Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Open canonical comparison link

Comparable alternatives

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence fieldgroqShortlist candidateJADX-AI-MCP (Part of Zin MCP Suite)MCP100 Recommended
Task fit
Best for
  • Low-latency model-inference and multimodal processing workflows.
  • Navigating JADX decompilation, searching APK code, and accelerating reverse-engineering or security-analysis hypotheses
Not ideal for
  • Production use before the documented maturity gaps are resolved
  • Definitive vulnerability certification, dynamic analysis, or reviewing applications without authorization
Avoid when
  • The connected identity is broader than the task requires
  • Tool calls cannot be reviewed before consequential mutations
  • APK contents, decompiled code, or findings cannot be shared with the connected AI client
Provenance
Provenance details

First-party MCP

ecosystem:groq · Publisher source ↗

Community implementation

github:zinja-coder · Publisher source ↗

Maintenance
Maintenance details

Repo: Aug 13, 2026

Package: Not documented

Repo: Sep 23, 2026

Package: Not documented

Popularity evidence
GitHub stars

43

GitHub stars · checked 2026-08-14T18:46:26.000Z

2,822

GitHub stars · checked 2026-09-24T04:14:47.694000Z

Client coverage
Client coverage details
Claude Code✓ Local stdio
Claude Desktop✓ Local stdio
Codex✓ Local stdio
VS Code✓ Local stdio
Cursor✓ Local stdio
OpenCode✓ Local stdio
Claude Code✓ Local stdio
Claude Desktop✓ Local stdio
Codex✓ Local stdio
VS Code✓ Local stdio
Cursor✓ Local stdio
OpenCode✓ Local stdio
Client coverage noteLocal stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
AuthenticationThe official server uses a Groq API key.The documented default is stdio with the HTTP endpoints on 127.0.0.1. The publisher explicitly warns that binding the MCP server to 0.0.0.0 or another non-localhost address exposes plain HTTP with no authentication or TLS, allowing anyone on that network to invoke all tools.
CostThe MCP integration has no separately verified MCP100 price conclusion. Publisher subscriptions, API usage, compute, storage, and AI-client charges may apply.The publisher distributes the project under the Apache License 2.0 and lists no MCP server usage fee. JADX, local compute, the selected MCP client, and model-provider costs can still apply.
PermissionsGroq API-key permissions, model availability, and account quotas govern usage.The published tools can read decompiled code for classes and methods, smali, AndroidManifest.xml, string and resource files, cross-references, and debugger frames, threads, and variables from the project open in JADX. They can also rename classes, methods, fields, packages, and variables within the JADX analysis workspace.
Data handlingAuthorized service data and tool results pass through the MCP server to the connected AI client. Review the publisher and client data policies before using sensitive ai & reasoning information.The publisher's architecture sends tool requests from the LLM client through the Python MCP server over HTTP to the JADX-GUI plugin, then returns source, resource, manifest, and debugger data to the connected client. The reviewed README does not document telemetry, retention, or model-training use, so those behaviors remain unknown.
Limitations
Tradeoffs
  • The implementation has limited maintenance history and a narrower evidence base than established Recommended entries.
  • JADX integration speeds static exploration, but decompilation is imperfect and AI-generated security conclusions can contain false positives or miss runtime behavior.
Risk contextThe implementation has limited maintenance history and a narrower evidence base than established Recommended entries. Use a test environment where practical, least-privilege credentials, narrowly enabled tools, and explicit confirmation for mutations. MCP100 did not execute third-party server code during this documentation review.This server exposes sensitive reverse-engineering material and mutation tools for the APK project open in JADX. Keep both connections on 127.0.0.1 and prefer stdio; if remote access is unavoidable, use a trusted isolated network plus firewall or SSH tunnel. Treat decompiled source, resources, manifests, and debugger values as potentially confidential, and review rename operations before saving or exporting analysis artifacts.
Evidence date
Editorial review2026-07-302026-08-11
Candidate evidence2026-08-14T18:46:26.000Z2026-09-24T04:25:05.554391Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →