AwesomeREA.org

Integration

JADX MCP Server (Qtty)

MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. Its 23 tools return classes, decompiled sources with size-capped outlines, methods, fields, smali, cross-references and callees read from a dex-derived index, type hierarchies and overrides, exported and deep-link components, the manifest and resource files, plus a whole-APK sweep for framework sink call sites grouped by impact category.

Targets
App
Category
Independent MCP integrations
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • The repository has a single commit, dated 2026-08-20, and no releases or tags. Its GitHub description still calls it a pure-Java MCP server; README explains that the MCP layer moved to Python after concurrent tool calls hung the Java SDK's transport. Unlike JADX-AI-MCP, it uses no JADX GUI plugin.
  • Building needs Java 17+ (README says it is built and run on 21) and Maven 3.6+ for the Spring Boot daemon jar; the MCP layer needs Python 3.10+ with the pinned mcp 1.27.2 and httpx 0.27.2. The MCP client launches mcp_server/jadx_mcp.py, which starts the daemon on first use. The daemon binds 127.0.0.1:8765 with a 24 GB default heap and keeps one APK loaded by default; README puts a large APK at about 26 GB.
  • Input is an APK the analyst supplies. List and source tools are capped by default to bound response size, and README says the sink sweep is blind to reflection and to wrappers that rename the operation. The committed test fixture misc/DivaApplication.apk is the DIVA deliberately vulnerable training app; tests needing a larger production APK skip without it, and README reports 92 run and 4 skipped.
  • No license file: README only notes that the JADX library is Apache-2.0, so the server's own code states no reuse terms. README frames the tool for defensive security analysis and demonstrates it with Claude; no REA connection is stated, and nothing was run in this review.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Qtty/jadx-mcp-server · Revision 4e6d890
  2. mcp_server/jadx_mcp.py GitHub · Qtty/jadx-mcp-server · Revision 4e6d890
  3. mcp_server/requirements.txt GitHub · Qtty/jadx-mcp-server · Revision 4e6d890
  4. pom.xml GitHub · Qtty/jadx-mcp-server · Revision 4e6d890
  5. src/main/resources/application.properties GitHub · Qtty/jadx-mcp-server · Revision 4e6d890

More in Agents and MCP

All 66 entries in Agents and MCP