JADX gets an MCP port: let LLMs query APK guts directly

What it does

JADX-AI-MCP is a JADX plugin paired with a Python MCP server that turns the Android decompiler into an LLM-readable workspace. It exposes the guts of a decompiled APK—Java sources, smali, manifests, resources, and even live debugger variables—as structured tools an LLM can call through the Model Context Protocol. The model asks for a specific class or cross-reference; the plugin fetches it from the current JADX session and returns it.

The interesting bit

Instead of dumping megabytes of decompiled code into a chat window, the model can paginate through cross-references, rename obfuscated symbols on the fly, or inspect stack frames while you debug. That keeps context windows small and grounds reasoning in the actual binary rather than a stale copy-paste.

Key highlights

• ~25 MCP tools, from get_class_source() and get_smali_of_class() to xrefs_to_method() and manifest parsing
• Supports live debugger introspection: stack frames, threads, and variables
• Can rename classes, methods, fields, and packages programmatically via the LLM
• Paginated search and cross-reference lookups for large codebases
• Part of the broader Zin MCP Suite, which includes APKTool and a dedicated client

Caveats

• The README explicitly warns the project is early-stage and expects bugs, crashes, and logical errors
• Requires two separate components—a Java plugin and a Python server—to function
• Tool documentation is mostly a terse list; how gracefully the LLM handles large or obfuscated apps is unclear

Verdict

Android reverse engineers and pentesters who live in JADX and want an AI assistant that can actually read the binary should try it. If you need a single-install, production-polished tool, wait for the rough edges to smooth out.