zinja-coder/jadx-mcp-server

What it solves

It simplifies the reverse engineering of Android APKs by allowing Large Language Models (LLMs) to interact directly with the decompiled code and context of a live JADX session. This eliminates the need to manually copy-paste code into an AI for analysis, vulnerability hunting, or deobfuscation.

How it works

The project consists of two parts: a Python-based MCP server and a JADX-AI-MCP plugin. The MCP server acts as a bridge using the Model Context Protocol (MCP), translating requests from an LLM client (like Claude Desktop) into HTTP requests that the JADX-AI-MCP plugin handles within the JADX-GUI. This allows the LLM to perform actions and gather data directly from the decompiler in real-time.

Who it’s for

It is designed for security researchers, reverse engineers, and developers who analyze Android applications to find vulnerabilities, understand app logic, or perform ethical security assessments.

Highlights

• Live Context Access: LLMs can fetch current classes, selected text, and full source code directly from the active JADX session.
• Comprehensive Toolset: Includes tools for searching methods/classes, retrieving AndroidManifest.xml, accessing resource files, and fetching debugger stack frames and variables.
• AI-Driven Modification: Supports renaming variables within methods to help deobfuscate code via AI recommendations.
• Deep APK Analysis: Provides specialized tools to identify main activity classes and application code based on package names.
• Cross-Machine Support: Can be configured to run the MCP server and JADX-GUI on different machines via configurable host and port flags.