jadx-mcp MCP Server Plugin for AI-Assisted jadx Reverse Engi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/0xdad0/jadx-mcp
• Blog Title: jadx-mcp: MCP Server Plugin for AI-Assisted jadx Reverse Engineering
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > APK decompilers, with a possible cross-reference from AI Security > AI MCP Security

🎯 Content Summary

jadx-mcp is a native jadx-gui plugin that embeds a Model Context Protocol (MCP) server into the jadx process. It lets Claude Code, Claude Desktop, or any streamable-HTTP MCP client analyze the APK, DEX, or JAR currently loaded in jadx-gui. Its 27 tools expose classes, decompiled Java, smali, individual methods, fields, Android manifest components, resources, strings, cross-references, and symbol-renaming operations for iterativ...

🔧 Technical Details

AI-assisted static analysis through a decompiler API: Expose a decompiler's internal analysis model through structured MCP tools rather than manually copying source into an AI client. The client can enumerate classes, search class and method names, retrieve complete Java or smali, inspect method signatures and fields, and use paginated full-text searches. Signature fragments should be supplied when overloaded methods make a name ambiguous.

Android attack-surface discovery: Combine decoded AndroidManifest.xml, component-type filtering, MAIN/LAUNCHER activity resolution, application-package enumeration, resource extraction, and strings.xml analysis. This workflow can reveal exported activities, services, receivers, providers, IPC entry points, WebView-related code, hardcoded endpoints, credentials, API keys, feature flags, and security-sensitive configuration. Retrieve the referenced class...

🤖 Agent Actions

Updated src/mobile-pentesting/android-app-pentesting/apk-decompilers.md with:

• jadx-mcp installation and MCP client configuration.
• AI-assisted Android analysis workflow.
• Manifest/resource triage, cross-reference tracing, and iterative deobfuscation.
• Pagination and token-usage guidance.
• Loopback-only security warning for the unauthenticated endpoint.
• Numbered citation to the original repository.

Validation: git diff --check passed; no forbidden sources used. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/0xdad0/jadx-mcp

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > APK decompilers, with a possible cross-reference from AI Security > AI MCP Security".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0