DexAndroid MCP server
Commit Oct 18, 2026Enables AI clients to perform Android reverse-engineering, including APK unpacking, smali decompilation, and packer detection.
Also known as TimeCyber/DexAndroid
- Stars
- 2
- Tools
- 15
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Oct 18, 2026
- License
- MIT
What is DexAndroid MCP?
DexAndroid enables AI clients to perform Android reverse-engineering, including APK unpacking, smali decompilation, and packer detection. It exposes 15 tools, such as detect_packer, pull_apk, static_unpack.
Summary generated from the project's README
About DexAndroid MCP server
Performing Android reverse-engineering and smali analysis from within AI clients like Cursor, Claude Code, or Codex is what DexAndroid enables. This server provides a suite of tools for security researchers and developers to manage connected ADB devices, detect various packers such as Tencent or Alibaba, and unpack applications using multiple methodologies.
Users can choose between static unpacking for simple files, BlackDex for no-root memory dumps, or Frida for deep unpacking on rooted devices. The server facilitates the conversion of dex files to smali format using baksmali, allowing for granular code inspection. Once decompiled, the system supports searching for API strings, listing classes, and reading specific smali files to understand application logic.
Setup requires Node.js, Java 8 or higher, and ADB on your system path. While basic functions work with standard setups, advanced unpacking requires local binaries like frida-server or BlackDex placed in a tools directory. All unpacked files are saved to a local directory defined by the DEX_OUT_DIR environment variable.
What you can do with it
- 1Detecting application packersIdentify if an APK is protected by specific security providers like Bangcle or ijiami.
- 2Unpacking protected applicationsExtract business logic from protected apps using memory dumps when static methods fail.
- 3Searching for API endpointsUse regex patterns to find network URLs or sensitive API strings within smali code.
- 4Locating application entry pointsFind the main launcher activity and the onCreate method within the smali directory.
Written from the project's README. Every use case is checked against a quote from it.
DexAndroid MCP tools 15
Detected from the READMEdetect_packerpull_apkstatic_unpackblackdex_prepareblackdex_pullfrida_preparefrida_unpackdex_to_smalismali_list_classessmali_read_classsmali_searchfind_app_entry
| detect_packer | — | |
| pull_apk | — | |
| static_unpack | — | |
| blackdex_prepare | — | |
| blackdex_pull | — | |
| frida_prepare | — | |
| frida_unpack | — | |
| dex_to_smali | — | |
| smali_list_classes | — | |
| smali_read_class | — | |
| smali_search | — | |
| find_app_entry | — |
Show all 15 toolsShow fewer tools
apk_decodeapk_repacksmali_patch
| apk_decode | — | |
| apk_repack | — | |
| smali_patch | — |
Configuration
ADB_PATHDEX_OUT_DIR
| Name | Description | |
|---|---|---|
| ADB_PATH | — | |
| DEX_OUT_DIR | — |
Automated checks
Ran Nov 14, 2026Full report →Not verified yet. A server needs a score of 80, no serious finding, and enough data for us to check. How checks work
- Source repository linked and reachabletimecyber/dexandroid is public and reachablegithub.com/timecyber/dexandroid ↗Pass
- Package names this repository as its sourceNot checked
- Build provenance (Sigstore attestation)Not checked
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-10-18github.com/timecyber/dexandroid ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNot checked
- No critical advisory in the package or its dependenciesNot checked
- No hidden instructions to the model15 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNo tool named like delete, drop or execPass
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubDexAndroid---Android Decompile MCP
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Français · Deutsch · Português · Русский · العربية · हिन्दी · Bahasa Indonesia · Tiếng Việt · ไทย · Italiano · Türkçe
⚠️ For learning and teaching purposes only. Do not use this project for any illegal activity, unauthorized cracking, copyright infringement, or bypassing third-party protections. You must follow local laws and the target app’s terms. You are solely responsible for misuse.
Android unpacking + smali analysis MCP Server. Use from Cursor / Codex / Claude Code to manage devices, detect packers, unpack (static / BlackDex / Frida), convert dex→smali, and search API strings.
Repo: https://github.com/TimeCyber/DexAndroid · npm: android-decompile-mcp
Quick start (npm + MCP)
1. No clone — download & run from npm:
npx -y android-decompile-mcp
2. Load into Cursor / Claude / Codex — paste into .cursor/mcp.json (or global MCP config):
{
"mcpServers": {
"android-decompile-mcp": {
"command": "npx",
"args": ["-y", "android-decompile-mcp"],
"env": {
"ADB_PATH": "adb",
"DEX_OUT_DIR": "./unpack-output"
}
}
}
}
Save → restart the client / reload MCP. Done.
Optional global install: npm i -g android-decompile-mcp then run android-decompile-mcp.
Features
| Capability | MCP tool | Notes |
|---|---|---|
| Devices | list_devices |
Connected ADB devices |
| Packages | list_packages |
Optional keyword filter |
| Packer detect | detect_packer |
360 / Tencent / Bangcle / ijiami / Alibaba, etc. |
| Pull APK | pull_apk |
Installed app (+ splits) |
| Static unpack | static_unpack |
Extract classes*.dex |
| No-Root unpack | blackdex_prepare / blackdex_pull |
BlackDex memory dump |
| Root unpack | frida_prepare / frida_unpack |
frida-server + frida-dexdump |
| Decompile | dex_to_smali |
baksmali → smali |
| Analyze | smali_list_classes / smali_read_class / smali_search |
List / read / regex |
| Entry locate | find_app_entry |
MAIN/LAUNCHER + smali onCreate (read-only) |
| Decode / rebuild | apk_decode / apk_repack |
apktool decode + rebuild/sign |
Unpacking methods
| Method | Root? | Use when |
|---|---|---|
| Static | No | Unpacked apps or shell/resources only |
| BlackDex | No | Most protected apps |
| Frida | Yes | Strong packers / fuller dumps |
Requirements
- Windows / macOS / Linux (docs use Windows examples)
- Node.js ≥ 18
- ADB on PATH, or set
ADB_PATH - Java 8+ (for baksmali via
dex_to_smali) - Optional: BlackDex; rooted device +
frida-server;pip install frida-tools frida-dexdump
Place baksmali fat jar / frida-server / BlackDex under local tools/ (large binaries are gitignored).
Local development build
git clone https://github.com/TimeCyber/DexAndroid.git
cd DexAndroid
npm install
npm run build
npm start
Environment variables
| Variable | Meaning | Default |
|---|---|---|
ADB_PATH |
adb executable | adb |
DEX_OUT_DIR |
Default output dir | <cwd>/unpack-output |
BAKSMALI_JAR |
baksmali jar | auto-discover under tools/ |
Typical workflows
1. Static unpack (fastest)
list_devicesor prepare localapkPath.detect_packer.static_unpack→classes*.dex.dex_to_smali→ smali folder.smali_search/smali_read_class.
Note: Protected apps often yield only the shell via static unpack—use BlackDex / Frida for business code.
2. No-Root (BlackDex)
list_devices.blackdex_preparewithblackdexApkPath.- Unpack the target app in BlackDex UI.
blackdex_pullwithtargetPkg.dex_to_smalithensmali_*.
3. Root (Frida)
- Rooted device (e.g. Magisk),
adbready. frida_prepareto push/starttools/frida-server.- Matching
frida/frida-dexdumplocally (prefer 16.x). frida_unpackwithpkg, preferspawn: true,deepSearch: true.dex_to_smalion output, then analyze.
If Frida 17 attach fails, align tools to 16.x; some devices need temporary setenforce 0.
4. smali analysis examples
smali_list_classes smaliDir=.../smali keyword=login
smali_search smaliDir=.../smali pattern=https?://|/api/|publicClient/
smali_read_class smaliDir=.../smali className=com.example.api.ApiService
Layout
DexAndroid/
├── src/ # MCP server (TypeScript)
│ ├── index.ts
│ ├── adb.ts
│ ├── detect.ts
│ ├── smali.ts
│ └── unpack/
├── dist/
├── examples/ # Damai / Huaxi sample smali.zip + docs
├── skills/ # Canonical agent skills (edit here, then sync)
├── .cursor/skills/ # Cursor copy
├── .agents/skills/ # Codex copy
├── .claude/skills/ # Claude Code copy
├── tools/ # baksmali / frida-server / BlackDex (local)
├── unpack-output/ # local dumps (gitignored)
├── package.json
└── README.md
Agent skills (Cursor / Codex / Claude Code)
After unpacking, use android-api-smali-analysis so the agent recovers headers, body, encrypt/decrypt methods, and keys (smali / .so / server-delivered), not path-only notes.
| Client | Skill path |
|---|---|
| Canonical | skills/android-api-smali-analysis/SKILL.md |
| Cursor | .cursor/skills/android-api-smali-analysis/ |
| Codex | .agents/skills/android-api-smali-analysis/ |
| Claude Code | .claude/skills/android-api-smali-analysis/ (/android-api-smali-analysis) |
Edit the canonical file, then sync copies:
node tools/sync-skills.mjs
See skills/README.md.
Decompile examples
See examples/ (smali shipped as zip):
| Sample | Path | Contents |
|---|---|---|
| Damai | examples/damai/ |
Frida smali.zip + API docs |
| Huaxi Maternity | examples/huaxi/ |
Static smali.zip (info.cd120.two) |
After unzip, run smali_list_classes / smali_search / smali_read_class.
MCP tool cheatsheet
| Tool | Params |
|---|---|
detect_packer |
apkPath or pkg, optional serial |
pull_apk |
pkg, optional outDir / serial |
static_unpack |
apkPath or pkg, optional outDir |
blackdex_prepare |
blackdexApkPath, optional serial |
blackdex_pull |
targetPkg, optional outDir / serial |
frida_prepare |
optional serial / serverLocalPath |
frida_unpack |
pkg, optional spawn / deepSearch / outDir |
dex_to_smali |
dexInput, optional outDir |
smali_list_classes |
smaliDir, optional keyword |
smali_read_class |
smaliDir, className |
smali_search |
smaliDir, pattern, optional flags / maxResults |
find_app_entry |
projectDir / manifestPath / apkPath, optional smaliDir（只读定位入口） |
apk_decode |
apkPath, optional outDir（apktool 解码） |
apk_repack |
projectDir, optional outApk / keystore 参数（重建并签名） |
smali_patch |
mode + smaliPath/projectDir；调用方 content 或 insert_verify_log |
FAQ
Q: Empty list_devices?
Check USB debugging, adb devices, pass serial if multiple.
Q: No business classes after static unpack?
Likely packed—use BlackDex or Frida.
Q: dex_to_smali failed?
Install Java; put baksmali jar in tools/ or set BAKSMALI_JAR.
Q: Frida jailed / version mismatch?
Keep frida-server and host frida major versions aligned; try 16.x.
Q: Where is output?
Default unpack-output/ (or DEX_OUT_DIR). Do not commit dumps.
Legal & disclaimer
This project is only for learning, teaching, and authorized security research. It is strictly forbidden to use it for any criminal or illegal activity, including unauthorized access, cracking, piracy, attacking systems, or IP infringement. Authors and contributors are not liable for misuse. By using this software you agree to these terms.
⚠️ For learning and teaching purposes only. Do not use this project for any illegal activity, unauthorized cracking, copyright infringement, or bypassing third-party protections. You must follow local laws and the target app’s terms. You are solely responsible for misuse.
License
MIT — see LICENSE.
DexAndroid MCP questions
What tools does DexAndroid MCP provide?
It exposes 15 tools, including detect_packer, pull_apk, static_unpack, blackdex_prepare, blackdex_pull.
What should I do if list_devices returns empty?
Check your USB debugging settings and run 'adb devices'. If you have multiple devices connected, pass the specific serial number.
Why are there no business classes after a static unpack?
The application is likely protected by a packer; you should use BlackDex or Frida instead.
How do I fix a dex_to_smali failure?
Ensure Java is installed and place the baksmali jar in the tools/ directory or specify the path using the BAKSMALI_JAR environment variable.
Where are the unpacked files saved?
Files are saved to the 'unpack-output/' directory by default, or the directory specified by the DEX_OUT_DIR environment variable.