an existing PDB when decompiling.
dump_package tool — extract all assemblies from a NuGet package folder into a target directory for bulk analysis.
Achieved 100% coverage of ilspycmd CLI flags.
Tool count increased from 14 to 15.

Type parsing regex now correctly handles generic types with nested angle brackets.
UserStringHeap reading fixed for assemblies with large string tables.
Decompile-to-stdout path no longer creates unnecessary temp directories.

Fixed shell injection vulnerability — switched from asyncio.create_subprocess_shell to asyncio.create_subprocess_exec. Assembly paths are no longer passed through a shell interpreter.

5-minute subprocess timeout prevents runaway decompilation on corrupted or adversarial assemblies.
pytest test suite with 35 tests covering all tools and error paths.
PATH auto-discovery for ilspycmd (checks ~/.dotnet/tools when not in PATH).
importlib.metadata versioning — version is derived from the installed package metadata.
Standardized error message format across all tools.
FastMCP lifespan pattern for clean startup/shutdown.

dnfile-based metadata tools — 6 new tools (search_methods, search_fields, search_properties, list_events, list_resources, get_metadata_summary) that parse PE metadata directly without ilspycmd.
Platform-aware installation detection and instructions.
Improved README with tool matrix and usage examples.

Initial release with 4 core tools: decompile_assembly, list_types, generate_diagrammer, get_assembly_info.
ILSpyWrapper async subprocess management.
Pydantic request/response models.
MCP prompts for guided analysis workflows.