{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/mcp_server/jadx_mcp.py",
    "https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/mcp_server/requirements.txt",
    "https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/pom.xml",
    "https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/src/main/resources/application.properties"
  ],
  "category": "agent-mcp",
  "description_en": "MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. Its 23 tools return classes, decompiled sources with size-capped outlines, methods, fields, smali, cross-references and callees read from a dex-derived index, type hierarchies and overrides, exported and deep-link components, the manifest and resource files, plus a whole-APK sweep for framework sink call sites grouped by impact category.",
  "description_zh": "用于 Android APK 分析的 MCP 服务：Python FastMCP 进程通过 stdio 与智能体通信，并驱动一个常驻本地的 JVM 守护进程，后者以库的形式内嵌 JADX 1.5.6，因此无需 JADX 图形界面，已加载的 APK 也能在会话之间保持就绪。它的 23 个工具可返回类列表、超出大小上限时改为大纲的反编译源码、方法、字段、smali、基于 dex 索引的交叉引用与被调函数、类型层次与重写关系、导出组件和深层链接组件、清单与资源文件，并能在整个 APK 中按影响类别扫描框架敏感调用点。",
  "entry_url": "https://awesomerea.org/resources/qtty-jadx-mcp-server/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/qtty-jadx-mcp-server/",
  "evidence_url": "https://github.com/Qtty/jadx-mcp-server/blob/4e6d890d1d3753d2bb47d492a9523ef98874df85/README.md",
  "group": "agents",
  "id": "qtty-jadx-mcp-server",
  "json_url": "https://awesomerea.org/resources/qtty-jadx-mcp-server/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/qtty-jadx-mcp-server/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/qtty-jadx-mcp-server/index.md",
  "name": "JADX MCP Server (Qtty)",
  "name_zh": "JADX MCP Server（Qtty）",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "The repository has a single commit, dated 2026-08-20, and no releases or tags. Its GitHub description still calls it a pure-Java MCP server; README explains that the MCP layer moved to Python after concurrent tool calls hung the Java SDK's transport. Unlike JADX-AI-MCP, it uses no JADX GUI plugin.",
    "Building needs Java 17+ (README says it is built and run on 21) and Maven 3.6+ for the Spring Boot daemon jar; the MCP layer needs Python 3.10+ with the pinned mcp 1.27.2 and httpx 0.27.2. The MCP client launches mcp_server/jadx_mcp.py, which starts the daemon on first use. The daemon binds 127.0.0.1:8765 with a 24 GB default heap and keeps one APK loaded by default; README puts a large APK at about 26 GB.",
    "Input is an APK the analyst supplies. List and source tools are capped by default to bound response size, and README says the sink sweep is blind to reflection and to wrappers that rename the operation. The committed test fixture misc/DivaApplication.apk is the DIVA deliberately vulnerable training app; tests needing a larger production APK skip without it, and README reports 92 run and 4 skipped.",
    "No license file: README only notes that the JADX library is Apache-2.0, so the server's own code states no reuse terms. README frames the tool for defensive security analysis and demonstrates it with Claude."
  ],
  "requirements_zh": [
    "仓库只有一次提交，日期为 2026-08-20，没有发布版本或标签。其 GitHub 简介仍称它是纯 Java 的 MCP 服务；README 解释说，由于并发工具调用会让 Java SDK 的传输层卡死，MCP 层已改用 Python。与 JADX-AI-MCP 不同，它不使用 JADX 图形界面插件。",
    "构建 Spring Boot 守护进程 jar 需要 Java 17+（README 称在 21 上构建和运行）和 Maven 3.6+；MCP 层需要 Python 3.10+，以及固定版本的 mcp 1.27.2 和 httpx 0.27.2。MCP 客户端启动 mcp_server/jadx_mcp.py，后者在首次使用时启动守护进程。守护进程绑定 127.0.0.1:8765，默认堆上限 24 GB，默认只保留一个已加载的 APK；README 称一个大型 APK 约占 26 GB。",
    "输入是分析者自备的 APK。列表和源码类工具默认设有上限，以控制响应大小；README 指出敏感调用扫描无法发现反射调用和改名封装的操作。仓库提交的测试样本 misc/DivaApplication.apk 是刻意含漏洞的 DIVA 练习应用；需要更大生产 APK 的测试在缺少该文件时会跳过，README 报告 92 项运行、4 项跳过。",
    "没有许可证文件：README 只说明 JADX 库采用 Apache-2.0，因此服务本身的代码未声明复用条款。README 将其定位为防御性安全分析工具，并以 Claude 演示其用法。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/Qtty/jadx-mcp-server",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}