io.github.ako2345Published by GitHub account ako2345v1.0.0Updated Oct 24, 2026
MCP server for static security analysis of Android source code
Remote MCP server that statically scans Android project source files for security issues and returns a scored report with fixes.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.ako2345%2Fandroid-security-analyzer/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"android-security-analyzer": {
"type": "http",
"url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
}
}
}MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.
Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers:
All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.
Key design decisions:
fast-xml-parserzodHosted server (recommended for Cline / MCP clients): no local install needed. The server runs at:
https://android-security-analyzer.ako-labs.workers.dev/mcp
Add this URL to your MCP client configuration (see Connecting from an MCP client below).
Local development:
This starts a local Wrangler dev server. The MCP endpoint is available at http://localhost:8787/mcp.
Deploys to Cloudflare Workers. Requires wrangler authentication (npx wrangler login).
Unix:
Windows (PowerShell):
Unix:
Windows (PowerShell): ответ приходит в result.tools; чтобы увидеть список как JSON, используйте сырой ответ:
Либо через объект: (Invoke-RestMethod ...).result.tools | ConvertTo-Json -Depth 5
Unix:
Windows (PowerShell):
Unix:
Windows (PowerShell):
Add to your MCP client configuration:
For production (hosted):
The analyzer implements 53 security rules across 5 categories:
Each finding includes:
Risk score (0-100) is computed from finding severities:
The raw sum is normalized against an expected maximum of 50 points.
src/rules/src/analyzers/src/mappings/cwe.ts if neededsrc/core/registry.tsMIT
Source: README.md at commit a14bd0d
Analyzes an Android project's source code for security vulnerabilities. Accepts project files (AndroidManifest.xml, build.gradle, Java/Kotlin sources, XML configs) and returns a structured security report with findings, severity scores, and recommendations.
filesrequiredoptionsprojectNamerequiredReturns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.
categoryExplains a specific security finding by its rule ID. Returns why it is a risk, how to fix it, and false positive considerations.
findingIdrequiredReturns the server health status, version, and rule engine statistics.
Takes no parameters.
90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a license in the repository or the registry entry.
POST /mcp ──► McpServer (JSON-RPC 2.0) ──► Tool Router │ ┌───────────────────────────────┘ ▼ Orchestrator │ ┌─────────┼─────────┬─────────────┬──────────────┐ ▼ ▼ ▼ ▼ ▼ Manifest Gradle Source Code XML Config Secret Analyzer Analyzer Analyzer Analyzer Scanner │ │ │ │ │ └─────────┴─────────┴─────────────┴──────────────┘ │ ▼ Scoring + Deduplication ──► AnalysisReportnpm installnpm run devnpm run deploynpm test # Run all testsnpm run test:watch # Watch modenpm run typecheck # TypeScript type checkingcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 4, "method": "tools/call", "params": { "name": "analyze_android_project", "arguments": { "projectName": "TestApp", "files": [ { "path": "app/src/main/AndroidManifest.xml", "content": "<manifest><application android:debuggable=\"true\" android:allowBackup=\"true\"></application></manifest>" } ] } } }'$body = @{ jsonrpc = "2.0" id = 4 method = "tools/call" params = @{ name = "analyze_android_project" arguments = @{ projectName = "TestApp" files = @( @{ path = "app/src/main/AndroidManifest.xml" content = "<manifest><application android:debuggable=`"true`" android:allowBackup=`"true`"></application></manifest>" } ) } }} | ConvertTo-Json -Depth 10(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body $body -UseBasicParsing).Content{ "mcpServers": { "android-security-analyzer": { "url": "http://localhost:8787/mcp" } }}{ "mcpServers": { "android-security-analyzer": { "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp" } }}src/├── index.ts # Worker entry point├── server/│ ├── mcp.ts # MCP JSON-RPC 2.0 handler│ └── tools/ # MCP tool implementations│ ├── analyzeAndroidProject.ts│ ├── listAndroidSecurityChecks.ts│ ├── explainFinding.ts│ └── health.ts├── core/│ ├── types.ts # TypeScript types & Zod schemas│ ├── scoring.ts # Risk score computation│ ├── registry.ts # Rule registry│ └── orchestrator.ts # Analysis orchestrator├── analyzers/│ ├── manifestAnalyzer.ts│ ├── gradleAnalyzer.ts│ ├── sourceAnalyzer.ts│ ├── xmlConfigAnalyzer.ts│ └── secretScanner.ts├── parsers/│ ├── xml.ts # XML parser wrapper│ ├── gradle.ts # Gradle file parser│ ├── source.ts # Source code pattern matcher│ └── files.ts # File classifier├── rules/│ ├── manifestRules.ts│ ├── gradleRules.ts│ ├── sourceRules.ts│ ├── xmlRules.ts│ └── secretRules.ts├── mappings/│ ├── cwe.ts # CWE descriptions│ └── owaspMobile.ts # OWASP Mobile Top 10└── utils/ ├── lines.ts # Line number utilities ├── paths.ts # Path classification └── text.ts # Text utilitiestest/├── fixtures/ # Sample Android project files├── unit/ # Unit tests per module└── integration/ # Full analysis integration tests