# 1. Set up the project folder
mkdir static-apk-auditor && cd static-apk-auditor

# 2. Create a venv and install the one dependency
python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate
pip install -r requirements.txt

# 3. Sanity check — should hang waiting for stdio input, Ctrl+C to stop
python3 server.py

# 4. Register with Claude Code (adjust paths to your actual location)
claude mcp add static-apk-auditor \
  --env APKTOOL_WORK_DIR=$(pwd)/data \
  -- $(pwd)/venv/bin/python3 $(pwd)/server.py

# 5. Verify it connected
claude mcp list

/mcp__static-apk-auditor__security_audit
/absolute/path/to/some.apk

Decompile /absolute/path/to/some.apk and give me a quick security triage.

static-apk-auditor/                  # your folder can be named anything — this is just an example
├── server.py                    # the MCP server — single file, FastMCP-based
├── requirements.txt              # just "mcp"
├── README.md                     # this file
├── prompts/
│   ├── security_audit.md         # 16-point checklist, OWASP Mobile Top 10 mapping
│   └── mobsf_review.md           # MobSF finding validation workflow
├── venv/                         # created locally, not part of the repo
└── data/                         # created automatically on first decode_apk call
                                   # (this is APKTOOL_WORK_DIR — see Configuration below)

$APKTOOL_WORK_DIR/<apk_filename_without_extension>/
├── source/
│   └── <original>.apk           # copy of the APK you pointed the tool at
├── decoded/
│   ├── AndroidManifest.xml
│   ├── smali/, smali_classes2/, ...
│   ├── res/, assets/, lib/
│   └── ...                      # apktool's decompiled output
├── reports/
│   ├── 20260706_175359_809_decode_apk.md
│   ├── 20260706_175412_112_analyze_manifest.md
│   ├── 20260706_175430_501_check_root_detection.md
│   └── ...                      # one markdown file per tool call, ever
└── final_reports/
    ├── 20260706_223500_123_security_audit.md
    └── 20260706_224100_456_mobsf_review.md
                                   # the finished, synthesized reports
                                   # (Summary + Detailed Findings + Risk Table),
                                   # saved explicitly via save_final_report

# Ubuntu/Debian
sudo apt update && sudo apt install default-jdk

# macOS
brew install openjdk
java -version

# Ubuntu/Debian
sudo apt install apktool

# macOS
brew install apktool
apktool --version

python3 --version

brew install aapt   # or: brew install --cask android-commandlinetools

git clone <your-repo-or-just-copy-the-files> static-apk-auditor
cd static-apk-auditor
python3 -m venv venv
source venv/bin/activate      # Windows: venv\Scripts\activate
pip install -r requirements.txt

python3 server.py
# Should hang waiting for stdio input (that's normal) — Ctrl+C to stop.

claude mcp add apktool-pro \
  --env APKTOOL_WORK_DIR=/absolute/path/to/static-apk-auditor/data \
  -- /absolute/path/to/static-apk-auditor/venv/bin/python3 /absolute/path/to/static-apk-auditor/server.py

claude mcp list
claude mcp get apktool-pro   # should show "✔ Connected"

{
  "mcpServers": {
    "apktool-pro": {
      "command": "/absolute/path/to/static-apk-auditor/venv/bin/python3",
      "args": ["/absolute/path/to/static-apk-auditor/server.py"],
      "env": {
        "APKTOOL_WORK_DIR": "/absolute/path/to/static-apk-auditor/data"
      }
    }
  }
}

Use decode_apk to decompile /path/to/app.apk

/apktool-pro:security_audit apk_path="/path/to/app.apk"

Use check_root_detection on the decompiled output

/apktool-pro:mobsf_review apk_path="/path/to/app.apk" mobsf_report_path="/path/to/mobsf_report.json"

# upload the APK, get back a hash
curl -F 'file=@/path/to/app.apk' http://localhost:8000/api/v1/upload \
  -H "Authorization: <MOBSF_API_KEY>"

# fetch the JSON report using that hash
curl -X POST http://localhost:8000/api/v1/report_json \
  -H "Authorization: <MOBSF_API_KEY>" \
  --data "hash=<hash_from_upload>" -o mobsf_report.json