JADX-AI-MCP
A JADX plugin and MCP server: the agent explores decompiled Android app code, finds vulnerabilities and helps with reverse engineering
- 3,007 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Reverse engineering and security analysis are only allowed for permitted apps
- Gives the agent access to the analyzed APK's decompiled code
Install
- Works in
Manual install
Install the JADX-AI-MCP plugin into JADX per the README, run the companion jadx-mcp-server and connect it to your MCP client. Building needs Java 11+ and Python 3.10+.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Reverse engineering and security analysis are only allowed for permitted apps
- Gives the agent access to the analyzed APK's decompiled code
This is third-party code. Review the repository files before installing.
What it does
JADX-AI-MCP bridges the Android decompiler JADX with an LLM through MCP. The plugin is added to JADX, and a companion MCP server lets the agent work with the decompiled code of an APK opened in JADX: read classes and methods, look for vulnerabilities, explain logic and drive the app analysis. The project is part of the Zin MCP Suite and targets mobile application security analysis and reverse engineering. The client can be Claude or another MCP-compatible tool.
Who it is for. For mobile security professionals and reverse engineers who analyze Android apps they are authorized to inspect.
Good fit when
- You want the agent to explore an APK's decompiled code
- You want to find vulnerabilities in an Android app under authorized analysis
- You want explanations of class and method logic from JADX
Not a fit when
- You are not authorized to analyze the app or its code
- You need analysis of a non-Android platform
Example request
Open this APK in JADX and find where the app stores secrets, explain the logicMCP
- Transport
- stdio
- Authentication
- not required
Limitations
You need JADX installed with the plugin added and the MCP server running; building and running need Java 11 or newer and Python 3.10 or newer. The tool analyzes decompiled code rather than running the app. Reverse engineering and security analysis are only allowed for apps you are permitted to inspect.
How to disable. Remove the MCP server entry from the client config, stop the server and remove the JADX-AI-MCP plugin from JADX.
FAQ
What is needed besides the plugin?
JADX installed and the MCP server running, which links the project open in JADX to your MCP client.
Does it run the app?
No. The tool works with decompiled code in JADX rather than executing the app itself.
Discussion
No questions or reviews yet.
Related
MCP serversJADX MCP Server
JADX-MCP-SERVER
MCP server for analyzing Android apps through JADX: the agent reads decompiled code, the manifest and hunts for vulnerabilities
An MCP server built on jadx-core analyses APKs without the JADX GUI: 26 tools for classes, smali, manifest and cross-references.
An MCP server on top of apktool: the agent decodes APKs, reads the manifest and smali, searches the code and patches it for Android reverse engineering
A native MCP plugin for the x64dbg debugger: the agent drives debugging over HTTP, sets breakpoints, steps through code, reads and patches memory
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
README in short
The README describes JADX-AI-MCP as a plugin for the Android decompiler JADX and an MCP server that together let an LLM such as Claude analyze APKs: find vulnerabilities, explore and reverse engineer code. The project is part of the Zin MCP Suite and works together with a companion jadx-mcp-server. Building and running need Java 11 or newer and Python 3.10 or newer. Its purpose is mobile application security analysis and reverse engineering. Apache-2.0 licensed.