android-apk-orchestrator
# Android APK Orchestrator
把这七个 Codex 安卓逆向 skill 合成 **一个 skill + 一个 MCP 服务器**：
1. `android-reverse-engineering`
2. `ghidra_idareverseengineeringskill`
3. `ghidra-rpc-main`
4. `protocol-reverse-engineering`
5. `reverse-api-engineer-main`
6. `reverse-engineering-android-malware-with-jadx`
7. `reverse-engineering-tools`
APK 进来后，调度器按 DAG 把工作分给七个 specialist agent 并行跑，再汇总 `REPORT.md`。Codex 父代理只读本 skill，子代理才去加载各自原来的 `SKILL.md`。
## 架构
```
User / Codex
| $android-apk-orchestrator
v
MCP android-apk-orchestrator
| apk_orchestrate
+-- wave1 parallel: decompile | native | tools
+-- wave2 parallel: malware | api | protocol | ghidra_rpc
v
case/
original/ 原始 APK 副本
fingerprint.json
derived/jadx/ 反编译
derived/native/ .so
derived/api_client.py
agents/<name>/result.json
REPORT.md
```
## 安装
```powershell
cd D:\HaizhuAI\android-apk-orchestrator
powershell -ExecutionPolicy Bypass -File .\scripts\install.ps1
```
安装脚本会：
- `uv sync` 装 MCP / androguard
- junction `~/plugins/android-apk-orchestrator`
- junction `~/.codex/skills/android-apk-orchestrator`
- 写入 Codex `config.toml` 的 MCP 条目
然后新开一条 Codex 线程。
## 命令
```powershell
uv run python -m android_apk_orchestrator agents
uv run python -m android_apk_orchestrator fingerprint .\app.apk
uv run python -m android_apk_orchestrator orchestrate .\app.apk -o .\app_case
uv run python -m android_apk_orchestrator orchestrate .\app.apk -o .\app_case --extras .\capture.har --agents decompile,malware,api
uv run python -m android_apk_orchestrator serve
```
无参数启动即 MCP stdio。
## MCP tools
- `apk_list_agents`
- `apk_create_case`
- `apk_fingerprint`
- `apk_orchestrate`
- `apk_dispatch`
- `apk_status`
- `apk_report`
## Codex 用法
把 APK 丢给 Codex 并说「反编译 / 安卓逆向 / 提取 API」。本 skill 会隐式激活，先跑 `apk_orchestrate`，再按 `references/agent-contracts.md` 把七个插件分给子智能体。
## 测试
```powershell
uv run pytest -q
```
TDQS
Scored across 7 tools
Each tool targets a distinct stage or concern in the APK orchestration pipeline: agent discovery, case creation, fingerprinting, dispatch, full orchestration, status, and report retrieval. Even status and report are clearly separated: status reads the machine-readable state, while report returns the synthesized output path.
All tools share the consistent 'apk_' prefix and mostly follow a verb-like action pattern such as list, create, dispatch, orchestrate. Minor deviations are apk_status and apk_report, which read more like noun endpoints than actions, but the overall convention remains predictable and readable.
Seven tools is well-scoped for an APK orchestration server. Each tool maps to a meaningful workflow step without redundancy or unnecessary surface area, and the count supports both targeted operations and a full pipeline run.
The tool set covers the full orchestration lifecycle: discovery, case creation, targeted analysis, dispatch, full pipeline execution, status polling, and report access. Minor gaps exist around managing existing cases or retrieving individual agent artifacts, but agents can complete the core workflow without dead ends.