Dejared

io.github.hqkh4nhPublished by GitHub account hqkh4nhv1.2.2Updated Nov 7, 2026

Java decompiler MCP server. Explore, search, and decompile JAR, WAR, EAR, and AAR bytecode.

VerifiedSTDIODesktop onlyFiles & StorageDeveloper Tools

Overview

AI-generated overview

A local MCP server that lets a coding assistant open Java archives, browse and search their bytecode, and decompile classes back to Java source.

What you can do
  • Browse archive contents: list packages with class counts, classes in a package, and non-class resources
  • Read embedded text resources such as YAML, XML, properties and JSON
  • Search bytecode by class name or by string literals like URLs, SQL and error messages
  • Inspect class metadata quickly without decompiling, including batch metadata for whole packages
  • Decompile individual classes to Java source, choosing between CFR, Vineflower and Procyon
When to use it
Useful when a dependency ships without sources and you need to see what a third-party library actually does, follow a stack trace into an unsourced library, recover a config or manifest file embedded in an archive, or inspect an obfuscated plugin or mod. It replaces hand-running jar, unzip and javap commands.
Requirements
Runs as a local process over stdio. The npm package needs Node.js 20 or later and Java 17 or later (a JRE is enough); the wrapper downloads and caches the server JAR on first run, so network access is needed then. Alternatively run the JAR directly with java. If Java is not on PATH, set DEJARED_JAVA_PATH.
Before you install
The npm wrapper downloads a server JAR from GitHub Releases on first run and caches it on disk, so the first launch needs network access and a writable cache directory. It reads archives you point it at, which may contain secrets such as credentials in embedded config files. Decompilation of difficult classes can time out; limits are configurable.

Installation

In SourceWeft

  1. Open Dejared in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[Java] [Node.js] [npm version] [npm downloads] [License: MIT]

dejared-mcp: Java decompiler MCP server

dejared-mcp is a Java decompiler and JAR analyzer that speaks the Model Context Protocol. It lets an AI coding agent (Claude Code, Codex, Cursor, VS Code) open a .jar, .war, .ear, or .aar, list what is inside, search its bytecode, and decompile any class back to Java source using CFR, Vineflower, or Procyon.

[Claude Code] [Codex] [Install in VS Code] [Add to Cursor]

Table of Contents

Overview

dejared-mcp is a Java-based MCP server distributed as an npm package. It provides nine tools organized into three categories: discovery, hunting, and deep analysis. AI assistants use these tools to navigate JAR file structures, search for classes and string literals in bytecode, and decompile .class files back to readable Java source code.

Reach for it whenever a dependency ships without sources: reading what a third-party library actually does, recovering an application.yml or MANIFEST.MF embedded in a JAR, following a stack trace into a library you have no source for, or inspecting an obfuscated plugin or mod. It replaces hand-running jar tf, unzip, javap, or a desktop decompiler.

Any ZIP-based Java archive works: .jar, .war, .ear, .aar, and Spring Boot fat-jars.

The npm package acts as a thin wrapper that downloads and caches the server JAR on first run, then spawns it via java -jar using stdio transport.

Prerequisites

  • Node.js 20 or later
  • Java 17 or later (JRE is sufficient)

Quick Start

The best install is the plugin. One command pair gives your agent both halves: the nine MCP tools, and the jar-analysis skill that tells it when to reach for them instead of shelling out to jar tf, unzip, or javap.

bash
claude plugin marketplace add hqkh4nh/dejared-mcpclaude plugin install dejared@dejared-mcp-marketplace

Codex carries the same bundle. See Install as a plugin. Every other client takes the plain MCP config.

Install as a plugin (recommended)

The MCP server on its own gives an agent nine tools. It does not tell the agent when to use them, so most agents keep reaching for jar tf, unzip -p, and javap -p out of habit and never touch the tools you installed.

A plugin ships both parts together:

PartWhat it does
MCP serverThe nine tools listed under Features
jar-analysis skillRoutes JAR questions to those tools, picks the cheap tool before the expensive one, and knows which decompiler to retry with

Two tools support that bundle today. Everything else is MCP-only.

Claude Code

bash
claude plugin marketplace add hqkh4nh/dejared-mcpclaude plugin install dejared@dejared-mcp-marketplace

Inside a session, the same commands work as /plugin marketplace add ... and /plugin install .... If the install summary says Run /reload-plugins to activate, run it.

Codex

bash
codex plugin marketplace add hqkh4nh/dejared-mcpcodex plugin add dejared@dejared-mcp-marketplace

Start a new session afterwards so the bundled skill and server load. Check with codex mcp list. dejared should be listed as enabled.

Install as an MCP server

For clients without a plugin system. You get the tools, but not the skill that steers the agent toward them.

Most clients accept this standard config:

json
{  "mcpServers": {    "dejared": {      "command": "npx",      "args": ["-y", "dejared-mcp"]    }  }}

From the command line

If your tool has a CLI, one line is enough:

bash
claude mcp add dejared -- npx -y dejared-mcp     # Claude Codecodex mcp add dejared -- npx -y dejared-mcp      # Codexamp mcp add dejared -- npx -y dejared-mcp        # Ampgemini mcp add dejared npx -y dejared-mcp        # Gemini CLI

Where the config file lives

Drop the standard config into the file for your tool:

ToolLocation
Claude Desktop%APPDATA%\Claude\claude_desktop_config.json (Windows) · ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)
Claude Code.mcp.json in the project root
Cursor.cursor/mcp.json (project) · ~/.cursor/mcp.json (global)
WindsurfMCP servers panel in settings, or mcpServers in your settings file
ClineMCP settings file, via the extension's MCP Servers panel
Antigravity Editor~/.gemini/antigravity/mcp_config.json
Kiro.kiro/settings/mcp.json
Copilot CLI~/.copilot/mcp-config.json, or run /mcp add
Gemini CLI~/.gemini/settings.json (global) · .gemini/settings.json (project)
GooseAdvanced settings → Extensions → Add custom extension, type STDIO
JetBrains IDEsSettings → Tools → AI Assistant → Model Context Protocol (MCP)
Qodo GenChat panel → Connect more tools → + Add new MCP

A few setups need more than the standard config. Expand those below.

Codex: TOML instead of JSON
bash
codex mcp add dejared -- npx -y dejared-mcpcodex mcp list

The -- matters: everything after it is the server's launch command.

Or edit ~/.codex/config.toml (global) or .codex/config.toml (project):

toml
[mcp_servers.dejared]command = "npx"args = ["-y", "dejared-mcp"]
# Only if Java is not on your PATH[mcp_servers.dejared.env]DEJARED_JAVA_PATH = "/path/to/java"
VS Code (GitHub Copilot): uses servers, not mcpServers

Create or edit .vscode/mcp.json:

json
{  "servers": {    "dejared": {      "command": "npx",      "args": ["-y", "dejared-mcp"]    }  }}

After saving, click Start above the server entry, then use Agent mode in Copilot Chat.

opencode: command is an array

Edit ~/.config/opencode/opencode.json:

json
{  "$schema": "https://opencode.ai/config.json",  "mcp": {    "dejared": {      "type": "local",      "command": ["npx", "-y", "dejared-mcp"],      "enabled": true    }  }}
Pure Java (no Node.js required)

If you prefer to run the server JAR directly without Node.js:

  1. Download the latest JAR from GitHub Releases.

  2. Run it:

    bash
    java -jar dejared-mcp-<version>.jar

  3. Configure your MCP client to use the JAR directly instead of npx:

    json
    {  "mcpServers": {    "dejared": {      "command": "java",      "args": ["-jar", "/path/to/dejared-mcp-<version>.jar"]    }  }}

Features

Discovery

Browse and read JAR contents.

ToolDescription
dejared_list_packagesList all packages with class counts
dejared_list_classesList classes in a specific package
dejared_list_resourcesList non-class resource files
dejared_read_resourceRead text resources (YAML, XML, properties, JSON, and others)

Hunting

Search inside JAR files.

ToolDescription
dejared_search_classSearch classes by name
dejared_search_stringSearch string literals in bytecode (URLs, SQL, error messages)

Deep Analysis

Inspect metadata and decompile classes.

ToolDescription
dejared_get_metadataExtract class metadata via ASM (fast, no decompilation)
dejared_dump_package_metadataBatch metadata extraction for entire packages
dejared_decompile_classDecompile .class files to Java source code

Decompiler Engines

dejared-mcp supports three decompiler engines. The engine can be specified per request via the dejared_decompile_class tool.

EngineDescription
CFR (default)Reliable general-purpose decompiler
VineflowerModern fork of FernFlower, handles newer Java features well
ProcyonAlternative engine, can handle some edge cases better

Custom Java Path

If Java is not in your system PATH, set the DEJARED_JAVA_PATH environment variable in your MCP config. This applies to all npx-based configurations:

json
{  "mcpServers": {    "dejared": {      "command": "npx",      "args": ["-y", "dejared-mcp"],      "env": {        "DEJARED_JAVA_PATH": "/path/to/java"      }    }  }}

Server Configuration

PropertyDefaultDescription
dejared.cache.max-size500Max entries in the decompilation LRU cache
dejared.security.max-resource-size5242880Max resource file size (bytes)
dejared.security.decompile-timeout-seconds30Timeout per decompilation

How It Works

The npm package is a thin Node.js wrapper. On first run it:

  1. Checks the platform cache directory for a cached JAR matching the current version.
    • Linux: $XDG_CACHE_HOME/dejared-mcp (defaults to ~/.cache/dejared-mcp)
    • macOS: ~/Library/Caches/dejared-mcp
    • Windows: %LOCALAPPDATA%\dejared-mcp
  2. Downloads the JAR from GitHub Releases if not cached.
  3. Spawns java -jar with stdio inherited for MCP transport.

The server communicates over stdio using the Model Context Protocol.

FAQ and Troubleshooting

Q: Java is installed but the server cannot find it.

Set the DEJARED_JAVA_PATH environment variable in your MCP configuration. See Custom Java Path.

Q: The server fails to start with a permission error.

Ensure that the cached JAR file is readable. The cache location depends on your platform. See How It Works for the cache directory paths.

Q: Decompilation times out or returns an error.

Some classes are difficult to decompile. Try a different engine by specifying vineflower or procyon in the dejared_decompile_class tool. The default timeout is 30 seconds and can be adjusted via dejared.security.decompile-timeout-seconds.

Q: Which Java version do I need?

Java 17 or later. A JRE is sufficient; you do not need a full JDK.

Q: Can I run the server without Node.js?

Yes. Download the JAR from GitHub Releases and run it directly with java -jar. See the "Pure Java" section under Install as an MCP server.

Contributing

Contributions are welcome. Please follow these guidelines:

  1. Fork the repository and create a feature branch from main.
  2. Ensure your changes compile and pass existing tests.
  3. Write clear commit messages describing the purpose of each change.
  4. Open a pull request against main with a description of what the change does and why.

The release version is maintained in package.json. Gradle and the JAR runner read it directly. To bump the version and synchronize the plugin and registry manifests, run:

sh
npm version patch --no-git-tag-version# Or use minor, major, or an explicit version instead of patch.npm run check-versions

Review and commit all changed manifests together. Create the matching vX.Y.Z tag only when ready to publish: pushing that tag starts the release workflow. If you edit package.json manually, run npm run sync-version afterward. CI and the release workflow reject mismatched versions without modifying files.

Project Structure

dejared-mcp/├── bin/                    # Node.js CLI entry point├── lib/                    # Node.js wrapper (JAR download and process management)├── java-mcp/               # Java MCP server (Spring Boot, Gradle)│   └── src/├── skills/                 # Agent skills, shared by every plugin manifest below├── .mcp.json               # MCP server definition, shared the same way├── .claude-plugin/         # Claude Code plugin + marketplace manifests├── .codex-plugin/          # Codex plugin manifest├── .agents/plugins/        # Codex marketplace manifest├── package.json            # npm package manifest└── server.json             # MCP Registry manifest

Building from Source

bash
cd java-mcp./gradlew build

Reporting Issues

Open an issue on GitHub Issues with steps to reproduce the problem, your Java version, and your Node.js version.

Third-Party Licenses

This project uses the following open-source libraries:

LibraryLicense
Spring BootApache 2.0
Spring AIApache 2.0
ASMBSD 3-Clause
CFRMIT
VineflowerApache 2.0
ProcyonApache 2.0

License

This project is licensed under the MIT License.

Source: README.md at commit 0c272ab

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v1.2.2LatestNov 7, 2026
  2. v1.2.1Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts