diff --git a/README.md b/README.md
index a742d3d..d7397e8 100644
--- a/README.md
+++ b/README.md
@@ -1,60 +1,28 @@
# mcilspy
-A Model Context Protocol (MCP) server that provides .NET assembly decompilation capabilities using ILSpy.
+[](https://pypi.org/project/mcilspy/)
+[](https://www.python.org/downloads/)
+[](https://opensource.org/licenses/MIT)
+[](https://modelcontextprotocol.io/)
-## Features
+**Decompile, search, and analyze .NET assemblies with AI assistance.**
-### ILSpy-based Tools (requires ilspycmd)
-- **Decompile Assemblies**: Convert .NET assemblies back to readable C# source code
-- **List Types**: Enumerate classes, interfaces, structs, delegates, and enums in assemblies
-- **Search Types**: Find types by name pattern with regex support
-- **Search Strings**: Find hardcoded strings in assembly code (URLs, credentials, etc.)
-- **Generate Diagrammer**: Create interactive HTML visualizations of assembly structure
-- **Assembly Information**: Get metadata about .NET assemblies (version, target framework, etc.)
+An MCP server that gives Claude (or any MCP client) the power to reverse-engineer .NET binaries — find hardcoded secrets, understand obfuscated code, recover lost source, and explore assembly internals.
-### Direct Metadata Tools (no ilspycmd required)
-- **Search Methods**: Find methods by name pattern directly from metadata tables
-- **Search Fields**: Find fields and constants in assemblies
-- **Search Properties**: Find properties by name pattern
-- **List Events**: Enumerate all events defined in an assembly
-- **List Resources**: List embedded resources (files, images, etc.)
-- **Metadata Summary**: Get comprehensive assembly metadata with statistics
+---
-### Installation & Diagnostics
-- **Check Installation**: Verify ilspycmd and dotnet CLI status
-- **Install ILSpy**: Automatically install or update ilspycmd
-
-## Prerequisites
-
-1. **ILSpy Command Line Tool**: Install the global dotnet tool:
- ```bash
- dotnet tool install --global ilspycmd
- ```
-
-2. **Python 3.10+**: Required for running the MCP server
-
-## Installation
-
-Install from PyPI:
+## Quick Start (30 seconds)
```bash
+# Install
pip install mcilspy
+
+# Add to Claude Code
+claude mcp add ilspy -- python -m mcilspy.server
+
+# Or add to Claude Desktop's config.json
```
-Or for development:
-
-```bash
-git clone https://github.com/Borealin/mcilspy.git
-cd mcilspy
-pip install -e .
-```
-
-## Usage
-
-### MCP Client Configuration
-
-Configure your MCP client (e.g., Claude Desktop) to use the server:
-
```json
{
"mcpServers": {
@@ -66,313 +34,364 @@ Configure your MCP client (e.g., Claude Desktop) to use the server:
}
```
-### Available Tools
+**That's it.** Ask Claude to analyze any `.dll` or `.exe`:
-#### 1. `decompile_assembly`
-Decompile a .NET assembly to C# source code. This is the primary tool for reverse-engineering .NET binaries.
+> *"Decompile the LoginService class from this assembly and explain what it does"*
-**Parameters:**
-- `assembly_path` (required): Path to the .NET assembly file
-- `output_dir` (optional): Output directory for decompiled files
-- `type_name` (optional): Fully qualified type name to decompile (e.g., "MyNamespace.MyClass")
-- `language_version` (optional): C# language version (default: "Latest")
-- `create_project` (optional): Create a compilable project structure
-- `show_il_code` (optional): Show IL bytecode instead of C#
-- `remove_dead_code` (optional): Remove unreachable code during decompilation
-- `remove_dead_stores` (optional): Remove unused variable assignments
-- `show_il_sequence_points` (optional): Include debugging sequence points in IL output
-- `nested_directories` (optional): Use nested directories for namespaces
+---
+
+## What Can You Do?
+
+### Find Hardcoded Secrets
+```
+"Search for any URLs, API keys, or connection strings in MyApp.dll"
+```
+Discovers hardcoded credentials, endpoints, and configuration that shouldn't be in code.
+
+### Reverse Engineer Unknown Binaries
+```
+"List all the types in this DLL and identify the main entry points"
+```
+Understand the structure of any .NET assembly without source code.
+
+### Recover Lost Source Code
+```
+"Decompile the entire assembly to a project I can build"
+```
+Recreate compilable C# projects from binaries when source is unavailable.
+
+### Analyze Malware Behavior
+```
+"Find all network-related methods and show me what URLs this malware contacts"
+```
+Safe static analysis of suspicious .NET executables.
+
+### Understand Third-Party Libraries
+```
+"Show me how Newtonsoft.Json handles circular references"
+```
+Learn from decompiled implementations when documentation falls short.
+
+---
+
+## Features at a Glance
+
+| Tool | What It Does | Requires ilspycmd? |
+|------|--------------|:------------------:|
+| `decompile_assembly` | Full C# source recovery | Yes |
+| `list_types` | Enumerate classes, interfaces, enums | Yes |
+| `search_types` | Find types by name pattern | Yes |
+| `search_strings` | Find hardcoded strings (URLs, keys) | Yes |
+| `search_methods` | Find methods by name | No |
+| `search_fields` | Find fields and constants | No |
+| `search_properties` | Find properties by name | No |
+| `list_events` | List all events | No |
+| `list_resources` | Find embedded files/images | No |
+| `get_metadata_summary` | Assembly stats and references | No |
+| `generate_diagrammer` | Interactive HTML type diagrams | Yes |
+| `get_assembly_info` | Version, framework, signing info | Yes |
+| `check_ilspy_installation` | Diagnose setup issues | No |
+| `install_ilspy` | Auto-install .NET SDK + ilspycmd | No |
+
+**6 tools work immediately** (via [dnfile](https://github.com/malwarefrank/dnfile)) — no .NET SDK required.
+**8 more tools** unlock with `ilspycmd` for full decompilation power.
+
+---
+
+## Installation Options
+
+### Option 1: Just the MCP Server (metadata tools only)
+```bash
+pip install mcilspy
+```
+Gives you search and metadata tools immediately.
+
+### Option 2: Full Decompilation Power
+```bash
+# Install the MCP server
+pip install mcilspy
+
+# Let the server install ilspycmd for you (detects your OS automatically)
+# Just ask Claude: "Install ilspycmd" or call install_ilspy with install_dotnet_sdk=true
+```
+
+**Supported platforms for auto-install:**
+- Arch Linux (`pacman`)
+- Ubuntu/Debian (`apt`)
+- Fedora/RHEL (`dnf`)
+- macOS (`homebrew`)
+- Windows (`winget` / `chocolatey`)
+
+### Option 3: Manual ilspycmd Setup
+```bash
+# Install .NET SDK from https://dotnet.microsoft.com/download
+# Then:
+dotnet tool install --global ilspycmd
+```
+
+---
+
+## Table of Contents
+
+- [Quick Start](#quick-start-30-seconds)
+- [What Can You Do?](#what-can-you-do)
+- [Features at a Glance](#features-at-a-glance)
+- [Installation Options](#installation-options)
+- [Tool Reference](#tool-reference)
+ - [Decompilation Tools](#decompilation-tools-requires-ilspycmd)
+ - [Metadata Tools](#metadata-tools-no-ilspycmd-required)
+ - [Installation Tools](#installation--diagnostics)
+- [Configuration](#configuration)
+- [Troubleshooting](#troubleshooting)
+- [License & Acknowledgments](#license)
+
+---
+
+## Tool Reference
+
+### Decompilation Tools (requires ilspycmd)
+
+decompile_assembly — Convert binaries back to C# source
+
+The primary reverse-engineering tool. Decompiles .NET assemblies to readable C#.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `type_name` | No | Specific type to decompile (e.g., `MyNamespace.MyClass`) |
+| `output_dir` | No | Save decompiled files to directory |
+| `create_project` | No | Generate compilable .csproj structure |
+| `language_version` | No | C# version (default: Latest) |
+| `show_il_code` | No | Output IL bytecode instead of C# |
-**Example:**
```json
{
- "name": "decompile_assembly",
- "arguments": {
- "assembly_path": "/path/to/MyAssembly.dll",
- "type_name": "MyNamespace.MyClass",
- "language_version": "CSharp10_0"
- }
+ "assembly_path": "/path/to/MyApp.dll",
+ "type_name": "MyApp.Services.AuthService"
+}
+```
+list_types — Enumerate types in an assembly
+
+Your starting point for exploring unknown assemblies.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `entity_types` | No | Filter: `class`, `interface`, `struct`, `delegate`, `enum` |
+
+```json
+{
+ "assembly_path": "/path/to/MyApp.dll",
+ "entity_types": ["class", "interface"]
+}
+```
+search_types — Find types by name pattern
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `pattern` | Yes | Search pattern |
+| `namespace_filter` | No | Limit to specific namespace |
+| `use_regex` | No | Enable regex matching |
+| `case_sensitive` | No | Case-sensitive search |
+
+```json
+{
+ "assembly_path": "/path/to/MyApp.dll",
+ "pattern": "Controller",
+ "namespace_filter": "MyApp.Web"
+}
+```
+search_strings — Find hardcoded strings (secrets, URLs, config)
+
+Essential for security analysis. Finds strings embedded in IL code.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `pattern` | Yes | String to search for |
+| `use_regex` | No | Enable regex matching |
+| `max_results` | No | Limit results (default: 100) |
+
+```json
+{
+ "assembly_path": "/path/to/MyApp.dll",
+ "pattern": "api\\..*\\.com"
+ "use_regex": true
+}
+```
+generate_diagrammer — Create interactive type relationship diagrams
+
+Generates an HTML visualization of type hierarchies and relationships.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `output_dir` | No | Where to save the HTML |
+| `include_pattern` | No | Regex for types to include |
+| `exclude_pattern` | No | Regex for types to exclude |
+
+get_assembly_info — Get assembly metadata
+
+Returns version, target framework, strong name signing status, and debug info.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+
+search_methods — Find methods by name pattern
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `pattern` | Yes | Method name pattern |
+| `type_filter` | No | Limit to types containing this string |
+| `namespace_filter` | No | Limit to specific namespace |
+| `public_only` | No | Only public methods |
+| `use_regex` | No | Enable regex matching |
+
+```json
+{
+ "assembly_path": "/path/to/MyApp.dll",
+ "pattern": "Handle",
+ "public_only": true
+}
+```
+search_fields — Find fields and constants
+
+Great for finding magic numbers, configuration values, and API keys stored as constants.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `pattern` | Yes | Field name pattern |
+| `constants_only` | No | Only literal/const fields |
+| `public_only` | No | Only public fields |
+
+```json
+{
+ "assembly_path": "/path/to/MyApp.dll",
+ "pattern": "Key|Secret|Password",
+ "use_regex": true,
+ "constants_only": true
+}
+```
+search_properties — Find properties by name
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `pattern` | Yes | Property name pattern |
+| `type_filter` | No | Limit to types containing this string |
+| `namespace_filter` | No | Limit to specific namespace |
+
+list_events — List all events in an assembly
+
+Useful for understanding event-driven architectures and observer patterns.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+| `type_filter` | No | Limit to types containing this string |
+| `namespace_filter` | No | Limit to specific namespace |
+
+list_resources — Find embedded resources
+
+Discovers embedded files, images, localization data, and other resources.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+
+get_metadata_summary — Comprehensive assembly statistics
+
+Returns type/method/field/property/event counts and referenced assemblies.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `assembly_path` | Yes | Path to .dll or .exe |
+
+check_ilspy_installation — Diagnose your setup
+
+Shows whether dotnet CLI and ilspycmd are installed, with version info and troubleshooting tips.
+
+No parameters required.
+install_ilspy — Auto-install everything you need
+
+Detects your platform and installs the .NET SDK and ilspycmd automatically.
+
+| Parameter | Required | Description |
+|-----------|:--------:|-------------|
+| `update` | No | Update ilspycmd to latest version |
+| `install_dotnet_sdk` | No | Also install .NET SDK if missing |
+
+```json
+{
+ "install_dotnet_sdk": true
}
```
-#### 2. `list_types`
-List types in a .NET assembly. Typically the **first tool to use** when analyzing an unknown assembly.
+**Auto-detected package managers:** pacman, apt, dnf, zypper, homebrew, winget, chocolatey
+
+ Built for security researchers, reverse engineers, and curious developers. +