JADX MCP Server
JADX MCP server enabling AI agents to interact with JADX — the leading Android APK and Java decompiler — querying decompiled Java/Kotlin source code from Android apps, searching class structures and method implementations, and integrating JADX's decompilation capabilities into agent-driven Android reverse engineering and mobile security research workflows.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Local JADX instance. No credentials. Community MCP (reputable author). Analyze APKs in isolated environment.
⚡ Reliability
Best When
A mobile security researcher needs AI-assisted Android app analysis — querying JADX-decompiled code to understand app behavior, find vulnerabilities, or analyze malware.
Avoid When
You're analyzing iOS apps, native ARM code, or working on non-Android targets.
Use Cases
- • Querying decompiled Android app source code from mobile security agents
- • Searching for specific methods or classes in APK decompilations from RE agents
- • Analyzing Android malware behavior from threat intelligence agents
- • Understanding third-party Android SDK implementations from integration agents
- • Auditing Android app security from mobile security assessment agents
- • Researching Android app APIs and data flows from privacy research agents
Not For
- • iOS app analysis (JADX is Android/Java/Kotlin only; use Ghidra for iOS)
- • Teams without JADX installed locally
- • Native code analysis (JADX handles Java bytecode, not native .so files)
Interface
Authentication
No authentication — connects to JADX local server. JADX must be running with server mode enabled. Local process communication only.
Pricing
JADX is free open source. MCP server from LaurieWired (mobile security researcher) is free. No licensing costs.
Agent Metadata
Known Gotchas
- ⚠ JADX must be running in server mode with target APK loaded before MCP can query it
- ⚠ JADX decompilation quality varies — obfuscated apps produce hard-to-read output
- ⚠ APK must be decompiled before querying — initial decompilation can take several minutes for large apps
- ⚠ Class and method names may be obfuscated (a.b.c style) — agents need to handle this
- ⚠ MCP from LaurieWired — reputable mobile security researcher; smaller contributor base
- ⚠ Java/Kotlin decompiled code is approximate — may not be 100% correct for complex bytecode
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for JADX MCP Server.
Scores are editorial opinions as of 2026-03-06.