概要
What is apktool-mcp-server?
apktool-mcp-server is a fully automated MCP server built on top of ApkTool that integrates with the Model Context Protocol (MCP) to provide live reverse engineering support with LLMs like Claude. It targets reverse engineers, security researchers, and CTF players by enabling tasks such as vulnerability detection, manifest parsing, and AI-driven code modification.
How to use apktool-mcp-server?
Download the latest release from GitHub, install apktool and ensure it is in your PATH, then install uv for dependency management. Configure your MCP client (e.g., Claude Desktop or Cherry Studio) with a stdio command pointing to the uv executable with arguments --directory /path/to/apktool-mcp-server/ run apktool_mcp_server.py. The server exposes tools such as decode_apk(), get_manifest(), get_smali_file(), modify_smali_file(), and search_in_file() through the MCP interface.
Key features of apktool-mcp-server
- Decode APK files and extract resources and smali code.
- Retrieve AndroidManifest.xml and apktool.yml content.
- List and read smali directories and files.
- Modify smali and resource files programmatically.
- Search for patterns across all project files.
- Build an APK from a decoded project.
- Clean a project directory before rebuilding.
Use cases of apktool-mcp-server
- Vulnerability detection: analyze permissions, hardcoded URLs, and exported activities.
- AI code modification: patch smali methods or resource files automatically.
- Static analysis: review metadata, manifests, and resource configurations.
- Reverse engineering helpers: decode APKs, extract DEX files, and create test projects.
- CTF solving: interactively analyze and modify APK components in real time.
FAQ from apktool-mcp-server
What is the difference between apktool-mcp-server and apktool alone?
apktool-mcp-server is an MCP server that wraps ApkTool, adding a standardized interface for AI assistants to call apktool operations and provide context-aware code reviews, vulnerability analysis, and modification suggestions.
What runtime dependencies does apktool-mcp-server require?
The server requires Python 3.10 or newer, apktool installed and configured in the system PATH, uv for dependency management, and the Python packages httpx and fastmcp.
Where does the decoded APK data live?
All decoded project files are stored locally on the user’s filesystem in the project directory specified when using decode_apk() or build_apk().
What transport protocol does apktool-mcp-server use?
The server uses the stdio transport for MCP communication, configured via the command and args fields in the client’s MCP server configuration.
Does the server require any authentication or API keys?
No, the README does not mention any authentication or API key requirements. The server runs locally and communicates with the MCP client over stdio.
