io.github.ako2345由 GitHub 帳號 ako2345 發布v1.0.0更新於 Oct 24, 2026
MCP server for static security analysis of Android source code
遠端 MCP 伺服器，對 Android 專案原始碼做靜態安全掃描，回傳含風險評分的結構化報告與修正建議。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.ako2345%2Fandroid-security-analyzer/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"android-security-analyzer": {
"type": "http",
"url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
}
}
}MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.
Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers:
All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.
Key design decisions:
fast-xml-parserzodHosted server (recommended for Cline / MCP clients): no local install needed. The server runs at:
https://android-security-analyzer.ako-labs.workers.dev/mcp
Add this URL to your MCP client configuration (see Connecting from an MCP client below).
Local development:
This starts a local Wrangler dev server. The MCP endpoint is available at http://localhost:8787/mcp.
Deploys to Cloudflare Workers. Requires wrangler authentication (npx wrangler login).
Unix:
Windows (PowerShell):
Unix:
Windows (PowerShell): ответ приходит в result.tools; чтобы увидеть список как JSON, используйте сырой ответ:
Либо через объект: (Invoke-RestMethod ...).result.tools | ConvertTo-Json -Depth 5
Unix:
Windows (PowerShell):
Unix:
Windows (PowerShell):
Add to your MCP client configuration:
For production (hosted):
The analyzer implements 53 security rules across 5 categories:
Each finding includes:
Risk score (0-100) is computed from finding severities:
The raw sum is normalized against an expected maximum of 50 points.
src/rules/src/analyzers/src/mappings/cwe.ts if neededsrc/core/registry.tsMIT
來源：README.md，提交 a14bd0d
Analyzes an Android project's source code for security vulnerabilities. Accepts project files (AndroidManifest.xml, build.gradle, Java/Kotlin sources, XML configs) and returns a structured security report with findings, severity scores, and recommendations.
files必填optionsprojectName必填Returns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.
categoryExplains a specific security finding by its rule ID. Returns why it is a risk, how to fix it, and false positive considerations.
findingId必填Returns the server health status, version, and rule engine statistics.
無需輸入參數。
已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在儲存庫或註冊中心條目中宣告授權條款。
POST /mcp ──► McpServer (JSON-RPC 2.0) ──► Tool Router │ ┌───────────────────────────────┘ ▼ Orchestrator │ ┌─────────┼─────────┬─────────────┬──────────────┐ ▼ ▼ ▼ ▼ ▼ Manifest Gradle Source Code XML Config Secret Analyzer Analyzer Analyzer Analyzer Scanner │ │ │ │ │ └─────────┴─────────┴─────────────┴──────────────┘ │ ▼ Scoring + Deduplication ──► AnalysisReportnpm installnpm run devnpm run deploynpm test # Run all testsnpm run test:watch # Watch modenpm run typecheck # TypeScript type checkingcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}'(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"health","arguments":{}}}' -UseBasicParsing).Contentcurl -X POST http://localhost:8787/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 4, "method": "tools/call", "params": { "name": "analyze_android_project", "arguments": { "projectName": "TestApp", "files": [ { "path": "app/src/main/AndroidManifest.xml", "content": "<manifest><application android:debuggable=\"true\" android:allowBackup=\"true\"></application></manifest>" } ] } } }'$body = @{ jsonrpc = "2.0" id = 4 method = "tools/call" params = @{ name = "analyze_android_project" arguments = @{ projectName = "TestApp" files = @( @{ path = "app/src/main/AndroidManifest.xml" content = "<manifest><application android:debuggable=`"true`" android:allowBackup=`"true`"></application></manifest>" } ) } }} | ConvertTo-Json -Depth 10(Invoke-WebRequest -Method Post -Uri "http://localhost:8787/mcp" -ContentType "application/json" -Body $body -UseBasicParsing).Content{ "mcpServers": { "android-security-analyzer": { "url": "http://localhost:8787/mcp" } }}{ "mcpServers": { "android-security-analyzer": { "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp" } }}src/├── index.ts # Worker entry point├── server/│ ├── mcp.ts # MCP JSON-RPC 2.0 handler│ └── tools/ # MCP tool implementations│ ├── analyzeAndroidProject.ts│ ├── listAndroidSecurityChecks.ts│ ├── explainFinding.ts│ └── health.ts├── core/│ ├── types.ts # TypeScript types & Zod schemas│ ├── scoring.ts # Risk score computation│ ├── registry.ts # Rule registry│ └── orchestrator.ts # Analysis orchestrator├── analyzers/│ ├── manifestAnalyzer.ts│ ├── gradleAnalyzer.ts│ ├── sourceAnalyzer.ts│ ├── xmlConfigAnalyzer.ts│ └── secretScanner.ts├── parsers/│ ├── xml.ts # XML parser wrapper│ ├── gradle.ts # Gradle file parser│ ├── source.ts # Source code pattern matcher│ └── files.ts # File classifier├── rules/│ ├── manifestRules.ts│ ├── gradleRules.ts│ ├── sourceRules.ts│ ├── xmlRules.ts│ └── secretRules.ts├── mappings/│ ├── cwe.ts # CWE descriptions│ └── owaspMobile.ts # OWASP Mobile Top 10└── utils/ ├── lines.ts # Line number utilities ├── paths.ts # Path classification └── text.ts # Text utilitiestest/├── fixtures/ # Sample Android project files├── unit/ # Unit tests per module└── integration/ # Full analysis integration tests