SkillFoxx

DexSQL MCP

DexSQL gives an agent SQL over APK and DEX files: classes, methods, strings, call references and smali through built-in MCP.

  • 302 ★ on the repository
  • Last commit
MCP serverOfficial

Extended access

Why this level

  • Installation downloads and runs a binary from GitHub releases.
  • Content of the analyzed app, including strings and code, goes into the model context.
All reasons and checks

lsposed/dexsql-releaseAuthor:LSPosed

Install

Manual install

npx skills add LSPosed/dexsql-release --skill install-dexsql

Installs the skill that downloads a binary from releases, verifies SHA-256 and adds the MCP configuration.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • Installation downloads and runs a binary from GitHub releases.
  • Content of the analyzed app, including strings and code, goes into the model context.

This is third-party code. Review the repository files before installing.

What it does

DexSQL reads DEX files directly and answers SQL queries about classes, methods, strings and call references in APK and DEX files. An agent combines signatures, strings and call relationships in one query and gets only the structured results it needs. The built-in MCP server connects the tool to agents with no GUI: `dexsql mcp` over stdio. The schema and documentation are served as MCP resources. The `install-dexsql` skill sets it up: `npx skills add LSPosed/dexsql-release --skill install-dexsql`. It downloads a matching binary from releases, verifies its SHA-256 checksum, adds the MCP configuration and checks the connection. Manually use `codex mcp add dexsql -- /absolute/path/dexsql mcp`. APK parsing runs locally and leaves the input file unchanged.

Who it is for. Android security researchers and developers who analyze their own or audited APKs and want an agent to search app code.

Good fit when

  • An agent finds methods that reference a log message and lists their callers.
  • Smali and two-hop call relationships are shown for a found method.
  • A query is refined and saved in a script to repeat on the next APK version.
  • A large APK is opened once and several questions are answered in a row.

Not a fit when

  • A GUI decompiler with code navigation is needed: DexSQL answers SQL queries.
  • The app cannot be examined under the law or license terms: analyzing a third-party APK may be forbidden.
  • Dynamic analysis of a running app is needed: DexSQL reads static files.

Example request

Open `/path/to/app.apk`, find methods that reference this log message, list their callers and show the smali.

MCP

Transport
stdio
Authentication
not required

Limitations

The tool works with static APK and DEX files: it does not run the app and does not replace dynamic analysis. The installer skill downloads a binary from releases and checks SHA-256, so compare the version it installs with the one you expect. Keep `LICENSE` and `LICENSE-AUXILIARY` from the same release next to the executable. The AI client settings decide which results go to the model. Analyzing someone else app is subject to law and the app license, and responsibility is yours.

How to disable. Remove the `dexsql` entry from the client settings along with the downloaded binary and license files. Opened APKs stay unchanged.

FAQ

How do I install it?

Run `npx skills add LSPosed/dexsql-release --skill install-dexsql` and ask the agent to use the `install-dexsql` skill. In Codex invoke it as `$install-dexsql`.

How do I connect it manually?

Download the executable from releases and run `codex mcp add dexsql -- /absolute/path/dexsql mcp`. In JSON set `command` and `args` to `["mcp"]`.

What can I ask?

Classes, methods, strings and call references in APK and DEX files, plus smali. The server serves the schema and documentation as MCP resources.

Does the tool change the APK?

No, parsing runs locally and the input file stays unchanged.

Is there a command line?

Yes, DexSQL also works from the command line without MCP. Speed comparisons with other tools are in the `benchmarks` directory.

Discussion

No questions or reviews yet.

MCP servers

An MCP server built on jadx-core analyses APKs without the JADX GUI: 26 tools for classes, smali, manifest and cross-references.

MCP serverBroad access169

JADX MCP Server

JADX-MCP-SERVER

MCP server for analyzing Android apps through JADX: the agent reads decompiled code, the manifest and hunts for vulnerabilities

MCP serverExtended access842

An MCP server on top of apktool: the agent decodes APKs, reads the manifest and smali, searches the code and patches it for Android reverse engineering

MCP serverBroad access709

A JADX plugin and MCP server: the agent explores decompiled Android app code, finds vulnerabilities and helps with reverse engineering

MCP serverBroad access3K

RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.

MCP serverBroad access179

Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.

MCP serverExtended access123

README in short

The README explains why SQL over DEX is useful, how to connect via the registry, the skill and manually and shows speed measurements on large apps.

README badge

Report a problem