Power your agent
URL ของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
https://android-security-analyzer.ako-labs.workers.dev/mcpปุ่ม Claude ด้านบนจะเปิด Claude พร้อมกรอกชื่อและ URL ให้แล้ว คุณยังต้องยืนยันที่นั่นเอง
claude mcp add --transport http io.github.ako2345-android-security-analyzer https://android-security-analyzer.ako-labs.workers.dev/mcpRun in a terminal.
{ "mcpServers": { "io.github.ako2345-android-security-analyzer": { "command": "npx", "args": [ "-y", "mcp-remote", "https://android-security-analyzer.ako-labs.workers.dev/mcp" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.
Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers:
MCP server for static security analysis of Android source code
All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.
POST /mcp ──► McpServer (JSON-RPC 2.0) ──► Tool Router
│
┌───────────────────────────────┘
▼
Orchestrator
│
┌─────────┼─────────┬─────────────┬──────────────┐
▼ ▼ ▼ ▼ ▼
Manifest Gradle Source Code XML Config Secret
Analyzer Analyzer Analyzer Analyzer Scanner
│ │ │ │ │
└─────────┴─────────┴─────────────┴──────────────┘
│
▼
Scoring + Deduplication ──► AnalysisReport
Key design decisions:
fast-xml-parserzodHosted server (recommended for Cline / MCP clients): no local install needed. The server runs at:
https://android-security-analyzer.ako-labs.workers.dev/mcp
Add this URL to your MCP client configuration (see Connecting from an MCP client below).
Local development:
npm install
npm run dev
This starts a local Wrangler dev server. The MCP endpoint is available at http://localhost:8787/mcp.
npm run deploy
Deploys to Cloudflare Workers. Requires wrangler authentication (npx wrangler login).
npm test # Run all tests
npm run test:watch # Watch mode
npm run typecheck # TypeScript type checking
Unix:
curl -X POST http://localhost:8787/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'
Windows (PowerShell):
(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' -UseBasicParsing).Content
Unix:
curl -X POST http://localhost:8787/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
Windows (PowerShell): ответ приходит в result.tools; чтобы увидеть список как JSON, используйте сырой ответ:
(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' -UseBasicParsing).Content
Либо через объект: (Invoke-RestMethod ...).result.tools | ConvertTo-Json -Depth 5
Unix:
curl -X POST http://localhost:8787/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}'
Windows (PowerShell):
(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}' -UseBasicParsing).Content
Unix:
curl -X POST http://localhost:8787/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 4,
"method": "tools/call",
"params": {
"name": "analyze_android_project",
"arguments": {
"projectName": "TestApp",
"files": [
{
"path": "app/src/main/AndroidManifest.xml",
"content": "<manifest><application android:debuggable=\"true\" android:allowBackup=\"true\"></application></manifest>"
}
]
}
}
}'
Windows (PowerShell):
$body = @{
jsonrpc = "2.0"
id = 4
method = "tools/call"
params = @{
name = "analyze_android_project"
arguments = @{
projectName = "TestApp"
files = @(
@{
path = "app/src/main/AndroidManifest.xml"
content = "<manifest><application android:debuggable=`"true`" android:allowBackup=`"true`"></application></manifest>"
}
)
}
}
} | ConvertTo-Json -Depth 10
(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body $body -UseBasicParsing).Content
Add to your MCP client configuration:
{
"mcpServers": {
"android-security-analyzer": {
"url": "http://localhost:8787/mcp"
}
}
}
For production (hosted):
{
"mcpServers": {
"android-security-analyzer": {
"url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
}
}
}
The analyzer implements 53 security rules across 5 categories:
Each finding includes:
Risk score (0-100) is computed from finding severities:
The raw sum is normalized against an expected maximum of 50 points.
src/
├── index.ts # Worker entry point
├── server/
│ ├── mcp.ts # MCP JSON-RPC 2.0 handler
│ └── tools/ # MCP tool implementations
│ ├── analyzeAndroidProject.ts
│ ├── listAndroidSecurityChecks.ts
│ ├── explainFinding.ts
│ └── health.ts
├── core/
│ ├── types.ts # TypeScript types & Zod schemas
│ ├── scoring.ts # Risk score computation
│ ├── registry.ts # Rule registry
│ └── orchestrator.ts # Analysis orchestrator
├── analyzers/
│ ├── manifestAnalyzer.ts
│ ├── gradleAnalyzer.ts
│ ├── sourceAnalyzer.ts
│ ├── xmlConfigAnalyzer.ts
│ └── secretScanner.ts
├── parsers/
│ ├── xml.ts # XML parser wrapper
│ ├── gradle.ts # Gradle file parser
│ ├── source.ts # Source code pattern matcher
│ └── files.ts # File classifier
├── rules/
│ ├── manifestRules.ts
│ ├── gradleRules.ts
│ ├── sourceRules.ts
│ ├── xmlRules.ts
│ └── secretRules.ts
├── mappings/
│ ├── cwe.ts # CWE descriptions
│ └── owaspMobile.ts # OWASP Mobile Top 10
└── utils/
├── lines.ts # Line number utilities
├── paths.ts # Path classification
└── text.ts # Text utilities
test/
├── fixtures/ # Sample Android project files
├── unit/ # Unit tests per module
└── integration/ # Full analysis integration tests
src/rules/src/analyzers/src/mappings/cwe.ts if neededsrc/core/registry.tsMIT
MCP server for static security analysis of Android source code
{ "mcpServers": { "io.github.ako2345-android-security-analyzer": { "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp", "headers": {} } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก http สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Android Security Analyzer เข้าถึงได้ผ่าน HTTP
ตรวจสอบล่าสุดเมื่อ 2026-11-09 MCP server for static security analysis of Android source code