Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Open canonical comparison link

Comparable alternatives

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence fieldmcp-agentWatchlist candidateJADX-AI-MCP (Part of Zin MCP Suite)MCP100 Selected
Task fit
Best for
  • Python teams building MCP-native multi-step agents or durable workflows.
  • Navigating JADX decompilation, searching APK code, and accelerating reverse-engineering or security-analysis hypotheses
Not ideal for
  • Users who need a broadly proven, low-risk, fully mature Selected-grade integration today.
  • Definitive vulnerability certification, dynamic analysis, or reviewing applications without authorization
Avoid when
  • Avoid high-impact or sensitive production use unless the documented authentication, permissions, rollback, and data handling match your environment.
  • APK contents, decompiled code, or findings cannot be shared with the connected AI client
Provenance
Provenance details

First-party MCP

github:lastmile-ai · Publisher source ↗

Community implementation

github:zinja-coder · Publisher source ↗

Maintenance
Maintenance details

Stale

Repo: Not documented

Package: Not documented

Repo: Aug 6, 2026

Package: Not documented

Popularity evidence
GitHub starsNot documented

2,664

GitHub stars · checked 2026-08-14T18:46:26.000Z

Client coverage
Client coverage detailsNot documented
Claude Code✓ Local stdio
Claude Desktop✓ Local stdio
Codex✓ Local stdio
VS Code✓ Local stdio
Cursor✓ Local stdio
OpenCode✓ Local stdio
Client coverage noteLocal stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
AuthenticationDepends on configured MCP servers and LLM/cloud providers; the framework documents configuration/secrets and OAuth support.The documented default is stdio with the HTTP endpoints on 127.0.0.1. The publisher explicitly warns that binding the MCP server to 0.0.0.0 or another non-localhost address exposes plain HTTP with no authentication or TLS, allowing anyone on that network to invoke all tools.
CostOpen-source framework; model providers, Temporal/cloud deployment and connected services may be billable.The publisher distributes the project under the Apache License 2.0 and lists no MCP server usage fee. JADX, local compute, the selected MCP client, and model-provider costs can still apply.
PermissionsInherits the tool/resource authority of every connected MCP server plus any workflow/cloud runtime permissions.The published tools can read decompiled code for classes and methods, smali, AndroidManifest.xml, string and resource files, cross-references, and debugger frames, threads, and variables from the project open in JADX. They can also rename classes, methods, fields, packages, and variables within the JADX analysis workspace.
Data handlingWorkflow data can pass through connected MCP servers, model providers and optional cloud/Temporal services; deployment-specific policies control retention.The publisher's architecture sends tool requests from the LLM client through the Python MCP server over HTTP to the JADX-GUI plugin, then returns source, resource, manifest, and debugger data to the connected client. The reviewed README does not document telemetry, retention, or model-training use, so those behaviors remain unknown.
Limitations
Tradeoffs
  • Broad authority across multiple MCP servers/providers makes permission and production-governance evidence important before Selected promotion.
  • JADX integration speeds static exploration, but decompilation is imperfect and AI-generated security conclusions can contain false positives or miss runtime behavior.
Risk contextBroad authority across multiple MCP servers/providers makes permission and production-governance evidence important before Selected promotion.This server exposes sensitive reverse-engineering material and mutation tools for the APK project open in JADX. Keep both connections on 127.0.0.1 and prefer stdio; if remote access is unavoidable, use a trusted isolated network plus firewall or SSH tunnel. Treat decompiled source, resources, manifests, and debugger values as potentially confidential, and review rename operations before saving or exporting analysis artifacts.
Evidence date
Editorial review2026-09-13T00:00:00Z2026-08-11
Candidate evidence2026-09-13T00:00:00Z2026-08-14T18:46:26.000Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →