jadx-mcp-server MCP — 사용 사례, 설치 & 라이브 데모

왜 쓰나요

핵심 기능

25+ MCP tools for Android APK reverse engineering
Live contextual analysis of decompiled Android code
Vulnerability detection and security assessment capabilities
Debugger integration for runtime inspection
Supports stdio and HTTP transport for flexible deployment

라이브 데모

실제 사용 모습

jadx-mcp-server.replay ▶ 준비됨

0/0

설치

클라이언트 선택

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Claude Desktop → Settings → Developer → Edit Config 열기. 저장 후 앱 재시작.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Cursor는 Claude Desktop과 동일한 mcpServers 스키마 사용. 프로젝트 설정이 전역보다 우선.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Cline 사이드바의 MCP Servers 아이콘 클릭 후 "Edit Configuration" 선택.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "jadx-mcp-server": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  }
}

Claude Desktop과 같은 형식. Windsurf 재시작 후 적용.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "jadx-mcp-server",
      "command": "TODO",
      "args": [
        "See README: https://github.com/zinja-coder/jadx-mcp-server"
      ]
    }
  ]
}

Continue는 맵이 아닌 서버 오브젝트 배열 사용.

~/.config/zed/settings.json

{
  "context_servers": {
    "jadx-mcp-server": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/zinja-coder/jadx-mcp-server"
        ]
      }
    }
  }
}

context_servers에 추가. 저장 시 Zed가 핫 리로드.

claude mcp add jadx-mcp-server -- TODO 'See README: https://github.com/zinja-coder/jadx-mcp-server'

한 줄 명령. claude mcp list로 확인, claude mcp remove로 제거.

사용 사례

실전 활용법: jadx-mcp-server

How to perform a security audit on an Android APK with JADX MCP

👤 Security auditors reviewing Android applications they are authorized to test ⏱ ~60 min intermediate

언제 쓸까: You need to review an APK for security vulnerabilities.

사전 조건

JADX with jadx-ai-mcp plugin running with target APK loaded — Install plugin and open the APK in JADX-GUI
jadx-mcp-server running — uv run jadx_mcp_server.py

흐름

Check manifest for issues

Get the AndroidManifest.xml. Check for exported components, dangerous permissions, and debug flags.✓ 복사됨

→ Security findings from manifest analysis
Search for insecure patterns

Search for classes that use SharedPreferences, Log.d, or hardcoded URLs. Are there any credentials stored in plain text?✓ 복사됨

→ List of potential security issues with code locations

결과: A security assessment report with specific code-level findings.

함정

ProGuard-obfuscated code is hard to follow — Use rename_variable and rename_class to deobfuscate as you analyze

함께 쓰기: filesystem

조합

다른 MCP와 조합해 10배 효율

jadx-mcp-server + filesystem

Save security findings and annotated code to report files

Compile all security findings into a report and save to ~/audits/app-audit.md.✓ 복사됨

도구

이 MCP가 노출하는 것

도구	입력	언제 호출
fetch_current_class	none	Get source code of the class selected in JADX
get_all_classes	none	List all classes in the APK
search_classes_by_keyword	keyword: str	Search for classes by keyword
get_android_manifest	none	Get the AndroidManifest.xml
xrefs_to_method	class: str, method: str	Find cross-references to a method
rename_variable	class: str, old: str, new: str	Rename a variable for deobfuscation

비용 및 제한

운영 비용

API 쿼터: N/A — fully local
호출당 토큰: 200–2000 tokens per tool call
금액: Free
팁: Use search before fetching full class sources to minimize output.

보안

권한, 시크릿, 파급범위

자격 증명 저장: N/A

데이터 외부 송신: All analysis is local

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.

문제 해결

자주 발생하는 오류와 해결

Server can't connect to JADX

Ensure JADX-GUI is running with the jadx-ai-mcp plugin enabled and an APK is loaded.

확인: Check JADX-GUI for the plugin status indicator

uv not found

Install the uv package manager: curl -LsSf https://astral.sh/uv/install.sh | sh

확인: uv --version

Empty class list

Make sure an APK file is actually loaded in JADX before connecting.

확인: Open an APK in JADX-GUI first

대안

jadx-mcp-server 다른 것과 비교

대안	언제 쓰나	단점/장점
jadx-ai-mcp (plugin)	You want the complete plugin+server setup as a single package	This is the server component — you need both the plugin and server

jadx-mcp-server