Plugin for JADX to integrate MCP server
<div align="center">
# JADX-AI-MCP (Part of Zin MCP Suite)
⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly.
![GitHub contributors JADX-AI-MCP](https://img.shields.io/github/contributors/zinja-coder/
Retrieve specific manifest component instead of whole manifest file
FAQ
Questions
How do I install Jadx Ai?
Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Jadx Ai need an API key?
No required environment variable is listed on this record.
What transport does Jadx Ai use?
Jadx Ai runs locally over stdio.
When was Jadx Ai last checked?
Last checked 2026-11-08. Plugin for JADX to integrate MCP server
<div align="center">
# JADX-AI-MCP (Part of Zin MCP Suite)
⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly.
⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly.
⭐ Contributors
Thanks to these wonderful people for their contributions ⭐
JADX-AI-MCP is a plugin for the JADX decompiler that integrates directly with Model Context Protocol (MCP) to provide live reverse engineering support with LLMs like Claude.
Think: "Decompile → Context-Aware Code Review → AI Recommendations" — all in real time.
High Level Sequence Diagram
sequenceDiagram
LLM CLIENT->>JADX MCP SERVER: INVOKE MCP TOOL
JADX MCP SERVER->>JADX AI MCP PLUGIN: INVOKE HTTP REQUEST
JADX AI MCP PLUGIN->>REQUEST HANDLERS: INVOKE HTTP REQUEST HANDLER
REQUEST HANDLERS->>JADX GUI: PERFORM ACTION/GATHER DATA
JADX GUI->>REQUEST HANDLERS: ACTION PERFORMED/DATA GATHERED
REQUEST HANDLERS->>JADX AI MCP PLUGIN: CRAFT HTTP RESPONSE
JADX AI MCP PLUGIN->>JADX MCP SERVER:HTTP RESPONSE
JADX MCP SERVER->>LLM CLIENT: MCP TOOL RESULT
Key features
01. Plugin for JADX to integrate MCP server
02. <div align="center">
03. # JADX-AI-MCP (Part of Zin MCP Suite)
04. ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly
JADX MCP Server is a standalone Python server that interacts with a JADX-AI-MCP plugin (see: jadx-ai-mcp) via MCP (Model Context Protocol). It lets LLMs communicate with the decompiled Android app context live.
rename_variable() : Renames the variable within a method
add_comment() : Adds a comment to a class, method, field, or a single code line (line=, the 1-based line number of the decompiled source), shown in JADX-GUI and saved with the project (re-commenting the same target updates it, an empty comment removes it)
list_comments() : Lists the comments stored in the project, optionally filtered to one class
debug_get_stack_frames() : Get the stack frames from jadx debugger
debug_get_threads() : Get the insights of threads from jadx debugger
debug_get_variables() : Get the variables from jadx debugger
xrefs_to_class() : Find all references to a class (returns method-level and class-level references, supports pagination)
xrefs_to_method() : Find all references to a method (includes override-related methods, supports pagination)
xrefs_to_field() : Find all references to a field (returns methods that access the field, supports pagination)
🗒️ Sample Prompts
🔍 Basic Code Understanding
"Explain what this class does in one paragraph."
"Summarize the responsibilities of this method."
"Is there any obfuscation in this class?"
"List all Android permissions this class might require."
🛡️ Vulnerability Detection
"Are there any insecure API usages in this method?"
"Check this class for hardcoded secrets or credentials."
"Does this method sanitize user input before using it?"
"What security vulnerabilities might be introduced by this code?"
🛠️ Reverse Engineering Helpers
"Deobfuscate and rename the classes and methods to something readable."
"Can you infer the original purpose of this smali method?"
"What libraries or SDKs does this class appear to be part of?"
"Tell me which classes contains code related to 'encryption'?"
📦 Static Analysis
"List all network-related API calls in this class."
"Identify file I/O operations and their potential risks."
"Does this method leak device info or PII?"
🤖 AI Code Modification
"Refactor this method to improve readability."
"Add comments to this code explaining each step."
"Rewrite this Java method in Python for analysis."
📄 Documentation & Metadata
"Generate Javadoc-style comments for all methods."
"What package or app component does this class likely belong to?"
"Can you identify the Android component type (Activity, Service, etc.)?"
🐞 Debugger Assistant
"Fetch stack frames, varirables and threads from debugger and provide summary"
"Based the stack frames from debugger, explain the execution flow of the application"
"Based on the state of variables, is there security threat?"
Download both jadx-ai-mcp-<version>.jar and jadx-mcp-server-<version>.zip files.
# 0. Download the jadx-ai-mcp-<version>.jar and jadx-mcp-server-<version>.zip
https://github.com/zinja-coder/jadx-ai-mcp/releases
# 1.
unzip jadx-mcp-server-<version>.zip
├jadx-mcp-server/
├── jadx_mcp_server.py
├── requirements.txt
├── README.md
├── LICENSE
├── src/
├── static/
├── examples/
└── test.sh
├jadx-ai-mcp-<version>.jar
# 2. Install the plugin
# For this you can follow two approaches:
## 1. One liner - execute below command in your shell
jadx plugins --install "github:zinja-coder:jadx-ai-mcp"
## The above one line code will install the latest version of the plugin directly into the jadx, no need to download the jadx-ai-mcp's .jar file.
## 2. Or you can use JADX-GUI to install it by following images as shown below:
## 3. GUI method, download the .jar file and follow below steps shown in images
# 3. Navigate to jadx-mcp-server directory
cd jadx-mcp-server
# 4. This project uses uv - https://github.com/astral-sh/uv instead of pip for dependency management.
## a. Install uv (if you dont have it yet)
curl -LsSf https://astral.sh/uv/install.sh | sh
## b. OPTIONAL, if for any reasons, you get dependecy errors in jadx-mcp-server, Set up the environment
uv venv
source .venv/bin/activate # or .venv\Scripts\activate on Windows
## c. OPTIONAL Install dependencies
uv pip install httpx fastmcp
# The setup for jadx-ai-mcp and jadx_mcp_server is done.
🤖 2. Use Claude Desktop
Make sure Claude Desktop is running with MCP enabled.
You can also use Jadx in HTTP Stream Mode using --http option with jadx_mcp_server.py as shown in following:
uv run jadx_mcp_server.py --http
OR
uv run jadx_mcp_server.py --http --port 9999
Advanced CLI Options — Understanding the Flags
There are two separate connections and each has its own host/port:
┌─────────────┐ --host / --port ┌──────────────────┐ --jadx-host / --jadx-port ┌──────────────────┐
│ LLM Client │ ◄──────────────────► │ jadx-mcp-server │ ──────────────────────────► │ JADX-GUI Plugin │
│ (Claude, │ Where the MCP server │ │ Where the MCP server looks │ (jadx-ai-mcp) │
│ Codex..) │ LISTENS for clients │ │ for the JADX plugin │ │
└─────────────┘ └──────────────────┘ └──────────────────┘
Flag
Default
Controls
--http
off
Use HTTP transport instead of stdio
--host
127.0.0.1
Where the MCP server listens (bind address for LLM clients)
--port
8651
Which port the MCP server listens on
--jadx-host
127.0.0.1
Where to find the JADX plugin (the target JADX-GUI machine)
--jadx-port
8650
Which port the JADX plugin is on
Usage Examples
Scenario 1 — Everything on the same machine (most common):
# Default: MCP server on localhost:8651, connects to JADX plugin on localhost:8650
uv run jadx_mcp_server.py --http
Scenario 2 — Docker container or WSL (MCP server accessible from host network):
# MCP server listens on ALL interfaces so the host can reach it
# JADX plugin is still on the same machine
uv run jadx_mcp_server.py --http --host 0.0.0.0
Scenario 3 — JADX-GUI running on a different machine (e.g., remote VM):
# MCP server runs locally, but connects to JADX plugin on a remote machine
uv run jadx_mcp_server.py --http --jadx-host 192.168.1.100
Scenario 4 — Full remote setup (everything on different machines):
# MCP server listens on all interfaces on port 9999
# JADX plugin is on a different machine at 192.168.1.100:8652
uv run jadx_mcp_server.py --http --host 0.0.0.0 --port 9999 --jadx-host 192.168.1.100 --jadx-port 8652
[!CAUTION]
⚠️ Security Warning — Remote Binding
When using --host 0.0.0.0 (or any non-localhost address), the MCP server binds to all network interfaces over plain HTTP with no authentication. This means:
Anyone on the network can connect and invoke all MCP tools
There is no TLS encryption — traffic can be intercepted
An attacker can use the server to read decompiled code, rename classes/methods, and access debug info
Mitigations:
Only bind to 0.0.0.0 on trusted, isolated networks (e.g., Docker bridge, local VM)
Use a firewall to restrict access to the MCP port
Consider an SSH tunnel instead: ssh -L 8651:127.0.0.1:8651 remote-host
Stdio Mode Compatibility
[!NOTE]
When running in stdio mode (the default, without --http), all human-readable output (banner, health check) is written to stderr to keep stdout reserved for the MCP JSON-RPC stream. This ensures compatibility with Codex, Claude Desktop, and other stdio-based MCP clients.
6. Custom port and host configuration for JADX AI MCP Plugin
Configure Port: Configure the port on which the JADX AI MCP Plugin will listen on.
Default Port: Revert back the changes and listen on default port.
Restart Server: Force restart the JADX AI MCP Plugin server.
Server Status: Check the status of JADX AI MCP Plugin server.
To connect with JADX AI MCP Plugin running on custom port, the --jadx-port option will be used as shown in following:
uv run jadx_mcp_server.py --jadx-port 8652
If the JADX AI MCP Plugin is running on a different machine (e.g., JADX on a remote VM, MCP server on your local host), use the --jadx-host option:
# Connect to JADX plugin on a remote host
uv run jadx_mcp_server.py --jadx-host 192.168.1.100 --jadx-port 8650
CLI Reference — Understanding the Flags
There are two separate connections and each has its own host/port:
┌─────────────┐ --host / --port ┌──────────────────┐ --jadx-host / --jadx-port ┌──────────────────┐
│ LLM Client │ ◄──────────────────► │ jadx-mcp-server │ ──────────────────────────► │ JADX-GUI Plugin │
│ (Claude, │ Where the MCP server │ │ Where the MCP server looks │ (jadx-ai-mcp) │
│ Codex..) │ LISTENS for clients │ │ for the JADX plugin │ │
└─────────────┘ └──────────────────┘ └──────────────────┘
Flag
Default
Controls
--http
off
Use HTTP transport instead of stdio
--host
127.0.0.1
Where the MCP server listens (bind address for LLM clients)
--port
8651
Which port the MCP server listens on
--jadx-host
127.0.0.1
Where to find the JADX plugin (the target JADX-GUI machine)
--jadx-port
8650
Which port the JADX plugin is on
Usage Examples
Scenario 1 — Everything on the same machine (most common):
# Default: MCP server on localhost:8651, connects to JADX plugin on localhost:8650
uv run jadx_mcp_server.py --http
Scenario 2 — Docker container or WSL (MCP server accessible from host network):
# MCP server listens on ALL interfaces so the host can reach it
# JADX plugin is still on the same machine
uv run jadx_mcp_server.py --http --host 0.0.0.0
Scenario 3 — JADX-GUI running on a different machine (e.g., remote VM):
# MCP server runs locally, but connects to JADX plugin on a remote machine
uv run jadx_mcp_server.py --http --jadx-host 192.168.1.100
Scenario 4 — Full remote setup (everything on different machines):
# MCP server listens on all interfaces on port 9999
# JADX plugin is on a different machine at 192.168.1.100:8652
uv run jadx_mcp_server.py --http --host 0.0.0.0 --port 9999 --jadx-host 192.168.1.100 --jadx-port 8652
The MCP Configuration for custom jadx port will be as follows for claude:
The files related to JADX-AI-MCP can be found under this repo.
The files related to jadx-mcp-server can be found here.
To report bugs, issues, feature suggestion, Performance issue, general question, Documentation issue.
Kindly open an issue with respective template.
Tested on Claude Desktop Client, support for other AI will be tested soon!
🙏 Credits
This project is a plugin for JADX, an amazing open-source Android decompiler created and maintained by @skylot. All core decompilation logic belongs to them. I have only extended it to support my MCP server with AI capabilities.
JADX-AI-MCP and all related projects inherits the Apache 2.0 License from the original JADX repository.
⚖️ Legal Warning
Disclaimer
The tools jadx-ai-mcp and jadx_mcp_server are intended strictly for educational, research, and ethical security assessment purposes. They are provided "as-is" without any warranties, expressed or implied. Users are solely responsible for ensuring that their use of these tools complies with all applicable laws, regulations, and ethical guidelines.
By using jadx-ai-mcp or jadx_mcp_server, you agree to use them only in environments you are authorized to test, such as applications you own or have explicit permission to analyze. Any misuse of these tools for unauthorized reverse engineering, infringement of intellectual property rights, or malicious activity is strictly prohibited.
The developers of jadx-ai-mcp and jadx_mcp_server shall not be held liable for any damage, data loss, legal consequences, or other consequences resulting from the use or misuse of these tools. Users assume full responsibility for their actions and any impact caused by their usage.
Use responsibly. Respect intellectual property. Follow ethical hacking practices.
