jadx-mcp-server MCP — ユースケース, インストール & ライブデモ

なぜ使うのか

主な機能

25+ MCP tools for Android APK reverse engineering
Live contextual analysis of decompiled Android code
Vulnerability detection and security assessment capabilities
Debugger integration for runtime inspection
Supports stdio and HTTP transport for flexible deployment

ライブデモ

実際の動作

jadx-mcp-server.replay ▶ 準備完了

0/0

インストール

クライアントを選択

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Claude Desktop → Settings → Developer → Edit Config を開く。保存後、アプリを再起動。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Cursor は Claude Desktop と同じ mcpServers スキーマを使用。プロジェクト設定はグローバルより優先。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Cline サイドバーの MCP Servers アイコンをクリックし、"Edit Configuration" を選択。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Claude Desktop と同じ形式。Windsurf を再起動して反映。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "jadx-mcp-server",
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  ]
}

Continue はマップではなくサーバーオブジェクトの配列を使用。

~/.config/zed/settings.json

{
  "context_servers": {
    "jadx-mcp-server": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/zinja-coder/jadx-mcp-server"
        ]
      }
    }
  }
}

context_servers に追加。保存時に Zed がホットリロード。

claude mcp add jadx-mcp-server -- TODO 'See README: https://github.com/zinja-coder/jadx-mcp-server'

ワンライナー。claude mcp list で確認、claude mcp remove で削除。

ユースケース

実用的な使い方： jadx-mcp-server

How to perform a security audit on an Android APK with JADX MCP

👤 Security auditors reviewing Android applications they are authorized to test ⏱ ~60 min intermediate

使うタイミング： You need to review an APK for security vulnerabilities.

前提条件

JADX with jadx-ai-mcp plugin running with target APK loaded — Install plugin and open the APK in JADX-GUI
jadx-mcp-server running — uv run jadx_mcp_server.py

フロー

Check manifest for issues

Get the AndroidManifest.xml. Check for exported components, dangerous permissions, and debug flags.✓ コピーしました

→ Security findings from manifest analysis
Search for insecure patterns

Search for classes that use SharedPreferences, Log.d, or hardcoded URLs. Are there any credentials stored in plain text?✓ コピーしました

→ List of potential security issues with code locations

結果： A security assessment report with specific code-level findings.

注意点

ProGuard-obfuscated code is hard to follow — Use rename_variable and rename_class to deobfuscate as you analyze

組み合わせ： filesystem

組み合わせ

他のMCPと組み合わせて10倍の力を

jadx-mcp-server + filesystem

Save security findings and annotated code to report files

Compile all security findings into a report and save to ~/audits/app-audit.md.✓ コピーしました

ツール

このMCPが提供する機能

ツール	入力	呼び出すタイミング
fetch_current_class	none	Get source code of the class selected in JADX
get_all_classes	none	List all classes in the APK
search_classes_by_keyword	keyword: str	Search for classes by keyword
get_android_manifest	none	Get the AndroidManifest.xml
xrefs_to_method	class: str, method: str	Find cross-references to a method
rename_variable	class: str, old: str, new: str	Rename a variable for deobfuscation

コストと制限

運用コスト

APIクォータ: N/A — fully local
呼び出しあたりのトークン: 200–2000 tokens per tool call
金額: Free
ヒント: Use search before fetching full class sources to minimize output.

セキュリティ

権限、シークレット、影響範囲

認証情報の保管： N/A

データ送信先： All analysis is local

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.

トラブルシューティング

よくあるエラーと対処法

Server can't connect to JADX

Ensure JADX-GUI is running with the jadx-ai-mcp plugin enabled and an APK is loaded.

確認： Check JADX-GUI for the plugin status indicator

uv not found

Install the uv package manager: curl -LsSf https://astral.sh/uv/install.sh | sh

確認： uv --version

Empty class list

Make sure an APK file is actually loaded in JADX before connecting.

確認： Open an APK in JADX-GUI first

代替案

jadx-mcp-server 他との比較

代替案	代わりに使う場面	トレードオフ
jadx-ai-mcp (plugin)	You want the complete plugin+server setup as a single package	This is the server component — you need both the plugin and server

その他

リソース

📖 GitHub の公式 README を読む

🐙 オープンな issue を見る

🔍 400以上のMCPサーバーとSkillsを見る