John Smith
fb74beb6f4
Fresh re-import of the project. The prior history of the Heretek-AI/Android-RE repository was rebuilt from a single squashed initial commit per the project's vendor-neutrality policy (see CLAUDE.md for the policy and translation table). The audit trail for the rebuild is preserved at /tmp/sanitize/pre-destroy/ on the analyst host. The redaction spec is at /tmp/sanitize/redacts.json; the audit decision log is at /tmp/sanitize/audit-decision.md.
6.0 KiB
MCP Tool Reference
Auto-generated reference for every tool exposed by every Android-RE MCP server. Source of truth is the
mcp_servers/<server>/src/.../server.pyFastMCPregistration. If this page drifts from the code, the code wins.
Output convention
Every file-producing MCP tool accepts an output_path (single file) or
output_dir (directory) parameter. When omitted, the path is derived
from
android_re_core.paths.output_dir_for(apk_path):
Output/<apk-basename>-<short-sha>/<subdir>/<file>
Override the base with the ANDROID_RE_OUTPUT_DIR env var (read once
at import time of android_re_core.paths). The default base is
<repo-root>/Output/; the directory is git-ignored. The full
convention is documented in output-convention.md.
| Tool | Default subdir | Default filename |
|---|---|---|
finalize_triage |
Output/<apk>-<sha>/<triage_id>/ |
triage-<id>.{md,json,sarif} |
get_masvs_coverage |
Output/<apk>-<sha>/masvs/ |
coverage.json |
build_sarif_report |
Output/<apk>-<sha>/masvs/ |
report.sarif |
scan_secrets |
Output/<apk>-<sha>/secrets/ |
secrets-findings.json |
scan_with_quark |
Output/<apk>-<sha>/secrets/quark/ |
(quark's native layout) |
run_androwarn |
Output/<apk>-<sha>/secrets/ |
androwarn.json |
build_native_report |
Output/<apk>-<sha>/native/ |
native-report.json |
build_session_report |
Output/<apk>-<sha>/dynamic/ |
session-report.json |
rebuild_apk |
Output/<apk>-<sha>/repackage/ |
rebuilt.apk |
create_gradle_project |
(required) | n/a |
take_screenshot |
Output/<apk>-<sha>/dynamic/ |
screenshot-<ts>.png |
screenrecord |
Output/<apk>-<sha>/dynamic/ |
screenrecord-<ts>.mp4 |
dump_heap |
(required) | n/a |
setup_mitm |
Output/<apk>-<sha>/network/ |
n/a |
Servers
| Server | Module |
|---|---|
android-re-static |
mcp_servers.static.android_re_mcp_static |
android-re-native |
mcp_servers.native.android_re_mcp_native |
android-re-dynamic |
mcp_servers.dynamic.android_re_mcp_dynamic |
android-re-triage |
mcp_servers.triage.android_re_mcp_triage |
mcp_bridge |
mcp_bridge (TypeScript) |
android-re-static
26 tools (Phase 1 + 2 + 3 + Decompilation pipeline).
Project lifecycle:
open_project(apk_path, project_id?, max_size?) -> {project_id, sha256, size, ...}close_project(project_id) -> {ok}list_projects() -> [ProjectSummary]
Manifest:
read_manifest(project_id, formatted?) -> manifest XML or structuredlist_components(project_id, component_type?) -> [Component]get_permissions(project_id, classification?) -> [Permission]
DEX:
find_classes(project_id, query, limit?, exact?) -> [Class]find_methods(project_id, class_name?, name_substring?, native_only?, limit?) -> [Method]
Decompilation (jadx):
decompile_class(project_id, class_name, deobfuscate=False, threads=None, output_format="java") -> {source, found, workdir, deobfuscated, output_format}decompile_method(project_id, class_name, method_name, descriptor, deobfuscate=False, output_format="java") -> {source, found, start_line, end_line, full_class_source, workdir, reason}— slices the decompiled class by method signature;start_line/end_lineare 1-indexed.decompile_apk(project_id, force=False, deobfuscate=False, threads=None, output_format="java", limit=500, offset=0) -> {class_count, files, total_files, truncated, jadx_duration_s}— enumerates the decompiled tree.read_source(project_id, path, deobfuscate=False, output_format="java") -> {content, found, line_count, byte_size, reason}— reads a file by path; refuses..and files > 10 MB.
Smali / repackage:
get_smali(project_id, class_name) -> {smali, found, workdir}decode_apk(project_id, force=False) -> {workdir, class_count, smali_dirs, manifest_path}rebuild_apk(project_id, output_path?, confirm=False) -> {output_path, size}— requiresconfirm=true.patch_manifest(project_id, patch, confirm=False) -> {applied, changes, ...}— dry-run by default.
Signing:
verify_signature(project_id) -> {signed, versions, signers, ...}get_certificate_info(project_id, signer_index?) -> {subject, issuer, ..., fingerprint_sha256}
Native (delegated from android-re-native):
list_native_libs(project_id) -> [lib_path]analyze_elf(project_id, lib_name) -> {format, architecture, security, sections, imports, exports}disassemble_native(project_id, lib_name, symbol?, offset?, length?, max_instructions?) -> [instruction]
Secrets / reports:
scan_secrets(project_id, rules="default", limit=500) -> [SecretFinding]scan_with_quark(project_id, timeout_s=300) -> {matched_rules}run_androwarn(project_id, timeout_s=300) -> [Warning]build_sarif_report(project_id) -> SARIF logget_masvs_coverage(project_id) -> {by_group, controls, findings}
Each decompile tool caches its workdir under
/tmp/android-re/<project_id>-jadx-{deobf,plain}-{java,kotlin}/.
deobfuscate and output_format are part of the cache key.
android-re-native
(Phase 2) 19 tools — see mcp_servers/native/src/.../server.py.
android-re-dynamic
(Phase 3) 30+ tools — see mcp_servers/dynamic/src/.../server.py.
android-re-triage
(Phase 4) 12 tools — orchestrator; composes the other three.
mcp_bridge (TypeScript)
(Phase 3) 18 tools — ADB / screencap / logcat / frida-ps.
MCP resources
| Resource URI | Provided by |
|---|---|
apk://<project_id>/manifest |
android-re-static |
apk://<project_id>/smali/<fqcn> |
android-re-static |
apk://<project_id>/source/<fqcn> |
android-re-static |
native://<project_id>/lib/<lib_name>/... |
android-re-native |
device://<serial>/<topic> |
mcp_bridge |