mcp-flutter-apk-injector

Overview Schema Source Related Servers Discussions Admin

Decode Android APK into workspace

decompile_apk

Destructive

Disassembles an Android APK into Smali bytecode, manifest, assets, and resources, with an option to skip DEX disassembly for asset-only inspection, and sets up a workspace for subsequent analysis.

Instructions

Disassemble an Android APK file into decoded Smali bytecode, AndroidManifest.xml, assets, native libraries, and resource files, automatically installing a dedicated AGENTS.md workspace contract. Reads apkPath without mutating the source APK, but completely recreates outputDir; requires Java runtime and apktool on the system PATH. Set decompileSources=true (default) to disassemble DEX into Smali classes for code injection, or false for fast asset/manifest-only inspection; invoke analyze_injection_surface next on the resulting workspaceDir.

Input Schema

TableJSON Schema

Name	Required	Description
`apkPath`	Yes	Absolute path to target source .apk file to decompile
`outputDir`	Yes	Destination directory path where decompiled Smali code, resources, assets, and AndroidManifest.xml will be extracted
`decompileSources`	No	Whether to disassemble DEX files into Smali code (default: true). Set false for resource/asset-only disassembly

Output Schema

TableJSON Schema

Name	Required	Description
`fileCount`	Yes	Number of extracted workspace files.
`smaliRoot`	Yes	Primary Smali root, when source decoding was enabled.
`sourceApk`	Yes	Absolute path to the input APK that was read.
`targetAbis`	Yes	Native ABI directories detected in the workspace.
`packageName`	Yes	Package name parsed from AndroidManifest.xml.
`mainActivity`	Yes	Resolved launcher activity, when present.
`manifestPath`	Yes	Absolute path to decoded AndroidManifest.xml.
`workspaceDir`	Yes	Absolute path to the decoded workspace.
`hasNativeLibs`	Yes	Whether the decoded workspace contains native libraries.
`minSdkVersion`	Yes	Declared minimum Android API level.
`applicationClass`	Yes	Declared application class, when present.
`targetSdkVersion`	Yes	Declared target Android API level.

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedv0.1.3Aug 13, 2026

addedInput schema / properties / apkPath / description

Added value: +"Absolute path to target source .apk file to decompile"

addedInput schema / properties / decompileSources / description

Added value: +"Whether to disassemble DEX files into Smali code (default: true). Set false for resource/asset-only disassembly"

addedInput schema / properties / outputDir / description

Added value: +"Destination directory path where decompiled Smali code, resources, assets, and AndroidManifest.xml will be extracted"

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "applicationClass": {
+      "description": "Declared application class, when present.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "fileCount": {
+      "description": "Number of extracted workspace files.",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "hasNativeLibs": {
+      "description": "Whether the decoded workspace contains native libraries.",
+      "type": "boolean"
+    },
+    "mainActivity": {
+      "description": "Resolved launcher activity, when present.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "manifestPath": {
+      "description": "Absolute path to decoded AndroidManifest.xml.",
+      "type": "string"
+    },
+    "minSdkVersion": {
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Declared minimum Android API level."
+    },
+    "packageName": {
+      "description": "Package name parsed from AndroidManifest.xml.",
+      "type": "string"
+    },
+    "smaliRoot": {
+      "description": "Primary Smali root, when source decoding was enabled.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "sourceApk": {
+      "description": "Absolute path to the input APK that was read.",
+      "type": "string"
+    },
+    "targetAbis": {
+      "description": "Native ABI directories detected in the workspace.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "targetSdkVersion": {
+      "anyOf": [
+        {
+          "type": "integer"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Declared target Android API level."
+    },
+    "workspaceDir": {
+      "description": "Absolute path to the decoded workspace.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "workspaceDir",
+    "sourceApk",
+    "packageName",
+    "mainActivity",
+    "applicationClass",
+    "minSdkVersion",
+    "targetSdkVersion",
+    "targetAbis",
+    "fileCount",
+    "hasNativeLibs",
+    "manifestPath",
+    "smaliRoot"
+  ],
+  "type": "object"
+}

First observedv0.1.2Aug 2, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description transparently discloses side effects beyond annotations, such as 'completely recreates outputDir' and 'automatically installing a dedicated AGENTS.md workspace contract', which align with the destructiveHint=true. It also clarifies that the source APK is not mutated, providing a clear picture of the tool's impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the main purpose and then details usage and side effects. It is appropriately sized for the complexity, though the long run-on structure could be slightly improved for readability, but it remains clear and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 parameters, side effects, and integration with a workflow), the description covers all essential aspects: purpose, prerequisites (Java and apktool), parameter options, side effects, and next-step guidance. It is complete enough for an agent to understand when and how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions already fully cover all three parameters (apkPath, outputDir, decompileSources) with clear explanations. The description restates the decompileSources toggle but adds no new semantic information beyond what the schema provides, so it meets the baseline for full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's primary function: disassembling Android APK files into Smali code, manifest, assets, and resources, plus installing an AGENTS.md contract. This distinguishes it from sibling tools like analyze_injection_surface and inject_flutter_runtime_and_smali, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on when to use this tool, including the decompileSources option for asset-only vs. full source disassembly, and explicitly directs the agent to invoke analyze_injection_surface next. It could be more explicit about when not to use it relative to other tools, but the workflow hint and option details offer useful context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server