What are metadata and the manifest in a .NET assembly, and how can you read them without loading the assembly?

How I would answer this in an interview

Metadata is the structured, language-neutral description of everything an assembly defines and references: types, members, signatures, attributes, generic parameters, and references to other assemblies and types. The manifest is the part of the metadata describing the assembly itself: its identity, referenced assemblies, resources and exported types. Both live in tables inside the PE file, and you can read them without loading the assembly for execution using System.Reflection.Metadata or MetadataLoadContext.

1. What metadata contains

Metadata is a set of tables plus heaps:

Heaps store strings (#Strings), user strings (#US for string literals), GUIDs and blobs (signatures, attribute values). Tokens (e.g. 0x06000012 = MethodDef row 0x12) link IL instructions to metadata.

Metadata is what makes .NET self-describing: compilers reference types from it, the CLR builds runtime types from it, reflection reads it, and tools (IntelliSense, decompilers, analysers) rely on it.

2. The manifest

• Identity: name, version, culture, public key.
• References: each AssemblyRef (name, version, culture, public key token) this assembly depends on.
• Resources: embedded resources and their names.
• Exported/forwarded types: [TypeForwardedTo] redirects (used in reference assemblies and refactorings).
• Assembly-level attributes: [assembly: InternalsVisibleTo], TargetFramework, version attributes, etc. (stored as custom attributes on the assembly).

3. Reading metadata without loading the assembly

Loading an assembly via reflection (Assembly.LoadFrom) executes nothing by itself but binds it into a load context, may lock the file, resolves dependencies, can't be unloaded easily, and may fail for assemblies targeting other frameworks. For tooling, inspect metadata directly:

System.Reflection.Metadata (low-level, fast, no loading):

using var stream = File.OpenRead(path);
using var pe = new PEReader(stream);
var md = pe.GetMetadataReader();

var def = md.GetAssemblyDefinition();
Console.WriteLine($"{md.GetString(def.Name)} {def.Version}");

foreach (var refHandle in md.AssemblyReferences)
{
    var r = md.GetAssemblyReference(refHandle);
    Console.WriteLine($"  -> {md.GetString(r.Name)} {r.Version}");
}

foreach (var typeHandle in md.TypeDefinitions)
{
    var t = md.GetTypeDefinition(typeHandle);
    Console.WriteLine($"{md.GetString(t.Namespace)}.{md.GetString(t.Name)}");
}

MetadataLoadContext (System.Reflection.MetadataLoadContext package) — reflection-like API (Type, MethodInfo, GetCustomAttributesData) over assemblies loaded for inspection only, with a resolver you control:

var resolver = new PathAssemblyResolver(Directory.GetFiles(RuntimeEnvironment.GetRuntimeDirectory(), "*.dll").Append(path));
using var mlc = new MetadataLoadContext(resolver);
var asm = mlc.LoadFromAssemblyPath(path);
foreach (var type in asm.GetTypes().Where(t => t.GetCustomAttributesData().Any(a => a.AttributeType.Name == "PluginAttribute")))
    Console.WriteLine(type.FullName);

You can't execute code or create instances from MetadataLoadContext types, which is exactly what makes it safe for scanning.

Other tools: AssemblyName.GetAssemblyName(path) (identity only), ILSpy/dnSpy/monodis, ildasm, Roslyn reading references, dotnet-symbol.

4. Use cases

• Plugin discovery: find types implementing an interface or marked with an attribute without loading untrusted plugins into the host.
• Build tools/CI checks: list dependencies and versions, detect forbidden references, verify public API.
• License/SBOM tools: inventory assemblies and versions.
• Analysers and generators: Roslyn reads referenced assemblies' metadata.
• Diagnosing load errors: check the exact AssemblyRef versions an assembly expects.

5. A production example

A plugin platform scanned a folder at start-up with Assembly.LoadFrom to find plugin types. A malformed or framework-mismatched DLL crashed start-up, and files stayed locked so plugins couldn't be updated without restarting. We replaced scanning with MetadataLoadContext to read attributes and referenced versions (rejecting incompatible plugins with clear errors), and only then loaded valid plugins into collectible AssemblyLoadContexts. Start-up became robust and plugin updates no longer needed host restarts.