android-apk-orchestrator
Provides orchestrated reverse engineering of Android APK files, including decompilation, native library analysis, malware inspection, API extraction, protocol reverse engineering, and consolidated report generation.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@android-apk-orchestrator analyze this APK and generate the unified report"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Android APK Orchestrator
把这七个 Codex 安卓逆向 skill 合成 一个 skill + 一个 MCP 服务器:
android-reverse-engineeringghidra_idareverseengineeringskillghidra-rpc-mainprotocol-reverse-engineeringreverse-api-engineer-mainreverse-engineering-android-malware-with-jadxreverse-engineering-tools
APK 进来后,调度器按 DAG 把工作分给七个 specialist agent 并行跑,再汇总 REPORT.md。Codex 父代理只读本 skill,子代理才去加载各自原来的 SKILL.md。
架构
User / Codex
| $android-apk-orchestrator
v
MCP android-apk-orchestrator
| apk_orchestrate
+-- wave1 parallel: decompile | native | tools
+-- wave2 parallel: malware | api | protocol | ghidra_rpc
v
case/
original/ 原始 APK 副本
fingerprint.json
derived/jadx/ 反编译
derived/native/ .so
derived/api_client.py
agents/<name>/result.json
REPORT.mdRelated MCP server: APK Security Guard MCP Suite
安装
cd D:\HaizhuAI\android-apk-orchestrator
powershell -ExecutionPolicy Bypass -File .\scripts\install.ps1安装脚本会:
uv sync装 MCP / androguardjunction
~/plugins/android-apk-orchestratorjunction
~/.codex/skills/android-apk-orchestrator写入 Codex
config.toml的 MCP 条目
然后新开一条 Codex 线程。
命令
uv run python -m android_apk_orchestrator agents
uv run python -m android_apk_orchestrator fingerprint .\app.apk
uv run python -m android_apk_orchestrator orchestrate .\app.apk -o .\app_case
uv run python -m android_apk_orchestrator orchestrate .\app.apk -o .\app_case --extras .\capture.har --agents decompile,malware,api
uv run python -m android_apk_orchestrator serve无参数启动即 MCP stdio。
MCP tools
apk_list_agentsapk_create_caseapk_fingerprintapk_orchestrateapk_dispatchapk_statusapk_report
Codex 用法
把 APK 丢给 Codex 并说「反编译 / 安卓逆向 / 提取 API」。本 skill 会隐式激活,先跑 apk_orchestrate,再按 references/agent-contracts.md 把七个插件分给子智能体。
测试
uv run pytest -qAvailable Tools
7 toolsapk_create_caseC
Hash and preserve an APK/XAPK, then write a case workspace.
Inputs: apk_path (required), extras, case_dir. Returns: object
apk_dispatchB
Run selected specialist agents in wave order against an existing case.
Inputs: case_dir (required), agents. Returns: object
apk_fingerprintA
Fast framework/HTTP/SDK/native fingerprint without a full decompile.
Inputs: apk_path (required). Returns: object
apk_list_agentsA
List the seven specialist agents, source skills, and availability.
Inputs: no named parameters. Returns: object
apk_orchestrateC
Run the full 7-agent Android reverse pipeline and write REPORT.md.
Inputs: apk_path (required), agents, extras, case_dir. Returns: object
apk_reportC
Return the synthesized report path and agent index if present.
Inputs: case_dir (required). Returns: object
apk_statusC
Read case status.json written by the orchestrator.
Inputs: case_dir (required). Returns: object
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 7 tools
Each tool targets a distinct stage or concern in the APK orchestration pipeline: agent discovery, case creation, fingerprinting, dispatch, full orchestration, status, and report retrieval. Even status and report are clearly separated: status reads the machine-readable state, while report returns the synthesized output path.
All tools share the consistent 'apk_' prefix and mostly follow a verb-like action pattern such as list, create, dispatch, orchestrate. Minor deviations are apk_status and apk_report, which read more like noun endpoints than actions, but the overall convention remains predictable and readable.
Seven tools is well-scoped for an APK orchestration server. Each tool maps to a meaningful workflow step without redundancy or unnecessary surface area, and the count supports both targeted operations and a full pipeline run.
The tool set covers the full orchestration lifecycle: discovery, case creation, targeted analysis, dispatch, full pipeline execution, status polling, and report access. Minor gaps exist around managing existing cases or retrieving individual agent artifacts, but agents can complete the core workflow without dead ends.
Maintenance
Related MCP Connectors
MCP server for static security analysis of Android source code
Scan Android and iOS apps for security issues: findings, MASVS mapping and pentest reports.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Cloud Android phones for AI agents: create a phone, read the screen, tap, type, install APKs, park.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides a one-stop automated solution for Android APK security analysis by integrating tools like JEB, JADX, APKTOOL, FlowDroid, and MobSF into unified MCP standard API interfaces.11-
- FlicenseNot gradedqualityDmaintenanceIntegrates multiple Android APK security analysis tools into MCP standard APIs for automated static and dynamic analysis and vulnerability detection.-
- AlicenseNot gradedqualityNot gradedmaintenanceEnables AI agents to perform autonomous Android security analysis, including static analysis, dynamic analysis, and Frida instrumentation, powered by MobSF.4MIT
- FlicenseNot gradedqualityBmaintenanceEnables Android APK security auditing through natural language by decompiling APKs with Apktool and running static analysis heuristics for attack surface, permissions, secrets, crypto, native libraries, and more, with every analysis logged to disk as markdown reports.-