apktool-mcp-server
byzinja-coder· 2 MCP servers
⚡ Fully automated MCP server built on top of apktool to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, parse manifests, and reverse engineer effortlessly.
How to install apktool-mcp-server?
zinja-coder/apktool-mcp-server
$git clone https://github.com/zinja-coder/apktool-mcp-serverInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install apktool-mcp-server by running `git clone https://github.com/zinja-coder/apktool-mcp-server`, then use it for the current task and follow its documentation at https://github.com/zinja-coder/apktool-mcp-server.
README.md
| 1 | <div align="center"> |
| 2 | |
| 3 | # apktool-mcp-server (Part of Zin's Reverse Engineering MCP Suite) |
| 4 | |
| 5 | ⚡ Fully automated MCP server built on top of apktool to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, parse manifests, and reverse engineer effortlessly. |
| 6 | |
| 7 |  |
| 8 |  |
| 9 |  |
| 10 |  |
| 11 |  |
| 12 | [](http://www.apache.org/licenses/LICENSE-2.0.html) |
| 13 | |
| 14 | </div> |
| 15 | |
| 16 | <!-- It is a still in early stage of development, so expects bugs, crashes and logical erros.--> |
| 17 | |
| 18 | <div align="center"> |
| 19 | <img alt="banner" height="480px" widht="620px" src="https://github.com/user-attachments/assets/eb9037f2-d1c7-45e0-8871-ca8aaade0dd0"> |
| 20 | </div> |
| 21 | |
| 22 | <!----> |
| 23 | |
| 24 | Image generated using AI tools. |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## 🤖 What is apktool-mcp-server? |
| 29 | |
| 30 | **apktool-mcp-server** is a MCP server for the [Apk Tool](https://github.com/iBotPeaches/apktool) that integrates directly with [Model Context Protocol (MCP)](https://github.com/anthropic/mcp) to provide **live reverse engineering support with LLMs like Claude**. |
| 31 | |
| 32 | Think: "Decompile → Context-Aware Code Review → AI Recommendations" — all in real time. |
| 33 | |
| 34 | Watch the demo! |
| 35 | |
| 36 | https://github.com/user-attachments/assets/d50251b8-6b1c-4341-b18e-ae54eb24a847 |
| 37 | |
| 38 | - **Solving the CTFs** |
| 39 | |
| 40 | |
| 41 | |
| 42 | https://github.com/user-attachments/assets/c783a604-a636-4e70-9fa8-37e3d219b20b |
| 43 | |
| 44 | |
| 45 | ## Other projects in Zin MCP Suite |
| 46 | - **[JADX-AI-MCP](https://github.com/zinja-coder/jadx-ai-mcp)** |
| 47 | - **[JADX-MCP-Server](https://github.com/zinja-coder/jadx-mcp-server)** |
| 48 | - **[ZIN-MCP-Client](https://github.com/zinja-coder/zin-mcp-client)** |
| 49 | |
| 50 | ## Current MCP Tools |
| 51 | |
| 52 | The following MCP tools are available: |
| 53 | |
| 54 | - `build_apk()` — Build an APK from a decoded APKTool Project. |
| 55 | - `get_manifest()` — Get the AndroidManifest.xml content from a decoded APK project. |
| 56 | - `get_apktool_yml()` — Get apktool.yml information from a decoded APK project. |
| 57 | - `list_smali_directories()` — List all smali directories in a project. |
| 58 | - `list_smali_files()` — List smali files in a specific smali directory, optinally filtered by package prefix. |
| 59 | - `get_smali_file()` — Get content of a specific smali file by class name. |
| 60 | - `modify_smali_file()` — Modify the content of a specific smali file. |
| 61 | - `list_resources()` — List resources in a project, optionally filtered by resource type. |
| 62 | - `get_resource_file()` — Get Content of a specific resource file. |
| 63 | - `modify_resource_file()` — Modify the content of a specific resource file. |
| 64 | - `search_in_file()` — Search for a pattern in files with specified extensions. |
| 65 | - `clean_project()` — Clean a project directory to prepare for rebuilding. |
| 66 | - `decode_apk()` — Decode an APK file using APKTool, extracting resources and smali code. |
| 67 | |
| 68 | --- |
| 69 | |
| 70 | ## 🗒️ Sample Prompts |
| 71 | |
| 72 | |
| 73 | ### 🔍 Basic Code Understanding |
| 74 | |
| 75 | - “List all smali directories for the dvac project.” |
| 76 | |
| 77 | - “Show me all the smali files under the package prefix com.vulnerable.component in the dvac project.” |
| 78 | |
| 79 | - “Get the smali code for the class com.vulnerable.component.MainActivity.” |
| 80 | |
| 81 | - “Compare MainActivity.smali with its previous version and show differences.” |
| 82 | |
| 83 | - “Search for usage of startActivity in smali files of dvac project.” |
| 84 | |
| 85 | ### 🛡️ Vulnerability Detection |
| 86 | |
| 87 | - “Analyze declared permissions in the dvac AndroidManifest.xml and flag dangerous ones.” |
| 88 | |
| 89 | - “Search for hardcoded URLs or IPs in all .xml and .smali files in the project.” |
| 90 | |
| 91 | - “Find all uses of PendingIntent.getActivity in smali files.” |
| 92 | |
| 93 | - “Check for exported activities or receivers in dvac’s |
Related
6 picksType
- agent-deviceLet AI agents inspect, control, and debug real iOS, Android, desktop, and TV appsJul 2026
- xcodebuildmcpXcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.Jul 2026
- mobile-mcpMCP server for iOS and Android Mobile Development, Automation and TestingJul 2026
- android-mcp-serverAn MCP server for android automationMay 2025
- android-mcpLightweight MCP Server for Android Operating SystemJul 2026
- mobile-mcpA MCP server to control your mobile devicesApr 2025
