jadx-ai-mcp MCP工具

4. This project uses uv - https://github.com/astral-sh/uv instead of pip for dependency management.

## a. Install uv (if you dont have it yet) curl -LsSf https://astral.sh/uv/install.sh | sh ## b. OPTIONAL, if for any reasons, you get dependecy errors in jadx-mcp-server, Set up the environment uv venv source .venv/bin/activate # or .venv\Scripts\activate on Windows ## c. OPTIONAL Install dependencies uv pip install httpx fastmcp

Dependencies

This project uses following awesome libraries.

• Plugin - Java
• Javalin - https://javalin.io/ - Apache 2.0 License
• SLF4J - https://slf4j.org/ - MIT License
• org.w3c.dom - https://mvnrepository.com/artifact/org.w3c.dom - W3C Software and Document License

• MCP Server - Python
• FastMCP - https://github.com/jlowin/fastmcp - Apache 2.0 License
• httpx - https://www.python-httpx.org - BSD-3-Clause (“BSD licensed”)

🛠️ Getting Started

2. Install the plugin

The above one line code will install the latest version of the plugin directly into the jadx, no need to download the jadx-ai-mcp's .jar file.

2. Or you can use JADX-GUI to install it by following images as shown below:

<div align="center">
    <img alt="banner" height="480px" widht="620px" src="docs/assets/img_1231.png">
</div>

<div align="center">
    <img alt="banner" height="480px" widht="620px" src="docs/assets/img_1123.png">
</div>

<div align="center">
    <img alt="banner" height="480px" widht="620px" src="docs/assets/img_2122.png">
</div>

The setup for jadx-ai-mcp and jadx_mcp_server is done.

```

Usage Examples

Scenario 1 — Everything on the same machine (most common): ```bash

Usage Examples

Scenario 1 — Everything on the same machine (most common): ```bash

Watch the demos!

- Perform quick analysis https://github.com/user-attachments/assets/b65c3041-fde3-4803-8d99-45ca77dbe30a

• Quickly find vulnerabilities

https://github.com/user-attachments/assets/c184afae-3713-4bc0-a1d0-546c1f4eb57f

• Multiple AI Agents Support

https://github.com/user-attachments/assets/6342ea0f-fa8f-44e6-9b3a-4ceb8919a5b0

• Run with your favorite LLM Client

https://github.com/user-attachments/assets/b4a6b280-5aa9-4e76-ac72-a0abec73b809

• Analyze The APK Resources

https://github.com/user-attachments/assets/f42d8072-0e3e-4f03-93ea-121af4e66eb1

• Your AI Assistant during debugging of APK using JADX

https://github.com/user-attachments/assets/2b0bd9b1-95c1-4f32-9b0c-38b864dd6aec

It is combination of two tools: 1. JADX-AI-MCP 2. JADX MCP SERVER

🗒️ Sample Prompts

🔍 Basic Code Understanding

"Explain what this class does in one paragraph."

"Summarize the responsibilities of this method."

"Is there any obfuscation in this class?"

"List all Android permissions this class might require."

🛡️ Vulnerability Detection

"Are there any insecure API usages in this method?"

"Check this class for hardcoded secrets or credentials."

"Does this method sanitize user input before using it?"

"What security vulnerabilities might be introduced by this code?"

🛠️ Reverse Engineering Helpers

"Deobfuscate and rename the classes and methods to something readable."

"Can you infer the original purpose of this smali method?"

"What libraries or SDKs does this class appear to be part of?"

"Tell me which classes contains code related to 'encryption'?"

📦 Static Analysis

"List all network-related API calls in this class."

"Identify file I/O operations and their potential risks."

"Does this method leak device info or PII?"

🤖 AI Code Modification

"Refactor this method to improve readability."

"Add comments to this code explaining each step."

"Rewrite this Java method in Python for analysis."

📄 Documentation & Metadata

"Generate Javadoc-style comments for all methods."

"What package or app component does this class likely belong to?"

"Can you identify the Android component type (Activity, Service, etc.)?"

🐞 Debugger Assistant

   "Fetch stack frames, varirables and threads from debugger and provide summary"

   "Based the stack frames from debugger, explain the execution flow of the application"

   "Based on the state of variables, is there security threat?"

---

Advanced CLI Options — Understanding the Flags

There are two separate connections and each has its own host/port:

┌─────────────┐    --host / --port     ┌──────────────────┐   --jadx-host / --jadx-port   ┌──────────────────┐
│  LLM Client │ ◄──────────────────►   │  jadx-mcp-server │ ──────────────────────────►   │  JADX-GUI Plugin │
│  (Claude,   │   Where the MCP server │                  │   Where the MCP server looks  │  (jadx-ai-mcp)   │
│   Codex..)  │   LISTENS for clients  │                  │   for the JADX plugin         │                  │
└─────────────┘                        └──────────────────┘                               └──────────────────┘

6. Custom port and host configuration for JADX AI MCP Plugin

<img width="800" height="335" alt="image" src="https://github.com/user-attachments/assets/6243adc5-5be4-4e2d-aa16-bdaf78a28e36" />

1. Configure Port: Configure the port on which the JADX AI MCP Plugin will listen on.
2. Default Port: Revert back the changes and listen on default port.
3. Restart Server: Force restart the JADX AI MCP Plugin server.
4. Server Status: Check the status of JADX AI MCP Plugin server.

To connect with JADX AI MCP Plugin running on custom port, the --jadx-port option will be used as shown in following:

uv run jadx_mcp_server.py --jadx-port 8652

If the JADX AI MCP Plugin is running on a different machine (e.g., JADX on a remote VM, MCP server on your local host), use the --jadx-host option: ```bash

MCP server listens on ALL interfaces so the host can reach it

MCP server listens on all interfaces on port 9999

CLI Reference — Understanding the Flags

There are two separate connections and each has its own host/port:

┌─────────────┐    --host / --port     ┌──────────────────┐   --jadx-host / --jadx-port   ┌──────────────────┐
│  LLM Client │ ◄──────────────────►   │  jadx-mcp-server │ ──────────────────────────►   │  JADX-GUI Plugin │
│  (Claude,   │   Where the MCP server │                  │   Where the MCP server looks  │  (jadx-ai-mcp)   │
│   Codex..)  │   LISTENS for clients  │                  │   for the JADX plugin         │                  │
└─────────────┘                        └──────────────────┘                               └──────────────────┘

MCP server listens on ALL interfaces so the host can reach it

MCP server listens on all interfaces on port 9999

Default: MCP server on localhost:8651, connects to JADX plugin on localhost:8650

uv run jadx_mcp_server.py --http

**Scenario 2 — Docker container or WSL (MCP server accessible from host network):**

JADX plugin is still on the same machine

uv run jadx_mcp_server.py --http --host 0.0.0.0

**Scenario 3 — JADX-GUI running on a different machine (e.g., remote VM):**

MCP server runs locally, but connects to JADX plugin on a remote machine

uv run jadx_mcp_server.py --http --jadx-host 192.168.1.100

**Scenario 4 — Full remote setup (everything on different machines):**

JADX plugin is on a different machine at 192.168.1.100:8652

uv run jadx_mcp_server.py --http --host 0.0.0.0 --port 9999 --jadx-host 192.168.1.100 --jadx-port 8652 ```

[!CAUTION] ### ⚠️ Security Warning — Remote Binding When using --host 0.0.0.0 (or any non-localhost address), the MCP server binds to all network interfaces over plain HTTP with no authentication. This means: - Anyone on the network can connect and invoke all MCP tools - There is no TLS encryption — traffic can be intercepted - An attacker can use the server to read decompiled code, rename classes/methods, and access debug info Mitigations: - Only bind to 0.0.0.0 on trusted, isolated networks (e.g., Docker bridge, local VM) - Use a firewall to restrict access to the MCP port - Consider an SSH tunnel instead: ssh -L 8651:127.0.0.1:8651 remote-host

Connect to JADX plugin on a remote host

uv run jadx_mcp_server.py --jadx-host 192.168.1.100 --jadx-port 8650 ```

Default: MCP server on localhost:8651, connects to JADX plugin on localhost:8650

uv run jadx_mcp_server.py --http

**Scenario 2 — Docker container or WSL (MCP server accessible from host network):**

JADX plugin is still on the same machine

uv run jadx_mcp_server.py --http --host 0.0.0.0

**Scenario 3 — JADX-GUI running on a different machine (e.g., remote VM):**

MCP server runs locally, but connects to JADX plugin on a remote machine

uv run jadx_mcp_server.py --http --jadx-host 192.168.1.100

**Scenario 4 — Full remote setup (everything on different machines):**

JADX plugin is on a different machine at 192.168.1.100:8652

uv run jadx_mcp_server.py --http --host 0.0.0.0 --port 9999 --jadx-host 192.168.1.100 --jadx-port 8652

The MCP Configuration for custom jadx port will be as follows for claude:

Troubleshooting

Check here

To report bugs, issues, feature suggestion, Performance issue, general question, Documentation issue.

• Kindly open an issue with respective template.

• Tested on Claude Desktop Client, support for other AI will be tested soon!