v0.7.1

What's Changed

• build(deps): Bump actions/setup-java from 5 to 6 by @dependabot[bot] in #31

Full Changelog: v0.7.0...v0.7.1

v0.7.0

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• build(deps): Bump jvm from 2.4.0 to 2.4.10 by @dependabot[bot] in #22
• build(deps): Bump com.gradleup.shadow from 9.5.1 to 9.6.1 by @dependabot[bot] in #24
• build(deps): Bump io.modelcontextprotocol:kotlin-sdk from 0.14.0 to 0.15.0 in the mcp-kotlin-sdk group across 1 directory by @dependabot[bot] in #27
• build(deps): Bump gradle-wrapper from 9.6.1 to 9.7.1 by @dependabot[bot] in #30
• build(deps): Bump actions/setup-java from 5 to 5.6.0 by @dependabot[bot] in #25
• fix: register jadx input plugins in shadow jar (APK only resolves 1 class) by @Catapult291 in #26

New Contributors

• @Catapult291 made their first contribution in #26

Full Changelog: v0.5.1...v0.6.0

v0.5.1

Full Changelog: v0.5.0...v0.5.1

v0.5.0

jadx-headless-mcp v0.5.0

Headless MCP (stdio) server for Android APK static analysis on jadx-core. 26 tools.

Change

• Resource export moved out. export_apk_resources / export_arsc_resources (added in v0.4.0)
  are removed from this server. They now live in the sibling dex-forge MCP, which also
  performs the DEX side of an APK-repack pipeline (merge / strip classes / dex→.class jar). Keeping
  the write-side (producing files) in one place leaves jadx-headless-mcp as pure read-only static
  analysis.

If you used the v0.4.0 resource-export tools, get them from dex-forge instead — same behaviour,
same jadx-core ResourcesSaver code path.

Everything else is unchanged from v0.4.0 (inner-class resolution, seamless smali fallback,
method-level smali, hard decompile timeout, jadx 1.5.6).

v0.4.0

jadx-headless-mcp v0.4.0

Headless MCP (stdio) server for Android APK static analysis on jadx-core. 28 tools (up from 26).

Highlights

• Resource export — two new tools that dump decoded resources to a directory on disk, the same operation as the jadx GUI's right-click "Export" on a resource node. Both are thin wrappers over jadx-core's own jadx.core.xmlgen.ResourcesSaver (the exact Runnable the GUI export runs), so output matches the GUI 1:1: binary AXML decoded to text, drawables/raw/fonts copied verbatim from the zip, res/ layout preserved, path-traversal blocked by jadx itself.
• Complementary scoping, matching the two res nodes in the GUI tree — file-based res/ vs. the table-decoded res/values* that live only inside resources.arsc.
• Runs on the single decompile worker under a wide wall-clock budget (DEFAULT_EXPORT_TIMEOUT_MS = 300000, timeout_ms overridable); response returns out_dir / sources_scoped / file_count / total_bytes / a manifest_limit-capped file sample / per-file errors. These tools write to the local disk (client and server share the filesystem).
• Verified end-to-end over MCP stdio against GCash base.apk: arsc → 141 files, apk res → 10241 files, errors: [].

New tools

Tool	Description
export_apk_resources	Export the APK's file-based res/ tree to disk (decoded AXML + verbatim drawables/raw/fonts). prefix overridable (e.g. assets/).
export_arsc_resources	Export the decoded resources.arsc value tree (res/values*, public.xml) — entries that exist only inside the arsc binary, not as standalone files.

Install

Download jadx-headless-mcp-0.4.0-all.jar (self-contained fat jar) and run via java -jar, or build the launcher with ./gradlew installDist. Requires JDK 17+.

v0.3.0

jadx-headless-mcp v0.3.0

Headless MCP (stdio) server for Android APK static analysis on jadx-core. 26 tools (up from 20).

Highlights

• Inner / $Companion class resolution — flatten nested classes into indexes; resolve dotted (Outer.Inner), raw (Outer$Companion), canonical, and unique fuzzy names via resolve_class / shared resolveClassArg.
• Seamless smali fallback — when jadx emits anti-decompile stubs (Code decompiled incorrectly, Method not decompiled, …), get_class_source / get_method_by_name / get_method_body auto-return smali with a // [jadx java-decompile failed → smali] header (smali_fallback=false to opt out).
• Method-level smali — get_method_smali / get_method_body slice .method….end method from class disassembly (jadx has no per-method smali API).
• Smali paging — get_smali_of_class supports offset; response reports total_bytes / next_offset.
• Hard decompile timeout — wall-clock budget (--decompile-timeout-ms, default 90s) so fat/obfuscated classes cannot hang MCP for hours.
• Windows startScripts — CLASSPATH uses lib\* to avoid CMD 8191 limit.
• jadx 1.5.6, Kotlin 2.4.0, MCP Kotlin SDK 0.13.x.

New tools

Tool	Description
get_method_body	One method as Java-if-possible-else-smali (JSON: mode, fell_back, markers, overloads)
get_method_smali	Smali of a single method (all overloads)
get_inner_classes	Nested classes with dotted full_name + raw $ raw_name
resolve_class	Resolve fuzzy/inner/$Companion name → exact FQN or candidates

Also since v0.1.0

• Disable JADX case-insensitive-FS rename pass
• Raise code-scope scan caps + --max-scan
• Manifest-less XAPK: pre-extract base APK
• Dependency bumps (Gradle wrapper, shadow, checkout action, slf4j, …)

Asset

• jadx-headless-mcp-0.3.0-all.jar — runnable fat jar (java -jar …)

Run

java -jar jadx-headless-mcp-0.3.0-all.jar
# or eager-load:
java -jar jadx-headless-mcp-0.3.0-all.jar --apk /path/to/app.apk

Or from source: ./gradlew installDist → build/install/jadx-headless-mcp/bin/jadx-headless-mcp.

Full tool list and MCP client config: see README.

v0.1.0

Initial release of jadx-headless-mcp — a headless MCP (stdio) server for Android APK static analysis powered by JADX.