jadx-mcp MCP Server Plugin for AI-Assisted jadx Reverse Engi...

src/mobile-pentesting/android-app-pentesting/apk-decompilers.md

@@ -16,6 +16,29 @@ As the pioneering GUI Java decompiler, **JD-Gui** allows you to investigate Java
 - For command-line usage, decompile an APK with: `jadx app.apk`
 - To specify an output directory or adjust decompilation options: `jadx app.apk -d <path to output dir> --no-res --no-src --no-imports`
 
+#### AI-assisted static analysis with jadx-mcp
+
+[**jadx-mcp**](https://github.com/0xdad0/jadx-mcp) is a jadx-gui plugin that exposes the analysis model of the currently loaded APK, DEX, or JAR as 27 schema-validated MCP tools over Streamable HTTP. Unlike copying decompiled text into an LLM, the client can request Java or Smali, methods and fields, decoded manifest components and resources, cross-references, and jadx rename operations as structured results.<sup>[[14]](#references)</sup>
+
+The plugin targets jadx-gui 1.5.6 and requires jadx to run on Java 17 or later. Install its fat JAR, open the target in jadx-gui, start the server from **Plugins → jadx-mcp: Settings...**, and register the default endpoint with an HTTP-capable MCP client:<sup>[[14]](#references)</sup>
+
+```bash
+jadx plugins --install-jar jadx-mcp-0.1.0.jar
+claude mcp add --transport http jadx-mcp http://localhost:8090/mcp
+```
+
+A compact Android review/deobfuscation loop is:<sup>[[14]](#references)</sup>
+
+1. Call `status`, then inspect `get_android_manifest`, `get_manifest_component`, `get_main_activity_class`, `get_strings`, and selected resource files to map exported entry points, deep links, hardcoded endpoints, and security configuration.
+2. Use `search_classes`, `search_method_by_name`, or `search_classes_by_keyword`, then retrieve only the relevant class/method source or Smali. Supply a `signature` fragment to method tools when overloads are ambiguous.
+3. Follow `xrefs_to_class`, `xrefs_to_method`, and `xrefs_to_field`, retrieving method source at each hop to reconstruct call paths and field-access flows.
+4. Rename inferred symbols with `rename_class`, `rename_method`, `rename_field`, or `rename_package`, reload, and repeat. These aliases use jadx's normal deobfuscation system; `rename_variable` is session-local and is not stored in saved `.jadx` metadata.
+
+Paginated tools accept `offset` and `limit` (default 50, maximum 500). Prefer targeted queries over `get_main_application_classes_code`, whose full-source responses are token-heavy.<sup>[[14]](#references)</sup>
+
+> [!WARNING]
+> The server has **no authentication**. Its safe default is `127.0.0.1:8090`; Origin/Host validation helps against browser and DNS-rebinding access but does not authenticate network clients. Never bind it to `0.0.0.0` or a LAN address, and do not port-forward the endpoint: connected clients can extract loaded code/resources and mutate project aliases.<sup>[[14]](#references)</sup>
+
 ### GDA Android Reversing Tool<sup>[[6]](#references)</sup>
 
 **GDA**, a Windows-only tool, offers extensive features for reverse engineering Android apps. Install and run GDA on your Windows system, then load the APK file for analysis.
@@ -88,5 +111,6 @@ This is especially practical for **field triage**, **mobile malware static analy
 - [11] [Krakatau repository](https://github.com/Storyyeller/Krakatau)
 - [12] [Procyon repository](https://github.com/mstrobel/procyon)
 - [13] [FRIDA-DEXDump repository](https://github.com/hluwa/FRIDA-DEXDump)
+- [14] [jadx-mcp: MCP server plugin for jadx-gui](https://github.com/0xdad0/jadx-mcp)
 
 {{#include ../../banners/hacktricks-training.md}}