JADX MCP Server
JADX-MCP-SERVER
MCP server for analyzing Android apps through JADX: the agent reads decompiled code, the manifest and hunts for vulnerabilities
- 843 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Reads decompiled code and debug info
- Can expose tools over the network without authentication
Install
- Works in
Manual install
uv run jadx_mcp_server.py --httpRequires JADX-GUI with the JADX-AI-MCP plugin on localhost:8650. Needs Java 11+ and Python 3.10+.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads decompiled code and debug info
- Can expose tools over the network without authentication
This is third-party code. Review the repository files before installing.
What it does
JADX MCP Server connects an AI agent to the JADX-AI-MCP plugin inside JADX-GUI and exposes tools for dissecting Android apps. Through it the agent reads decompiled Java code, parses the AndroidManifest, renames classes and methods and reaches debug info. The server runs on Python (uv or pip) and talks to the plugin over a separate host and port, with stdio and HTTP transports. It is part of Zin's Reverse Engineering MCP Suite and is meant for local APK analysis.
Who it is for. For mobile app security specialists and developers who take APKs apart.
Good fit when
- You need to dissect an APK and find vulnerabilities with an agent
- You need to read an app's decompiled code and manifest
- You need to rename classes and methods in JADX through an agent
Not a fit when
- You do not have JADX-GUI with the JADX-AI-MCP plugin
- You need to analyze a platform other than Android
Example request
Analyze this APK in JADX and find potential vulnerabilities in the manifest and exported componentsMCP
- Transport
- stdio, http
- Authentication
- not required
Limitations
It works in tandem with JADX-GUI and the JADX-AI-MCP plugin; without them the server is useless. It needs Java 11+ and Python 3.10+. Binding to 0.0.0.0 exposes the tools over the network without auth or encryption, and the README advises doing so only on trusted networks or through an SSH tunnel.
How to disable. Stop the jadx_mcp_server process and remove the MCP entry from the agent config; the JADX-GUI plugin can be disabled separately.
FAQ
What else is needed besides the server?
JADX-GUI with the JADX-AI-MCP plugin. The server reaches the plugin over its own host and port, localhost:8650 by default.
Can it run on another machine?
Yes, there are host, port, jadx-host and jadx-port flags and an HTTP mode, but open binding without auth is unsafe.
Discussion
No questions or reviews yet.
Related
MCP serversA JADX plugin and MCP server: the agent explores decompiled Android app code, finds vulnerabilities and helps with reverse engineering
An MCP server built on jadx-core analyses APKs without the JADX GUI: 26 tools for classes, smali, manifest and cross-references.
An MCP server on top of apktool: the agent decodes APKs, reads the manifest and smali, searches the code and patches it for Android reverse engineering
A native MCP plugin for the x64dbg debugger: the agent drives debugging over HTTP, sets breakpoints, steps through code, reads and patches memory
MCP server that bridges IDA Pro with an agent: reading decompilation, renaming and typing, comments and running IDAPython right in the database
DexSQL gives an agent SQL over APK and DEX files: classes, methods, strings, call references and smali through built-in MCP.
README in short
The README presents JADX MCP Server as part of a reverse-engineering suite that automates the agent's link to the JADX-AI-MCP plugin. It shows two connections, client to server and server to the JADX plugin, with separate hosts, ports and tuning flags. It walks scenarios for one machine, Docker or WSL and a remote machine. The README warns separately about the risks of binding to 0.0.0.0 without TLS or auth and suggests a firewall or SSH tunnel.