jadx-mcp-server MCP — Casos de uso, Instalar & Demo en vivo

Por qué usarlo

Características clave

25+ MCP tools for Android APK reverse engineering
Live contextual analysis of decompiled Android code
Vulnerability detection and security assessment capabilities
Debugger integration for runtime inspection
Supports stdio and HTTP transport for flexible deployment

Demo en vivo

Cómo se ve en la práctica

jadx-mcp-server.replay ▶ listo

0/0

Instalar

Elige tu cliente

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Abre Claude Desktop → Settings → Developer → Edit Config. Reinicia después de guardar.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Cursor usa el mismo esquema mcpServers que Claude Desktop. La configuración del proyecto prevalece sobre la global.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Haz clic en el icono MCP Servers de la barra lateral de Cline y luego en "Edit Configuration".

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Mismo formato que Claude Desktop. Reinicia Windsurf para aplicar.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "jadx-mcp-server",
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  ]
}

Continue usa un array de objetos de servidor en lugar de un mapa.

~/.config/zed/settings.json

{
  "context_servers": {
    "jadx-mcp-server": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/zinja-coder/jadx-mcp-server"
        ]
      }
    }
  }
}

Añádelo a context_servers. Zed recarga en caliente al guardar.

claude mcp add jadx-mcp-server -- TODO 'See README: https://github.com/zinja-coder/jadx-mcp-server'

Un solo comando. Verifica con claude mcp list. Quita con claude mcp remove.

Casos de uso

Usos del mundo real: jadx-mcp-server

How to perform a security audit on an Android APK with JADX MCP

👤 Security auditors reviewing Android applications they are authorized to test ⏱ ~60 min intermediate

Cuándo usarlo: You need to review an APK for security vulnerabilities.

Requisitos previos

JADX with jadx-ai-mcp plugin running with target APK loaded — Install plugin and open the APK in JADX-GUI
jadx-mcp-server running — uv run jadx_mcp_server.py

Flujo

Check manifest for issues

Get the AndroidManifest.xml. Check for exported components, dangerous permissions, and debug flags.✓ Copiado

→ Security findings from manifest analysis
Search for insecure patterns

Search for classes that use SharedPreferences, Log.d, or hardcoded URLs. Are there any credentials stored in plain text?✓ Copiado

→ List of potential security issues with code locations

Resultado: A security assessment report with specific code-level findings.

Errores comunes

ProGuard-obfuscated code is hard to follow — Use rename_variable and rename_class to deobfuscate as you analyze

Combinar con: filesystem

Combinaciones

Combínalo con otros MCPs para multiplicar por 10

jadx-mcp-server + filesystem

Save security findings and annotated code to report files

Compile all security findings into a report and save to ~/audits/app-audit.md.✓ Copiado

Herramientas

Lo que expone este MCP

Herramienta	Entradas	Cuándo llamar
fetch_current_class	none	Get source code of the class selected in JADX
get_all_classes	none	List all classes in the APK
search_classes_by_keyword	keyword: str	Search for classes by keyword
get_android_manifest	none	Get the AndroidManifest.xml
xrefs_to_method	class: str, method: str	Find cross-references to a method
rename_variable	class: str, old: str, new: str	Rename a variable for deobfuscation

Coste y límites

Lo que cuesta ejecutarlo

Cuota de API: N/A — fully local
Tokens por llamada: 200–2000 tokens per tool call
Monetario: Free
Consejo: Use search before fetching full class sources to minimize output.

Seguridad

Permisos, secretos, alcance

Almacenamiento de credenciales: N/A

Salida de datos: All analysis is local

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.

Resolución de problemas

Errores comunes y soluciones

Server can't connect to JADX

Ensure JADX-GUI is running with the jadx-ai-mcp plugin enabled and an APK is loaded.

Verificar: Check JADX-GUI for the plugin status indicator

uv not found

Install the uv package manager: curl -LsSf https://astral.sh/uv/install.sh | sh

Verificar: uv --version

Empty class list

Make sure an APK file is actually loaded in JADX before connecting.

Verificar: Open an APK in JADX-GUI first

Alternativas

jadx-mcp-server vs otros

Alternativa	Cuándo usarla	Contrapartida
jadx-ai-mcp (plugin)	You want the complete plugin+server setup as a single package	This is the server component — you need both the plugin and server

Más

Recursos

📖 Lee el README oficial en GitHub

🐙 Ver issues abiertas

🔍 Ver todos los 400+ servidores MCP y Skills