Fully-automated Model Context Protocol (MCP) server that wraps Apktool to decode/build APKs and exposes reverse-engineering utilities to LLMs (e.g. Claude) for live code review, vulnerability scanning and smali/resource editing.
https://github.com/zinja-coder/apktool-mcp-serverSkip the tedious manual APK analysis. This MCP server connects Apktool directly to Claude, giving you an AI assistant that can decode APKs, analyze smali code, hunt for vulnerabilities, and modify Android apps in real-time conversation.
Instead of bouncing between Apktool commands, text editors, and manual analysis, you get a conversational interface where Claude can:
This isn't just automation - it's having an AI pair programmer who understands Android internals, smali syntax, and common security patterns.
Before: Decode APK → manually grep through hundreds of smali files → cross-reference with manifest → piece together the attack surface → make modifications → rebuild → repeat
After: "Analyze this APK for exported components that handle intents without proper validation" and get a complete analysis with specific file references and suggested fixes.
The server provides 12 specialized tools that Claude can use autonomously:
decode_apk() - Full APK decoding with resource extractionget_manifest() / get_apktool_yml() - Metadata analysislist_smali_files() / get_smali_file() - Navigate and read smali codemodify_smali_file() - Make precise code changessearch_in_file() - Pattern hunting across the codebasebuild_apk() - Rebuild modified APKsSecurity Audits: "Find all uses of crypto functions and check if they're using hardcoded keys"
CTF Challenges: "Analyze this APK and find the flag - look for hidden activities or obfuscated strings"
Malware Analysis: "Trace data exfiltration paths - find where this app sends user data externally"
App Modification: "Patch the license check in MainActivity to always return true and rebuild the APK"
Vulnerability Research: "Scan for SQL injection vectors in database query construction"
The server plugs into Claude Desktop, Cherry Studio, or any MCP-compatible client. You can also use it with local LLMs via the companion Zin MCP Client for complete privacy when analyzing sensitive APKs.
Setup is straightforward - install Apktool, download the server, and add the configuration to your LLM client. The server handles all the Apktool complexity behind the scenes.
This server works alongside other tools in the Zin Reverse Engineering MCP Suite:
You can run multiple servers simultaneously, giving Claude access to both Apktool and JADX workflows in the same conversation.
apktool -versionThe repository includes extensive sample prompts covering everything from basic code understanding to advanced vulnerability hunting and AI-assisted code modification.
This tool turns Android reverse engineering from a manual, error-prone process into an interactive analysis session with an AI that understands your goals and the Android ecosystem.
Links: