Disassemble an Android APK file into decoded Smali bytecode, AndroidManifest.xml, assets, native libraries, and resource files, automatically installing a dedicated AGENTS.md workspace contract. Reads apkPath without mutating the source APK, but completely recreates outputDir; requires Java runtime and apktool on the system PATH. Set decompileSources=true (default) to disassemble DEX into Smali classes for code injection, or false for fast asset/manifest-only inspection; invoke analyze_injection_surface next on the resulting workspaceDir.

Perform static bytecode analysis and security auditing on a decoded APK workspace to identify manifest components, ABI coverage, JNI loading hooks, native libraries, anti-debug/root checks, and candidate injection hooks. This operation is read-only, non-mutating, and idempotent; requires workspaceDir pointing to a valid directory produced by decompile_apk with an AndroidManifest.xml and smali structures. Use after decompile_apk to audit the target before modifying files; review returned warnings, securityAnalysis, and candidate hooks before selecting an injection mode with inject_flutter_runtime_and_smali.

Compile a source Flutter project into platform native libraries (libflutter.so, libapp.so) and flutter_assets partitioned by target Android ABIs. Invokes the local Flutter CLI, writes compiled artifacts to outputDir (or system temp if omitted), and overwrites existing destination files; requires flutterProjectPath containing pubspec.yaml. Set targetAbis to match the target APK architectures discovered via analyze_injection_surface, choose buildMode ('release' for AOT production, 'debug' for JIT), and forward the emitted payloadDir to inject_flutter_runtime_and_smali.

Inject a synthesized Flutter payload (lib/ and assets/) and generated Smali bootstrap classes into a decoded APK workspace. Mutates workspaceDir in-place by writing Smali classes, copying native libraries per ABI, and deploying Flutter assets; requires payloadDir containing valid Flutter binaries. Select injectionMode based on target structure: prefer activity_overlay for cached-engine screens, direct_application_hook for custom Application classes, headless_engine for background tasks, or view_tree_injection (experimental); enable nativeLibraryFallback to guard against missing ABI crashes.

Configure AndroidManifest.xml in a decoded workspace by injecting Flutter activities, application subclass bindings, hardware acceleration, network security flags, and required permissions. Mutates AndroidManifest.xml in-place within workspaceDir; accepts customApplicationClass to rebind android:name, additionalPermissions to insert tags, and boolean flags for usesCleartextTraffic, largeHeap, and hardwareAccelerated. Use after inject_flutter_runtime_and_smali to configure component declarations before packaging; use analyze_injection_surface instead when inspecting the manifest without changes.

Rebuild a modified decoded workspace with apktool, 4-byte align the uncompressed APK with zipalign, and cryptographically sign the binary with apksigner (v1-v4 schemes). Mutates the filesystem by overwriting outputApkPath and creating temporary alignment artifacts; requires a valid workspaceDir containing modified Smali and AndroidManifest.xml. Pass keystoreConfig with custom keystorePath, passwords, and keyAlias for authorized release signatures; if keystoreConfig is omitted, generates an auto-signed debug test artifact.

Retrieve the Hermes+ reverse-engineering persona, loaded skill sheets, pipeline telemetry, and complete active session memory snapshot. This operation is read-only, non-mutating, and requires no authentication; omitting sessionId returns the active singleton session state without error. Use it at the start of an engineering workflow or to inspect overall pipeline status; use query_memory_graph for targeted keyword lookups or update_agent_memory to persist modifications.

Update the active reverse-engineering session memory with notes, target Android workspace metadata, or verified patch history records. Mutates session state in-memory and automatically persists updates to .mcp_memory/session_state.json in workspaceDir; non-null fields merge into state, notes are appended, and patchType with patchDetails logs a verified entry. Use after manual Smali edits, manifest changes, or decompiler discoveries to keep agent telemetry synchronized; use get_agent_context or query_memory_graph instead when inspecting memory without modification.

Search and inspect historical patch logs, register allocations, decompilation metadata, native libraries, and security findings in the active memory graph. This operation is read-only, non-mutating, and idempotent; performs fuzzy substring matching on query and returns ranked results by match score. Use query_memory_graph to locate specific patch records, hook locations, or components by keyword; use get_agent_context instead for a full session snapshot, and update_agent_memory to store new observations.