<div align="center">

# Android REA

### Android reverse engineering for AI agents.

Inspect APKs, trace runtime behavior, and connect screen actions to code through one MCP server.

[Quick start](#quick-start) · [Documentation](#documentation) · [Skill](skills/android-rea/SKILL.md)

</div>

Android REA combines static analysis, Frida instrumentation, and ADB in a standalone **Skill + MCP** toolkit. The Skill guides your agent; the MCP server runs the tools. Static providers are derived from [REA](https://github.com/morluto/rea).

## What you can analyze

| Target | Tools and results |
| --- | --- |
| APKs and resources | JADX and Apktool: classes, methods, references, manifests, and strings |
| Native libraries | Ghidra: ELF/SO disassembly, decompilation, and cross-references |
| Runtime behavior | Frida: selected Java, JNI, and native calls, arguments, and return values |
| App screens | ADB: screenshots, UI inspection, taps, and evidence linked to runtime events |

## Quick start

Requires Python 3.11+, Node.js 22.19+ with npm, JDK 21+ with `JAVA_HOME` set, and ADB on PATH. For native static analysis, install Ghidra and set `GHIDRA_HOME`.

From the repository checkout:

```sh
node bin/android-rea.mjs setup
```

Choose Codex, Claude Code, Cursor or Gemini CLI, review the plan and confirm. Setup installs dependencies, checks the host, backs up and updates the selected agents' MCP settings and Skill, then verifies a real MCP connection. Restart or reload the selected agent afterward.

For unattended setup, use `setup --agent codex --yes`; use `setup --agent codex --dry-run` to preview without changes. See [agent setup](docs/agents.md) for multiple agents, configuration paths and manual setup.

Runtime tracing needs a rooted Android device or root-capable emulator with a matching Frida server. See [device setup](docs/emulator.md).

## Ask your agent

```text
Use Android REA to analyze this APK. Find the code behind this button,
then trace its Java, JNI, and native calls on my test device.
Show the evidence and identify any gaps.
```

## Documentation

[Installation](docs/installation.md) · [Agent setup](docs/agents.md) · [Devices and emulators](docs/emulator.md) · [Workflows](docs/workflows.md) · [Tool catalog](docs/tool-catalog.json)

## License

[MIT](LICENSE). Includes code from [REA](https://github.com/morluto/rea); see [upstream attribution](licenses/REA-MIT.txt).