apktool-mcp-server
installs/mo · pypistarsforks
How to install apktool-mcp-server?
zinja-coder/apktool-mcp-server
$git clone https://github.com/zinja-coder/apktool-mcp-server⚡ Fully automated MCP server built on top of apktool to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, parse manifests, and reverse engineer effortlessly.
README.md
| 1 | <div align="center"> |
| 2 | |
| 3 | # apktool-mcp-server (Part of Zin's Reverse Engineering MCP Suite) |
| 4 | |
| 5 | ⚡ Fully automated MCP server built on top of apktool to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, parse manifests, and reverse engineer effortlessly. |
| 6 | |
| 7 |  |
| 8 |  |
| 9 |  |
| 10 |  |
| 11 |  |
| 12 | [](http://www.apache.org/licenses/LICENSE-2.0.html) |
| 13 | |
| 14 | </div> |
| 15 | |
| 16 | <!-- It is a still in early stage of development, so expects bugs, crashes and logical erros.--> |
| 17 | |
| 18 | <div align="center"> |
| 19 | <img alt="banner" height="480px" widht="620px" src="https://github.com/user-attachments/assets/eb9037f2-d1c7-45e0-8871-ca8aaade0dd0"> |
| 20 | </div> |
| 21 | |
| 22 | <!----> |
| 23 | |
| 24 | Image generated using AI tools. |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## 🤖 What is apktool-mcp-server? |
| 29 | |
| 30 | **apktool-mcp-server** is a MCP server for the [Apk Tool](https://github.com/iBotPeaches/apktool) that integrates directly with [Model Context Protocol (MCP)](https://github.com/anthropic/mcp) to provide **live reverse engineering support with LLMs like Claude**. |
| 31 | |
| 32 | Think: "Decompile → Context-Aware Code Review → AI Recommendations" — all in real time. |
| 33 | |
| 34 | Watch the demo! |
| 35 | |
| 36 | https://github.com/user-attachments/assets/d50251b8-6b1c-4341-b18e-ae54eb24a847 |
| 37 | |
| 38 | - **Solving the CTFs** |
| 39 | |
| 40 | |
| 41 | |
| 42 | https://github.com/user-attachments/assets/c783a604-a636-4e70-9fa8-37e3d219b20b |
| 43 | |
| 44 | |
| 45 | ## Other projects in Zin MCP Suite |
| 46 | - **[JADX-AI-MCP](https://github.com/zinja-coder/jadx-ai-mcp)** |
| 47 | - **[JADX-MCP-Server](https://github.com/zinja-coder/jadx-mcp-server)** |
| 48 | - **[ZIN-MCP-Client](https://github.com/zinja-coder/zin-mcp-client)** |
| 49 | |
| 50 | ## Current MCP Tools |
| 51 | |
| 52 | The following MCP tools are available: |
| 53 | |
| 54 | - `build_apk()` — Build an APK from a decoded APKTool Project. |
| 55 | - `get_manifest()` — Get the AndroidManifest.xml content from a decoded APK project. |
| 56 | - `get_apktool_yml()` — Get apktool.yml information from a decoded APK project. |
| 57 | - `list_smali_directories()` — List all smali directories in a project. |
| 58 | - `list_smali_files()` — List smali files in a specific smali directory, optinally filtered by package prefix. |
| 59 | - `get_smali_file()` — Get content of a specific smali file by class name. |
| 60 | - `modify_smali_file()` — Modify the content of a specific smali file. |
| 61 | - `list_resources()` — List resources in a project, optionally filtered by resource type. |
| 62 | - `get_resource_file()` — Get Content of a specific resource file. |
| 63 | - `modify_resource_file()` — Modify the content of a specific resource file. |
| 64 | - `search_in_file()` — Search for a pattern in files with specified extensions. |
| 65 | - `clean_project()` — Clean a project directory to prepare for rebuilding. |
| 66 | - `decode_apk()` — Decode an APK file using APKTool, extracting resources and smali code. |
| 67 | |
| 68 | --- |
| 69 | |
| 70 | ## 🗒️ Sample Prompts |
| 71 | |
| 72 | |
| 73 | ### 🔍 Basic Code Understanding |
| 74 | |
| 75 | - “List all smali directories for the dvac project.” |
| 76 | |
| 77 | - “Show me all the smali files under the package prefix com.vulnerable.component in the dvac project.” |
| 78 | |
| 79 | - “Get the smali code for the class com.vulnerable.component.MainActivity.” |
| 80 | |
| 81 | - “Compare MainActivity.smali with its previous version and show differences.” |
| 82 | |
| 83 | - “Search for usage of startActivity in smali files of dvac project.” |
| 84 | |
| 85 | ### 🛡️ Vulnerability Detection |
| 86 | |
| 87 | - “Analyze declared permissions in the dvac AndroidManifest.xml and flag dangerous ones.” |
| 88 | |
| 89 | - “Search for hardcoded URLs or IPs in all .xml and .smali files in the project.” |
| 90 | |
| 91 | - “Find all uses of PendingIntent.getActivity in smali files.” |
| 92 | |
| 93 | - “Check for exported activities or receivers in dvac’s |
People who liked this also viewed
6 picksType
- langfuse-mcpA Model Context Protocol (MCP) server for Langfuse, enabling AI agents to query Langfuse trace data for enhanced debugging and observabilityMCP ServersJun 2026
- tauri-plugin-mcpAllows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.MCP ServersJul 2026
- perfetto-mcpThis is a Model Context Protocol (MCP) server that gets answers from your Perfetto Traces. It turns natural‑language prompts into focused Perfetto analyses.MCP ServersApr 2026
- jshookmcpjs hook toolkit that all you needMCP ServersJul 2026
- Cron Expression Parser — Explain & Next Run TimesCron expression parser API for AI agents. Parse, validate, and explain cron expressions in plain English. Get next N scheduled run times in any timezone. Tools: schedule_parse_cron. Use this for debugging cron schedules, building scheduliMCP Serversrecently
- trace-mcpMCP server for Claude Code and Codex. One tool call replaces ~42 minutes of agent explorationMCP ServersJul 2026
