RELATED 01
REA
Local reverse-engineering toolkit for binaries, apps, websites and Android devices over MCP
440kGitHub stars
482k/wknpm downloads
123popularity score
asc-mcp
Read-only static analysis of Android APK, DEX, JAR and AAR files for MCP clients
By Aimar Sechan Adhitya (individual) Python Local · stdio SecurityDeveloper tools
16 popularity score ★ 20
Connect your client
Local (from source)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
FirstTerminal
git clone https://github.com/aimardcr/asc-mcp
cd asc-mcp
python -m pip install .Claude CodeTerminal
claude mcp add asc -- asc-mcpClaude Desktopclaude_desktop_config.json
{
"mcpServers": {
"asc": {
"command": "asc-mcp",
"args": []
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"asc": {
"command": "asc-mcp",
"args": []
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"asc": {
"type": "stdio",
"command": "asc-mcp",
"args": []
}
}
}Codex~/.codex/config.toml
[mcp_servers.asc]
command = "asc-mcp"
args = []Gemini CLITerminal
gemini mcp add --scope user asc asc-mcpSettings 6
ASC_MCP_ALLOWED_ROOTS |
Optional: Directories artifacts may be opened from, separated by : (; on Windows); defaults to the working directory. |
|---|---|
ASC_MCP_WORKERS |
Optional: Number of analysis worker processes; defaults to up to 4 CPUs. |
ASC_MCP_TRANSPORT |
Optional: stdio (default) or streamable-http. |
ASC_MCP_HOST |
Optional: HTTP bind address, 127.0.0.1 by default. |
ASC_MCP_PORT |
Optional: HTTP port, 8000 by default. |
ASC_MCP_HTTP_PATH |
Optional: Streamable HTTP endpoint path, /mcp by default. |
What it does
asc-mcp is a local Python server that opens Android build artifacts and answers structured questions about them without changing anything. After an artifact is loaded with load_artifact, the client works against the returned analysis_id: reading the manifest and declared components (including effective provider permissions), listing classes and their outlines, decompiling a single class to Java on demand, disassembling methods to Dalvik bytecode, and searching for where methods, fields, types or string constants are used. Each reference hit comes with the opcode, byte offset inside the calling method and whether it is a read, write, invoke or load.
It also inventories archive entries and native libraries, decodes binary XML resources, reports APK signing schemes and certificate fingerprints, scans for embedded secrets, and compares the class inventories of two loaded versions. Besides tools it offers two resource templates (the decoded manifest and a decompiled class) and three prompts: artifact_triage, trace_behavior and compare_artifacts.
It is a continuation of Droid ASC by MG1937, whose direct DEX querying and on-demand decompilation engine it builds on, with Androguard underneath. The code at version 0.2.0 registers 25 tools. List and search tools return 200 results per page by default and accept a limit of up to 1000; apk_get_call_graph walks 1 level by default and at most 3; apk_get_resource_content returns 128 KiB by default and at most 1 MiB with max_bytes (server.py).
What it needs
| Runtime | Python 3.10+ |
|---|
Python 3.10 or newer and a clone of the GitHub repository installed with pip (it pulls in androguard, mcp 2.x and mutf8). The Android artifacts to analyse must sit under a directory listed in ASC_MCP_ALLOWED_ROOTS, or under the server's working directory when that setting is not given. No account or API key is needed.
Limits
Not published on PyPI: the package named asc-mcp there is an unrelated App Store Connect server, so install from the repository rather than with pip install asc-mcp. JVM bytecode is not decompiled; plain JAR and AAR files give class and archive inventories only, and .aab, .apks, .xapk and .zip get archive inventory plus analysis of DEX files placed directly inside. Operations a format cannot support (such as signing data for a DEX file) return an error. apk_diff compares class inventories and hashes, not code behaviour. The quoted speed figures come from the original Droid ASC benchmark, not this server.
Who it suits
Suits security researchers and Android developers who want an assistant to triage or trace behaviour in an APK on their own machine, with no network service or account involved and no way for the tools to modify, rebuild or sign the artifact. It is a static reader only: anyone needing dynamic analysis, device interaction or JVM class decompilation of ordinary JARs needs other tooling. The streamable-http mode carries no sign-in of its own, so stdio is the better fit unless it is placed behind an authenticated boundary.
Tools 25
load_artifact- Open an allowed APK, DEX, JAR or archive and return an analysis_id with its capabilities
close_artifact- Release a loaded artifact and its analysis state
server_status- Report worker count and open analyses
apk_get_summary- Overview of a loaded artifact: package, SDK levels, contents
apk_get_manifest- Structured manifest with components, permissions and provider access
apk_get_signing_info- Signing schemes and certificate fingerprints
apk_list_classes- Page through class names, filtered by name
apk_get_class_outline- Fields and methods of one class with exact descriptors
apk_get_class_source- Decompile one class to Java source on demand
apk_get_class_hierarchy- Superclass, interfaces, subclasses and implementors of a class
apk_disassemble_method- Dalvik disassembly of one method
apk_get_call_graph- Callers and callees of a method, 1 to 3 levels deep
apk_get_string_constants- String constants loaded by a class or method
apk_search_method_bodies- Search rendered opcode and operand text across methods
apk_find_method_references- Call sites of a method with opcode and offset evidence
apk_find_field_references- Reads and writes of a field with evidence
apk_find_type_instructions- new-instance, check-cast, const-class and similar uses of a type
apk_find_string_references- Where matching strings are loaded in code
apk_search_members- Find declared methods or fields by name
apk_search_strings- Search literal values in the DEX string pool
apk_scan_secrets- Look for embedded keys, tokens and other secrets
apk_list_entries- List the files inside the archive
apk_get_resource_content- Read one entry, decoding text or binary XML
apk_list_native_libraries- List bundled native libraries by ABI
apk_diff- Compare class inventories and hashes of two loaded artifacts