zinja-coder/jadx-mcp-server

What is JADX‑MCP‑SERVER?

JADX‑MCP‑SERVER is a small Python service that sits between a local LLM (e.g., Claude Desktop) and the JADX decompiler GUI. It implements the Model Context Protocol (MCP) – a simple request/response protocol that lets an LLM ask a decompiler for information about an Android APK and even tell the decompiler to make changes (rename a variable, add a comment, etc.).

The server talks to a companion plugin called JADX‑AI‑MCP (installed inside the JADX GUI). The plugin receives HTTP calls from the server, runs the requested operation inside JADX, and returns the result. From the LLM’s point of view the whole chain looks like a set of tools it can call via OpenAI‑style function‑calling.

Core Features (as described in the README)

Feature	What it does
Live decompilation access	Retrieve the source of the currently selected class, any class by name, a method, smali, AndroidManifest, resources, etc.
Search utilities	Find classes, methods or fields by keyword, list all classes, list methods of a class, paginate results.
Code‑editing helpers	Rename variables, add or remove comments that appear in the JADX GUI and are saved with the project.
Debug integration	Pull stack frames, threads and variable values from the JADX debugger.
Cross‑reference queries	Get X‑refs for classes, methods or fields (who calls what).
LLM‑friendly output	Options such as `slim=True` strip Kotlin metadata to keep payloads small; line‑number flags help the model refer to exact lines.
OpenAI‑compatible client	A sample `examples/openai_compatible_client.py` converts the MCP tool list into OpenAI function‑calling schema, so any model that speaks the OpenAI chat API can use the server.
Configurable networking	Host/port for the MCP server (`--host`, `--port`) and for the JADX plugin (`--jadx-host`, `--jadx-port`). Supports plain HTTP (`--http`) for easy local testing.
Security warning	The README explicitly warns that exposing the server on `0.0.0.0` gives unauthenticated network access to all tools.

How it works – high‑level flow

LLM client (Claude, Ollama, OpenAI, etc.) sends a request to the MCP server using the Model Context Protocol.
The server forwards the request as an HTTP call to the JADX‑AI‑MCP plugin running inside the JADX GUI.
The plugin executes the requested operation (e.g., fetch_current_class, rename_variable).
Results are sent back to the server, which formats them as a tool response and returns them to the LLM.
The LLM can then decide to ask another tool, modify code, or produce a final answer.

Getting Started (quick steps)

# 1. Install the Python dependencies with uv (or pip)
uv sync   # or: pip install -r requirements.txt

# 2. Run the server (default ports 8651 → LLM, 8650 → JADX plugin)
uv run jadx_mcp_server.py --http

If the JADX GUI with the JADX‑AI‑MCP plugin is on the same machine, no extra flags are needed.

To expose the server to other machines (e.g., Docker, WSL) use:

uv run jadx_mcp_server.py --http --host 0.0.0.0

⚠️ The README stresses that this opens the server to anyone on the network; use firewalls or SSH tunnels.

Example usage with an OpenAI‑compatible model

pip install -r examples/requirements.txt   # install openai SDK

# Simple one‑shot query
OPENAI_API_KEY=sk-... python examples/openai_compatible_client.py \
    --prompt "What permissions does com.example.app need?"

The client converts the prompt into a series of MCP tool calls, fetches the AndroidManifest via the server, and returns a concise answer.

Who might find this useful?

Security researchers who want to automate vulnerability hunting in APKs using LLMs.
Reverse‑engineering hobbyists looking for a “chat‑with‑the‑decompiler” experience.
Tool builders who need a programmatic bridge between LLMs and existing Android analysis tools.

Roadmap (as listed)

Add support for apktool (already done).
Add Hermes (React‑Native) code handling.
Docker packaging.
More MCP tools and prompt templates.
Full local‑LLM client.
Ultimate goal: a single MCP server that can drive any Android RE tool.

Verdict

The repository is a genuine software project that builds a bridge between large language models and Android reverse‑engineering tools. It is squarely in the AI‑augmented tooling space, so off_topic = false.

All information above is taken directly from the README; no external assumptions have been added.