JADX-AI-MCP is a plugin for the JADX decompiler, used to integrate an MCP (Model Context Protocol) server into JADX, thereby enabling LLMs (such as Claude) to communicate in real time with the context of a decompiled Android app, realizing a real-time workflow of "decompile → context-aware code review → AI suggestions." It is part of the Zin MCP Suite, alongside APKTool-MCP-Server and JADX-MCP-Server in the same series.
Main capabilities: This tool consists of two parts—the JADX MCP server (a standalone Python server) and the JADX-AI-MCP plugin. The plugin is responsible for interacting with JADX-GUI, and the server lets the LLM access the decompilation context via the MCP protocol. The currently provided MCP tools include: getting the name and full source code of the currently selected class, getting the currently selected text, listing all classes in the project, getting the full source code of a specified class, getting method source code by name, searching for methods by name, searching for classes by keyword (with pagination support), listing a class's methods and fields, getting a class's smali code, getting the main Activity class declared in AndroidManifest.xml, getting the code and name of the main application class by package name, getting the contents of AndroidManifest.xml, getting a specific manifest component, getting strings.xml, getting all resource file names, getting resource file contents, renaming classes/methods/fields/packages/variables, adding comments (which can target a class, method, field, or a single line of code; comments are displayed in JADX-GUI and saved with the project), listing comments in the project, getting debugger stack frames/threads/variables, and finding cross-references for classes/methods/fields (with pagination support).
How to use: Download jadx-ai-mcp-<version>.jar and jadx-mcp-server-<version>.zip from GitHub Releases. Configure the MCP client (such as Claude Desktop's claude_desktop_config.json; on Windows the path is %APPDATA%\Claude\claude_desktop_config.json, on macOS it is ~/Library/Application Support/Claude/claude_desktop_config.json), filling in the path to the uv executable and the absolute path to jadx-mcp-server. You can also install jadx_mcp_server directly as an executable and use it directly in the command of the MCP configuration. Clients such as Cherry Studio and LM Studio (configured via mcp.json) are supported. HTTP streaming mode is supported; run jadx_mcp_server.py with the --http option. The plugin provides GUI operations such as custom port, restoring the default port, restarting the server, and viewing server status; when connecting to a custom port, use the --jadx-port option, and when connecting to a remote JADX, use the --jadx-host option.
Applicable scenarios: rapid analysis of Android APKs, vulnerability discovery, reverse engineering assistance, static analysis, AI code modification, viewing documentation and metadata, debugging assistance, etc.
Limitations and security warnings: When using --host 0.0.0.0 (or any non-localhost address), the MCP server binds to all network interfaces, uses plaintext HTTP with no authentication, anyone on the network can connect and call all MCP tools, and there is no TLS encryption, so traffic can be intercepted; an attacker can use the server to read decompiled code, rename classes/methods, and access debugging information. Therefore, 0.0.0.0 should only be bound in a trusted isolated network (such as a Docker bridge or local VM), use a firewall to restrict access to the MCP port, or consider using an SSH tunnel (ssh -L 8651:127.0.0.1:8651 remote-host). In stdio mode (the default, without --http), all human-readable output (banners, health checks) is written to stderr, to keep stdout dedicated to the MCP JSON-RPC stream, ensuring compatibility with stdio-based MCP clients such as Codex and Claude Desktop. The project inherits JADX's Apache 2.0 license and is limited to educational, research, and ethical security assessment purposes; users must ensure they use it in an authorized environment.
