Which integrations are available for this server?

Provides static security analysis for Android application source code, covering manifest files, Gradle/build configuration, Java/Kotlin source code, XML configuration, and secret scanning.

How do I use Android Security Analyzer?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Android Security Analyzer Run a security analysis on my Android project files." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

Android Security Analyzer

by ako2345

Overview Schema Related Servers Score Discussions

TypeScript

Hybrid

Android Security Analyzer

MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.

What it does

Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers:

Manifest analysis — exported components, dangerous permissions, cleartext traffic, debug flags, backup settings, SDK versions
Gradle/build config — release build misconfigurations, outdated SDKs, suspicious dependencies, hardcoded secrets
Source code (Java/Kotlin) — insecure WebView, SSL/TLS bypass, weak crypto, SQL injection patterns, process execution, insecure file storage, PendingIntent issues
XML configuration — network security config weaknesses, overly broad file provider paths
Secret scanning — API keys, tokens, passwords, private keys, cloud credentials, high-entropy strings

All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.

Related MCP server: APK Security Guard MCP Suite

Architecture

POST /mcp ──► McpServer (JSON-RPC 2.0) ──► Tool Router
                                              │
              ┌───────────────────────────────┘
              ▼
         Orchestrator
              │
    ┌─────────┼─────────┬─────────────┬──────────────┐
    ▼         ▼         ▼             ▼              ▼
 Manifest  Gradle   Source Code   XML Config    Secret
 Analyzer  Analyzer  Analyzer     Analyzer     Scanner
    │         │         │             │              │
    └─────────┴─────────┴─────────────┴──────────────┘
              │
              ▼
     Scoring + Deduplication ──► AnalysisReport

Key design decisions:

Stateless — no sessions, no Durable Objects
Minimal MCP JSON-RPC 2.0 implementation (no heavy SDK dependencies)
Data-driven rule engine with extensible rule registry
Independent analyzers with unified Finding type
Lightweight XML parsing via fast-xml-parser
Input validation via zod
Bundle size: ~66KB gzipped

MCP Tools

Tool	Description
`analyze_android_project`	Full security analysis of project files
`list_android_security_checks`	List all implemented security rules
`explain_finding`	Detailed explanation of a specific rule
`health`	Server status and rule engine stats

Install

Hosted server (recommended for Cline / MCP clients): no local install needed. The server runs at:

https://android-security-analyzer.ako-labs.workers.dev/mcp

Add this URL to your MCP client configuration (see Connecting from an MCP client below).

Local development:

npm install

Development

npm run dev

This starts a local Wrangler dev server. The MCP endpoint is available at http://localhost:8787/mcp.

Deploy

npm run deploy

Deploys to Cloudflare Workers. Requires wrangler authentication (npx wrangler login).

Testing

npm test              # Run all tests
npm run test:watch    # Watch mode
npm run typecheck     # TypeScript type checking

Local MCP Testing

Initialize the connection

Unix:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

Windows (PowerShell):

(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' -UseBasicParsing).Content

List available tools

Unix:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Windows (PowerShell): ответ приходит в result.tools; чтобы увидеть список как JSON, используйте сырой ответ:

(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' -UseBasicParsing).Content

Либо через объект: (Invoke-RestMethod ...).result.tools | ConvertTo-Json -Depth 5

Check health

Unix:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}'

Windows (PowerShell):

(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}' -UseBasicParsing).Content

Run analysis (minimal example)

Unix:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 4,
    "method": "tools/call",
    "params": {
      "name": "analyze_android_project",
      "arguments": {
        "projectName": "TestApp",
        "files": [
          {
            "path": "app/src/main/AndroidManifest.xml",
            "content": "<manifest><application android:debuggable=\"true\" android:allowBackup=\"true\"></application></manifest>"
          }
        ]
      }
    }
  }'

Windows (PowerShell):

$body = @{
  jsonrpc = "2.0"
  id = 4
  method = "tools/call"
  params = @{
    name = "analyze_android_project"
    arguments = @{
      projectName = "TestApp"
      files = @(
        @{
          path = "app/src/main/AndroidManifest.xml"
          content = "<manifest><application android:debuggable=`"true`" android:allowBackup=`"true`"></application></manifest>"
        }
      )
    }
  }
} | ConvertTo-Json -Depth 10
(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body $body -UseBasicParsing).Content

Connecting from an MCP client

Add to your MCP client configuration:

{
  "mcpServers": {
    "android-security-analyzer": {
      "url": "http://localhost:8787/mcp"
    }
  }
}

For production (hosted):

{
  "mcpServers": {
    "android-security-analyzer": {
      "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
    }
  }
}

Security Rules

The analyzer implements 53 security rules across 5 categories:

Category	Prefix	Rules	Examples
Manifest	MAN-*	17	debuggable, allowBackup, exported components, permissions
Gradle	GRD-*	9	release config, SDK versions, dependencies, secrets
Source	SRC-*	17	WebView, SSL/TLS, crypto, injection, file storage
XML Config	XML-*	4	network security config, file provider paths
Secret	SEC-*	7	API keys, tokens, passwords, cloud credentials

Each finding includes:

Stable rule ID
Severity (critical/high/medium/low/info) and confidence (high/medium/low)
File path and line number (when determinable)
Evidence snippet
CWE and OWASP Mobile Top 10 mappings
Actionable recommendation

Scoring

Risk score (0-100) is computed from finding severities:

Critical: 9 points
High: 6 points
Medium: 3 points
Low: 1 point
Info: 0 points

The raw sum is normalized against an expected maximum of 50 points.

Limitations

Not a SAST replacement — pattern/regex-based heuristics, not full AST/dataflow analysis
No build required — analyzes raw source, so build-time transforms are not visible
False positives possible — especially for secret scanning and some code patterns
Workers constraints — 128MB memory limit, CPU time limits, no filesystem access
No APK/AAB analysis — source code only
No inter-procedural analysis — patterns are matched per-file, not across call graphs

Project Structure

src/
├── index.ts                          # Worker entry point
├── server/
│   ├── mcp.ts                        # MCP JSON-RPC 2.0 handler
│   └── tools/                        # MCP tool implementations
│       ├── analyzeAndroidProject.ts
│       ├── listAndroidSecurityChecks.ts
│       ├── explainFinding.ts
│       └── health.ts
├── core/
│   ├── types.ts                      # TypeScript types & Zod schemas
│   ├── scoring.ts                    # Risk score computation
│   ├── registry.ts                   # Rule registry
│   └── orchestrator.ts              # Analysis orchestrator
├── analyzers/
│   ├── manifestAnalyzer.ts
│   ├── gradleAnalyzer.ts
│   ├── sourceAnalyzer.ts
│   ├── xmlConfigAnalyzer.ts
│   └── secretScanner.ts
├── parsers/
│   ├── xml.ts                        # XML parser wrapper
│   ├── gradle.ts                     # Gradle file parser
│   ├── source.ts                     # Source code pattern matcher
│   └── files.ts                      # File classifier
├── rules/
│   ├── manifestRules.ts
│   ├── gradleRules.ts
│   ├── sourceRules.ts
│   ├── xmlRules.ts
│   └── secretRules.ts
├── mappings/
│   ├── cwe.ts                        # CWE descriptions
│   └── owaspMobile.ts               # OWASP Mobile Top 10
└── utils/
    ├── lines.ts                      # Line number utilities
    ├── paths.ts                      # Path classification
    └── text.ts                       # Text utilities
test/
├── fixtures/                         # Sample Android project files
├── unit/                             # Unit tests per module
└── integration/                      # Full analysis integration tests

Adding New Rules

Define the rule in the appropriate file under src/rules/
Add detection logic in the corresponding analyzer under src/analyzers/
Add CWE mapping in src/mappings/cwe.ts if needed
Add a test case
The rule is automatically registered via src/core/registry.ts

License

MIT

This server cannot be installed

license - not found

Not graded

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

APK Security Guard MCP Suite
Security Penetration Testing
il-il1
F
license
Not graded
quality
D
maintenance
Provides a one-stop automated solution for Android APK security analysis by integrating tools like JEB, JADX, APKTOOL, FlowDroid, and MobSF into unified MCP standard API interfaces.
Updated 9 months ago (2025-12-03 12:17 UTC)
11
APK Security Guard MCP Suite
Penetration Testing Code Analysis
zmbcen
F
license
Not graded
quality
D
maintenance
Integrates multiple Android APK security analysis tools into MCP standard APIs for automated static and dynamic analysis and vulnerability detection.
Updated a year ago (2025-06-01 17:54 UTC)
re-apktool
Penetration Testing Code Analysis
Heretek-RE
A
license
A
quality
C
maintenance
MCP server for Android APK triage, providing tools to parse APK headers, list DEX classes, and decode AndroidManifest.xml using apktool or androguard backends.
Updated 2 months ago (2026-06-10 19:49 UTC)
5
1
MIT
MalDroid
Code Analysis Research & Data Security
yayaya142
A
license
Not graded
quality
B
maintenance
Local static-analysis assistant for Android malware research that manages investigation cases, exposes MCP tools via a local server, and persists evidence-backed findings without cloud dependency.
Updated a month ago (2026-07-24 20:45 UTC)
MIT

View all related MCP servers

Related MCP Connectors

ScanMalware.com URL Scanner
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Appcircle MCP
MCP server for Appcircle mobile CI/CD platform.
androidcliagentgate-mcp
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ako2345/android-security-analyzer'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

Android Security Analyzer

What it does

Architecture

MCP Tools

Install

Development

Deploy

Testing

Local MCP Testing

Initialize the connection

List available tools

Check health

Run analysis (minimal example)

Connecting from an MCP client

Security Rules

Scoring

Limitations

Project Structure

Adding New Rules

License

Maintenance

Resources

Looking for Admin?

Related MCP Servers

APK Security Guard MCP Suite

APK Security Guard MCP Suite

re-apktool

MalDroid

Related MCP Connectors

Latest Blog Posts

MCP directory API