Summary
An agent can take an APK apart and tell you what is inside it.
Decode once, then ask for the manifest, the permissions, the hardcoded strings or a pattern in the smali — and rebuild when you have changed something. The tool chain stays where it belongs, behind a question.
What it is
An MCP server in front of Apktool. It runs decode and build on your machine and exposes the parts of a decompiled APK — manifest, permissions, string resources, smali — as separate calls, alongside prompts for security, privacy and reverse-engineering workflows.
What you get
- An APK decoded into resources, manifest and smali code
- AndroidManifest.xml parsed into permissions and components
- Every requested permission enumerated
- String resources extracted, with locale support
- Smali code searched for a pattern across the decompiled tree
- Basic APK metadata read back
- System frameworks installed, for analysing system apps
- A modified source directory recompiled into an APK
Requirements
A Java JDK, because Apktool runs on it, and Python for the server. Everything runs locally against the APK file you point it at.
Setup effort
One command — pip install -r requirements.txt