AppUnpack — Android APK decompiler and reverse engineering

Give it an APK. Get decompiled Java, decoded resources and a local analysis report.

AppUnpack is a local Android APK decompiler and analysis CLI powered by JADX through jadx-headless-mcp. Analyze a file directly, inspect specific classes and methods, or connect an AI coding agent through MCP. A separate Python command inventories iOS IPA metadata.

Quick start · What you get · AI agents · FAQ · Documentation · Releases · Website

▶ Watch the 24-second real APK demo

Real NetGuard 2.337 analysis: manifest, permissions, resources and reconstructed Java. Edited for pacing; recovery is partial. Feature cards summarize code navigation, CLI/MCP and evidence reports.

Music: “Brain Dance” by Kevin MacLeod (incompetech.com), CC BY 4.0. Edited excerpt, loudness adjusted, fades added.

Quick start

Install Git, Node.js 24.11 or newer, npm and a Java 17 or newer JDK. Full APK export needs the JDK compiler modules. You do not need an Android device or an AI account.

git clone https://github.com/samalyxx/appunpack.git
cd appunpack
npm ci
node bin/appunpack.mjs install-tools
node bin/appunpack.mjs doctor

Then give it an actual APK file. On Windows:

.\appunpack.ps1 'C:\Apps\Example.apk'

Or use Node directly on any supported host:

node bin/appunpack.mjs /path/to/Example.apk

AppUnpack creates a new Example-analysis directory beside the input APK and refuses to overwrite an existing output directory. Open report.md, then browse the recovered files. To choose a destination:

node bin/appunpack.mjs analyze /path/to/Example.apk --output ./reports/example

You supply the APK; a name or Play Store link is not an APK. The engine download happens during setup. Analysis runs on your computer. See installation and Windows setup for runtime selection and launcher troubleshooting.

Related MCP server: apk-docforge

What you get

Recovered code is a derived view. It is not the original Java/Kotlin project, a guaranteed buildable app or the application's backend. Obfuscation and decompilation errors can leave gaps even when many useful files are exported.

Scope

Static references do not prove that a call occurs at runtime. Reports do not verify APK/IPA signatures or certify that an app is safe.

Extended Android workflows

These commands use separately installed tools. The basic APK command stays static and needs no device. See extended setup and commands.

node bin/appunpack.mjs splits ./apk-set --output ./reports/splits
node bin/appunpack.mjs decode ./Example.apk --output ./reports/apktool
node bin/appunpack.mjs native-libs ./Example.apk
node bin/appunpack.mjs native ./Example.apk --library lib/arm64-v8a/libexample.so --output ./reports/native
node bin/appunpack.mjs devices
node bin/appunpack.mjs pull com.example.app --device emulator-5554 --output ./reports/pulled
node bin/appunpack.mjs logcat --device emulator-5554 --seconds 10 --output ./reports/logs
node bin/appunpack.mjs frida-ps --device DEVICE_ID
node bin/appunpack.mjs trace 1234 ./observe.js --device DEVICE_ID --seconds 10 --output ./reports/trace

Split analysis combines the supplied APKs for investigation and saves per-part identities/resources; it does not create an installable merged APK. Runtime commands select an existing device/process explicitly. A Frida script executes inside that process and can change its behavior.

Follow the code

node bin/appunpack.mjs classes ./Example.apk MainActivity
node bin/appunpack.mjs class ./Example.apk com.example.MainActivity
node bin/appunpack.mjs source ./Example.apk com.example.MainActivity
node bin/appunpack.mjs method ./Example.apk com.example.MainActivity onCreate
node bin/appunpack.mjs references ./Example.apk com.example.MainActivity --method-name onCreate
node bin/appunpack.mjs resources ./Example.apk --query title

These commands return JSON. Use the class summary to select an overloaded method, then pass its index with --overload-index. See the command reference.

Connect your AI agent

node bin/appunpack.mjs mcp-config

Review the printed JSON and add it to your client's MCP settings. The server starts the Android engine directly over local stdio. Agent setup covers configuration, and the APK analysis skill supplies a focused investigation workflow.

Example prompt:

Inspect this APK's manifest, find the implementation behind its search screen, and trace the relevant classes, methods and callers. Include the APK hash, evidence and limitations. Separate observed facts from inferences.

The CLI does not require an AI account. If you connect a cloud AI client, the tool output it requests can be sent to that provider under the client's own data policy.

Checked against real APKs

Three public APK fixtures were processed locally. All produced source, resources and reports; all reported a partial export. One recovered sieve algorithm was also compared against its original source and an independent check for six inputs.

Additional launch checks analyzed the official NetGuard 2.337 and Mullvad 2026.12 APKs, a Jellyfin 2.7.3 release bundle's base/ABI/density splits, and Android Frida attachment on an isolated API 36 emulator. The split APKs also passed an install/pull/hash/analysis round trip. Production Java exports remained partial; these checks establish useful output, not complete reconstruction.

The verification record includes fixture identities, hashes, error counts, test coverage and what was not checked. GitHub Actions runs unit/parser checks on Windows and Ubuntu and a separate real JADX integration workflow on Ubuntu. CI does not install or launch target Android apps.

Initial iOS support

Install Python 3.10 or newer, then:

node bin/appunpack.mjs ipa ./Example.ipa --output ./reports/ios-example

This inventories the IPA archive and readable bundle metadata. Executable decompilation, FairPlay decryption and iOS runtime analysis are outside its scope. See IPA usage.

FAQ

The built-in CLI processes the target locally. Setup downloads the engine and npm dependencies. A connected cloud AI client can send requested tool results to its provider; review that client's settings before connecting sensitive targets.

No. JADX reconstructs Java from compiled Android bytecode. Original Kotlin, comments, meaningful obfuscated names, build configuration, missing split modules and server-side code cannot be assumed recoverable. Native libraries require a separate investigation. Exported files may need manual interpretation and correction.

The engine reported errors or warnings while exporting. Useful files may still exist. Read decompiled/export.json and decompile.log, and check the specific method or resource you need. A large file count is not evidence that every method was recovered correctly.

The Java engine benefits from desktop memory, an isolated workspace and code navigation tools. Static analysis does not require installing or launching the APK. Use a test device or emulator separately when a question requires observed runtime behavior.

Node.js 24.11 or newer, npm, Git and a Java 17 or newer JDK for full APK export. Python 3.10 or newer is needed for IPA, split preparation, APK preflight and native-library extraction; the basic JADX workflow does not need it. The setup command downloads and verifies the pinned JADX headless engine. GitHub release archives include source, not these runtimes or the engine JAR.

The current installation method is a GitHub source checkout or release archive followed by npm ci. There is no published AppUnpack npm release. You can run npm link from an installed checkout if you want an appunpack command on your PATH.

Documentation

• Decompile an APK locally: setup, exported files and partial-result checks.

• Analyze split APKs and XAPK: compatible sets, commands and per-part evidence.

• Installation: requirements, engine verification and platform setup.

• Commands and outputs: APK and IPA workflows, flags and report contracts.

• AI agent setup: local MCP configuration and investigation prompts.

• Extended Android workflows: split sets, Apktool, Ghidra, ADB and Frida.

• Architecture: how the CLI, engine and reports fit together.

• Mobile reverse-engineering research: Android and iOS tool comparisons.

• Verification: reproducible checks, real APK results and limits.

• Repository search visibility: GitHub metadata, Google visibility checks and supporting website setup.

• Changelog and GitHub releases.

Contributing and responsible use

Report reproducible bugs through GitHub issues. Include the command, runtime versions and sanitized diagnostics; keep private APKs and secrets out of public reports. See contributing and security guidance.

Analyze software you own or are authorized to examine. Unfamiliar target files are parsed by Java with your user permissions; use an isolated environment.

License

AppUnpack's code is MIT licensed. JADX, jadx-headless-mcp, the MCP SDK and other dependencies retain their own licenses and notices. See third-party notices. Integration names identify those projects and do not imply endorsement.