JADX MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track JADX and Android analysis compatibility with attention to artifact scope

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Authorized Android reverse engineering with JADX

What we know

Community MCP server for the JADX-AI plugin, exposing decompilation and Android reverse-engineering workflows to AI clients.

Maintenance / activity evidence

Observed Sep 23, 2026 (UTC)Merge pull request 66 from loaniloroze/feat/code-comments

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read/debug access to loaded APK/decompiled content; exact writes depend on plugin version. Reported action classes: Limited/roadmap-dependent modification tools. Complete write authority is not verified.
Authentication not yet verified.
Sensitive access: APK contents, Potential proprietary/mobile-app code

Use only on authorized applications and verify the current tool surface before enabling write-capable workflows.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

795 repository stars

Stars observed Sep 25, 2026.

Preserve any already-reviewed adoption metrics in MCP100. Batch 4 did not refresh package downloads because the package-stats provider had insufficient credits.

All limitations / Review context

Which APK analysis tools and client setup remain supported?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Use only on authorized applications and verify the current tool surface before enabling write-capable workflows.
Read/debug access to loaded APK/decompiled content; exact writes depend on plugin version.
Local reverse-engineering data is exposed to the MCP client.
Reviewed write actions: Limited/roadmap-dependent modification tools
Sensitive access: APK contents, Potential proprietary/mobile-app code
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Exact install command
Current authentication model
Exact write-capable tools
Community extension, not the upstream JADX project.
Some modification capabilities remain roadmap items.

Original activity observations

2026-09-23T07:51:37Z: Merge pull request 66 from loaniloroze/feat/code-comments

Technical identity

github.com/zinja-coder/jadx-mcp-server

Exact implementation source: https://github.com/zinja-coder/jadx-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: zinja-coder/jadx-mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
zinja-coder/jadx-mcp-server
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher requires a multistep setup; follow the source and configuration instructions, no invented one-line installer.
Configure / authenticate
MCP100 setup guide
Requires the modified `jadx-ai-mcp` GUI and separate jadx-mcp Python bridge. Configure the bridge to the locally running JADX GUI as documented; downloading vanilla jadx alone is insufficient.
Previously reviewed client configuration / prerequisites: Network listeners must remain loopback-only unless the user separately configures firewall/TLS/authentication.
Check connection
Suggested check
Open an authorized sample APK in modified JADX GUI and confirm MCP tool enumeration; do not modify files.
Remove / uninstall / revoke
MCP100 setup guide
If registered in Claude Code under the name `jadx-mcp-server`, remove the client entry with `claude mcp remove jadx-mcp-server`. For other MCP hosts remove the matching server/connector in that host’s MCP settings. Remove a globally installed software package separately if applicable; this does not delete data or revoke a service credential.
Client removal, software uninstall, persistent-data deletion and credential revocation are separate actions.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove jadx-mcp-server

Official Documentation & Sources

What it does

Community MCP server for the JADX-AI plugin, exposing decompilation and Android reverse-engineering workflows to AI clients.

Capability: Security & Testing
Resource type: MCP Server
Industry: Cybersecurity
Best fit: Authorized Android reverse engineering with JADX

Representative uses

Inspect decompiled Android code
Navigate classes/methods/resources
Support APK reverse-engineering investigations

Limitations

Community extension, not the upstream JADX project.
Some modification capabilities remain roadmap items.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Read/debug access to loaded APK/decompiled content; exact writes depend on plugin version.
Data handling: Local reverse-engineering data is exposed to the MCP client.
Cost: free
Risk and cautions: Use only on authorized applications and verify the current tool surface before enabling write-capable workflows.

Access scope and cautions

Write actions: Not verified Limited/roadmap-dependent modification tools
Sensitive access: APK contents Potential proprietary/mobile-app code
Risk level: moderate

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect decompiled Android code; Navigate classes/methods/resources; Support APK reverse-engineering investigations.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Limited/roadmap-dependent modification tools. Recorded permission context: Read/debug access to loaded APK/decompiled content; exact writes depend on plugin version.

What data-handling boundary should I consider?

Local reverse-engineering data is exposed to the MCP client. Recorded sensitive-access context: APK contents; Potential proprietary/mobile-app code.

What limitations and risks should I check before use?

Use only on authorized applications and verify the current tool surface before enabling write-capable workflows. Community extension, not the upstream JADX project. Some modification capabilities remain roadmap items. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

zinja-coder is listed as Community implementation in MCP100’s current evidence.