mcp-flutter-apk-injector

Model Context Protocol (MCP) server for Android APK reverse engineering and Flutter runtime injection — an automated, enterprise-grade white-hat security research & penetration testing toolkit exposing a complete Decompile ➔ Analyze ➔ Synthesize ➔ Inject ➔ Patch ➔ Repackage pipeline as six modular MCP tools and agent prompt triggers.

🔒 Scope & Compliance Statement
This project is designed exclusively for security researchers, mobile auditors, and application owners auditing their own binaries or authorized targets. Repackaging third-party applications without explicit authorization is prohibited. You are responsible for using this tool lawfully.

🚀 Quick Start & Installation

You can run mcp-flutter-apk-injector directly via npx (no manual build required), or install it globally:

📦 Global NPM Install

npm install -g mcp-flutter-apk-injector

⚡ Running via npx

npx -y mcp-flutter-apk-injector@latest

Related MCP server: SO Analyzer MCP

🛠️ MCP Client Setup

Claude Desktop Configuration

Add the following block to your claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-flutter-apk-injector": {
      "command": "npx",
      "args": ["-y", "mcp-flutter-apk-injector@latest"]
    }
  }
}

Antigravity IDE / Generic MCP Client (stdio)

{
  "mcpServers": {
    "mcp-flutter-apk-injector": {
      "command": "npx",
      "args": ["-y", "mcp-flutter-apk-injector@latest"],
      "env": {
        "MCP_FLUTTER_LOG_LEVEL": "info"
      }
    }
  }
}

⚡ Agent Prompts & Slash Commands

mcp-flutter-apk-injector registers native MCP Prompts for AI desktop agents (Antigravity IDE, Claude Desktop, Cursor):

• /scan: Diagnostic audit scan of decompiled APK workspace, entry points, Smali structure, and native ABIs.

• /inject: Execute Flutter runtime payload & Smali glue code injection into target APK.

• /patch: Patch AndroidManifest.xml (application class, hardware acceleration, cleartext traffic, permissions).

• /recompile: Repackage (apktool b), byte-align (zipalign), and cryptographically sign (apksigner) modified target.

🧠 How it Works & Injection Modes

The pipeline supports four flexible injection strategies aligning with Flutter's "Add-to-App" v2 architecture:

1. activity_overlay: Generates a dedicated FlutterOverlayActivity extending FlutterActivity that reuses the pre-warmed cached engine.

2. view_tree_injection: Programmatically attaches a FlutterView into the decor view layout tree of the target Activity's onCreate().

3. headless_engine: Initializes a background FlutterEngine without UI for headless Dart execution, channel routing, and telemetry.

4. direct_application_hook: Directly instruments existing Application.onCreate() or attachBaseContext() methods in decompiled Smali without altering android:name in AndroidManifest.xml.

🛠️ The 6 Core MCP Tools

💻 System Requirements

• Node.js >= 18.0.0

• Java Runtime / JDK (required by apktool and apksigner)

• Android SDK Build-Tools (zipalign, apksigner — auto-discovered from ANDROID_HOME or system PATH)

• apktool installed on system PATH

• Flutter SDK (required only when executing synthesize_flutter_payload)

🧪 Development & Testing

# Install local dependencies
npm install

# Build TypeScript to dist/
npm run build

# Typecheck without emitting
npm run typecheck

# Code formatting & lint check
npm run lint

# Execute Vitest suite (35 unit tests)
npm test

📜 License

MIT License © 2026 Marwan (MarwanDevSpace)