v6.4.1

Release Notes: JADX AI MCP v6.4.1

A correctness and reliability patch release.

Four community-reported bugs, two of which spanned both the Java plugin and the Python server. Huge thanks to @LYC-Android, @mhsjzsq, @1yearning1, @darkblack1234, @zbhello, and @Merrg1n for the detailed reports.

No breaking changes. Every new parameter is optional and existing calls behave exactly as before.

---

Bug Fixes

rename_method could rename a method in the wrong class (#103)

On obfuscated APKs, short names like a() repeat across hundreds of classes. handleRenameMethod walked every included class and renamed the first name match it found, so the rename frequently landed on an arbitrary unrelated class silently, with a success response.
rename_method now accepts an optional class_name. When supplied, the plugin resolves that single class first and only searches within it, returning a proper 404 if the class doesn't exist or the method isn't in it. The matching logic moved into a tryRenameMethodInClass helper so the scoped and unscoped paths can't drift apart.

# Now deterministic on obfuscated APKs
await rename_method(
    method_name="a",
    new_name="decryptPayload",
    class_name="com.example.crypto.Helper",
)

Renaming a method made it unfindable afterwards (#106)

The subtle one. MethodInfo builds its shortId once, from the original method name, and never refreshes it. JavaMethod.getName(), meanwhile, reports the current alias. The moment you renamed a method, those two disagreed so any signature carrying the new name stopped matching shortId, and the method appeared to have vanished. Rename it once and you could no longer address it.

Signature matching now lives in a single MethodSignatures.matches() utility that compares against both getShortId() and the alias-aware makeSignature(true, true). A signature keeps resolving before and after a rename. Both rename_method and get_method_by_name use it, so the two tools can no longer disagree about whether a method exists.

get_resource_file returned HTTP 500 on binary resources (#105, server #59)

The handler called resFile.loadContent().getText().getCodeStr() unconditionally. For resources whose ResContainer wraps a ResourceFile rather than ICodeInfo - PNGs, fonts, arbitrary binary assets - getText() throws ClassCastException: ResourceFile cannot be cast to ICodeInfo. That surfaced as a hard HTTP 500 that aborted the tool call entirely.

Content loading and text extraction now go through safeLoadContent() and safeExtractText(), which normalize decode failures to null. Non-text resources return a structured, stable response instead of an error:

{
  "type": "resource/binary",
  "file": {
    "file_name": "res/drawable/icon.png",
    "content": "",
    "note": "Matched resource is not text-decodable by JADX"
  }
}

Nested-file lookup was also generalized: it previously only descended into resources.arsc, and now searches the subfiles of any container resource.

Codex CLI could not load the MCP server over stdio (#104, server #60)

FastMCP prints a startup banner to stdout. The stdio transport reserves stdout exclusively for MCP protocol frames, so the banner corrupted the stream and broke the initialize handshake before the client ever saw a tool.

Worth calling out: show_banner=False had already been proposed in PR #51 and was lost during merge 605429d. This was a silent regression, not a new bug. The fix restores it on the stdio path and carries an inline comment explaining exactly why it must stay, so it doesn't get dropped a third time.

Package install rejected Python 3.10–3.12 (server #63)

pyproject.toml declared requires-python = ">=3.13", a value present since the very first commit (efac9e1, beta v0.0.1) and almost certainly an unmodified uv init default rather than a deliberate constraint. It contradicted both the README badge (Python 3.10+) and the PEP 723 inline metadata in jadx_mcp_server.py, which already said >=3.10. The practical result: script mode ran fine on 3.10, but uv tool install and pip install refused for no technical reason.

Now >=3.10, verified empirically against a real CPython 3.10.18 interpreter:

Documentation

The ReadTheDocs reference pages had drifted far enough to be actively misleading, the documented rename_method signature would have failed for anyone who copied it. Five signatures were corrected against the live registered tool schemas, not transcribed by hand:

Tool	Correct signature
rename_method	(method_name, new_name, class_name=None, method_signature=None)
rename_variable	(class_name, method_name, variable_name, new_name, reg=None, ssa=None)
search_classes_by_keyword	(search_term, package='', search_in='code', offset=0, count=20)
get_method_by_name	(class_name, method_name, method_signature=None)
get_xrefs_to_method	(class_name, method_name, offset=0, count=20)

The pages also shed a large amount of duplicated prose and aspirational examples describing tools that were never shipped, a net −1,966 lines across 10 pages.

Issues Closed

Issue	Reporter	Summary
#103	@LYC-Android	rename_method lacks class_name, causes wrong-class renames
#104	@zbhello	Codex CLI cannot load jadx mcp
#105	@1yearning1	get_resource_file() 500 error
#106	@mhsjzsq	Rename failed
server #59	@darkblack1234	ClassCastException: ResourceFile cannot cast to ICodeInfo
server #60	@Merrg1n	stdio transport fails to initialize with Codex CLI

Merged Pull Requests

Plugin — #109 (fixes), #110 (version), #111 (docs) Server — #61 (fixes), #62 (version), #63 (Python floor)

Upgrading

Both components must be on 6.4.1, the class_name fix requires the server to send the parameter and the plugin to honor it.

Full Changelog: v6.4.0...v6.4.1

New Contributors

• All the awesome people who helped in identification and fixing of these issues by providing valuable insights have been added as contributors:
• @mhsjzsq
• @LYC-Android
• @Merrg1n
• @1yearning1
• @darkblack1234
• @zbhello

Checksum SHA256:
jadx-mcp-server-6.4.1.zip: e7cf0fa756b817cde3d3a2b6c04a6a6eb8546298eaff6a957e711fb68e53b532
jadx-ai-mcp-6.4.1.jar: df7040ee4bc724c132635e8ad906b0961829db09a35da3365cbc46a761bed983

v6.4.0 Search Infrastructure Overhauled

What's Changed

• fix: resolve search timeout on large APKs and add progress tracking by @mostafaNazari702 in #94

Release Notes: JADX AI MCP v6.4.0

This major release focuses on drastically improving stability, performance, and reliability when analyzing massive Android applications. We've overhauled the search infrastructure to eliminate timeouts, fixed severe native memory leaks, and added precise refactoring capabilities for overloaded methods.

A huge shoutout to @mostafaNazari702 for their massive contributions to the search timeout and progress tracking features in this release! 🎉

What's New & Improved

Performance & Stability (Handling Massive APKs)

• Metadata-Based Search & Progress Polling: Resolved a critical issue where the MCP server would timeout while searching through extremely large APKs. The server now leverages metadata-based scanning instead of full decompilation and utilizes a dynamic polling mechanism (/search-progress) to keep the connection alive while reporting real-time progress back to the AI model. (Thanks to @mostafaNazari702! PRs #94, #54)
• Native Memory Leak Fix: Fixed a severe native memory exhaustion bug by ensuring Deflater and Inflater streams within the DecompilationCache are explicitly closed (.end()).
• Thread Contention Eliminated: Replaced Math.random() with UUID.randomUUID() for search ID generation, eliminating lock contention and collisions in parallel stream workers during heavy concurrent searches.
• Cache Optimizations: Fixed a double-lookup bug in ClassRoutes that caused redundant CPU decompression overhead and artificially inflated cache hit statistics.

Refactoring & Search Precision

• Overloaded Method Disambiguation (Issue #89): The get_method_by_name and rename_method MCP tools now support an optional method_signature parameter. This allows AI models and users to precisely identify, read, and refactor specific methods when multiple overloads exist (e.g., distinguishing between onCreate(Bundle) and onCreate(Bundle, PersistableBundle)).

Bug Fixes

• Startup Proxy Crash (Issue #99): Fixed a bug where the MCP server would immediately crash on startup if the host system had a dirty no_proxy (or other proxy-related) environment variable containing non-printable characters or trailing newlines. The server now thoroughly sanitizes the environment before dependencies are loaded.

Core Upgrades

• Upgraded underlying dependency to JADX Core v1.5.5.

---

New Contributors

• @mostafaNazari702 made their first contribution in #94

Full Changelog: v6.3.0...v6.4.0

Checksum SHA256:

• jadx-mcp-server-6.4.0.zip: 4dcfa6137f090ae46f88ff5a190a7efc6f578172a68c4ba1dd85974ed9d3da9f
• jadx-ai-mcp-6.4.0.jar: 46f1c76b3ebdfdf1d0e4792a0e1bc1bc404b29d79c00606e89e28a25726b67c7

v6.3.0 - Remote Host Support

JADX-AI-MCP v6.3.0 Release Notes

Announcing the release of JADX-AI-MCP v6.3.0, fundamentally improving the way the MCP Server connects with the JADX Plugin, enhancing security across the transport layer, and resolving critical bugs that affected remote/Docker workflows and JSON-RPC stability.

Key Features & Architectural Changes

1. Advanced Network Topologies (--host & --jadx-host) The architecture has been redesigned to support flexible deployments, such as running the server in Docker, WSL, or on a remote VM, separate from the JADX GUI.

   --host [IP]: The Python MCP server can now bind to any interface (e.g., 0.0.0.0), allowing LLM clients from external networks to connect over HTTP.
   --jadx-host [IP]: Replaces the hardcoded 127.0.0.1 plugin target. The MCP Server can now connect to a JADX plugin running on an entirely different machine.

2. Deep Stdio Integrity (Fixing Claude Desktop & LM Studio) When running the server in stdio mode (used by Claude Desktop and Codex), any human-readable logging previously polluted stdout and fatally corrupted the JSON-RPC stream.

   • All application banners, startup checks, and internal logs are now strictly routed to stderr.
   • stdout is now 100% reserved for pure MCP communication.

3. Advanced Tool Parameters
   Manifest Extraction: Added the get_manifest_component tool for targeted extraction of precise AndroidManifest XML components (Activities, Receivers, Services).

🛡️ Security & Stability

• Proxy Isolation (trust_env=False): The internal HTTP client routing traffic to the JADX plugin now ignores system proxy variables (http_proxy/https_proxy). This prevents OS-level VPNs and enterprise proxies from accidentally intercepting or breaking the internal 127.0.0.1 API loop.
• Runtime Security Warnings: When binding --host to remote interfaces like 0.0.0.0, the server now issues immediate, unavoidable initialization warnings covering the risks of unencrypted/unauthenticated HTTP transport over open networks.

Checksum SHA256:

• jadx-mcp-server-6.3.0.zip: 36b7139e16f754b13c04d995b868eb1d33785e36944b9af65f311fc3f95c94bf
• jadx-ai-mcp-6.3.0.jar: 5ccd9593eab85f69115647b3bfba84eb290b620fcd4015c5b8343a90701813d2

New Contributors:

• @bx33661
• @Haicaji
• @ChineseAStar

Full Changelog: v6.2.0...v6.3.0

v6.2.0

Fixed the Issues:

• Fixed the following issue -> #81 The plugin server now reliably releases the port when JADX re-initializes plugins. The ServerSocketChannel extraction uses a robust multi-fallback reflection strategy compatible with Jetty 12's internal API changes, ensuring cross-classloader cleanup works correctly.

What's Changed

• Dependency Upgrades
  • Javalin 6.4.0 → 6.7.0 (JADX Plugin) — Updated to the latest Javalin 6.x release (Still supporting JVM 11)
  • FastMCP → 3.0.2 (Python MCP Server) — Updated to the latest FastMCP release
    • Replaced mcp[cli] dependency with fastmcp>=3.0.2 in pyproject.toml
    • Cleaned up requirements.txt (removed stdlib entries, added version pins)

Full Changelog: v6.1.0...v6.2.0

Checksum SHA256:

• jadx-ai-mcp-6.2.0.jar: fbd327a274c7afc3b736c20d43c9196e668bd94cd634fe3402661a9cf98e288a
• jadx-mcp-server-v6.2.0.zip: d5af3480c42ce87e322ec0c08784e4f82ea7bf646af56b4a3a7540032159a6ce

v6.1.0 Enhanced Searching and Rename Variables

What's Changed

Two of the most impactful contributions have been made.

• 1. Enhance handleSearchClassesByKeyword by @ljt270864457 in #80
     1. Package filtering - Limit search scope to specific packages with special handling for jadx obfuscated packages
     2. Multi-location search - Search across multiple locations (class names, method names, field names, code, comments) with URL-friendly lowercase parameters
     3. Improved method search - Match jadx's search behavior by including method names, constructor names, and parameter types
• 2. Feature: Rename variables/arguments by @p0px in #83, this new mcp tool is used to rename the variables and deobfuscate the code further.

Contributors

• @ljt270864457 made their contribution in #80
• @p0px made their first contribution in #83

Full Changelog: v6.0.0...v6.1.0

Checksum SHA256:

• jadx-ai-mcp-6.1.0.jar: ba3a0f66e1aa253ab85faa5c22625d20936aac90543238c09e633f1970852c41
• jadx-mcp-server-v6.1.0.zip: 572b814636eebfe5840c9cc5987e1e8c9f38269a118e9b73cccdd178a574e5ca

v6.0.0 The Modular Architecture Update

Release v6.0.0: The Modular Architecture Update 🏗️

Major Architectural Overhaul

This release marks a significant milestone in the project's history. We have transitioned from a monolithic design to a fully modular architecture for both the Java Plugin and the Python MCP Server. This change lays the foundation for faster feature development, easier contributions, and improved stability.

📚 New Documentation

We have launched a complete documentation site! No more guessing how to configure ports or write custom tools.

• Home: jadx-ai-mcp.readthedocs.io

Key Highlights

• Modular Java Backend: The monolithic JadxAIMCP.java (previously ~3,800 lines) has been refactored into domain-specific route handlers.
  • Core Logic: McpServer.java now manages the server lifecycle.
  • Route Handlers: Separate classes for distinct functionalities:
    • ClassRoutes (Class navigation & source code)
    • SearchRoutes (Method & class search)
    • ResourceRoutes (Manifest & resources)
    • RefactoringRoutes (Rename operations)
    • XrefsRoutes (XRefs & usage)
    • DebugRoutes (Stack frames & variables)
  • UI Separation: All Swing components moved to PluginMenu.java.
• Modular Python Server: The jadx_mcp_server.py script has been broken down into a structured package:
  • Tools are now organized in src/server/tools/ (e.g., class_tools.py, search_tools.py).
  • Centralized configuration in src/server/config.py.
• Improved Maintainability:
  • 95% reduction in main file size.
  • Clear separation of concerns makes it easier to add new endpoints.
  • Enhanced testability for individual components.

What's New

• Optimized Performance: Reduced memory usage and faster startup times due to cleaner class loading.
• Standardized Error Handling: More consistent error responses across all API endpoints.

For Contributors

• New Directory Structure: Please refer to the updated project structure in the README. Adding a new feature is now as simple as creating a new Route class and registering it in McpServer.
• Better Onboarding: The codebase is now self-documenting and much easier to navigate.

Full Changelog

• Refactored JadxAIMCP.java into modular components.
• Implemented McpServer for centralized Javalin management.
• Created PluginMenu for UI interactions.
• Modularized Python MCP server into src/server package.

Full Changelog: v5.0.0...v6.0.0

---

A huge thank you to everyone who supported this refactoring effort! Your patience and feedback made this possible.

Checksum SHA256:

• jadx-ai-mcp-6.0.0.jar: 3f053274f49cf5dcc647548dc716c9b0bdae64ca1d50b8767ed9b5e46bbf636f
• jadx-mcp-server-v6.0.0.zip: `37f1db9f94cffdf1b2f1e4372e2bef06ca8913149502536e94cf055fa8eaf93c

v5.0.0 The Xrefs Update

New MCP Tools:

• xrefs-to-class - Find all references to a class
  Returns method-level references: { class, method }
  Returns class-level references: { class, method: "" }
  Supports pagination via offset and limit parameters

• /xrefs-to-method - Find all references to a method
  Includes override-related methods for polymorphic support
  Matches JADX GUI's "Find Usage" behavior
  Supports pagination

• /xrefs-to-field - Find all references to a field
  Returns methods that access the field
  Method field is always non-empty (field access always occurs within a method)
  Supports pagination

Bug Fix:

• There was a bug in get_main_application_classes_code(), implmentation was missing on plugin side and on the jadx_mcp_server.py side, the json key name was mismatch, the plugin is sending the data in 'classes' but jadx_mcp_server.py was looking for some other key.

What's Changed

• add xref feature implements by @ljt270864457 in #59
• feat: added pagination support in get_all_resource_file_names() mcp tool by @zinja-coder in #61
• optimize: separated pagination utils class from main jadx ai mcp file… by @zinja-coder in #62
• Code Improvements
  • Separated PaginationUtils class to progress towards modular design.
  • **BELOW CONTRIBUTIONS ARE MADE BY @ljt270864457 **
  • Refactoring: Extracted common helper methods to reduce code duplication:
  • validateRequiredParam() - Parameter validation
  • findClassByName() - Class lookup
  • findMethodsByName() - Method lookup (supports constructors)
  • findFieldByName() - Field lookup
  • collectMethodNodeReferences() - Reference collection with deduplication
  • sendXrefsResponse() - Paginated response handling

Checksum SHA256:

• jadx-ai-mcp-5.0.0.jar: a071a47587dc0810ecfe013f505eb893f1807e2a54573637dfbaabd1fb957f23
• jadx-mcp-server-v5.0.0.zip: 5e7d4a4773c125d754f6d9e5a4c457116b29ac54c0ea97fc8187a187cacf4e85

Full Changelog: v4.2.0...v5.0.0

v4.2.0 Rename Package

New MCP tool

• rename_package() : Renames a package and all its classes.
  - Args:
  1. old_package_name: The current package path to be renamed (e.g., "com.abc.def")
  2. new_package_name: The target package path (e.g., "com.example.newpkg")
  - Returns: The response from the JADX server with rename results.

Full Changelog: v4.1.0...v4.2.0

Checksum SHA256:

• jadx-ai-mcp-4.2.0.jar: 1d78aef061cd90b7de164603d8c7e023b9e62e2c8307a425a936dd2d86c01d48
• jadx-mcp-server-v4.2.0.zip: 5bf6a92e862f08ef92c6e37c8c1c8767f2af9e4bb4a5493348c1132462908bee

v4.1.0 Search Classes By Keyword

New MCP Tool

• search_classes_by_keyword() : Search for classes whose source code contains a specific keyword (supports pagination)
  • During Android APK reverse engineering and security analysis, analysts often need to quickly locate classes that contain specific keywords (e.g., "encrypt", "password", "API_KEY", etc.). The existing get_all_classes() tool only lists class names, and manually searching through decompiled code is time-consuming. This feature provides a powerful search capability that scans the actual source code of all classes.

Changes

• Feature commit by @ljt270864457 in #50
• feat: merged the PR 50, new mcp tool to search classes code for speci… by @zinja-coder in #51
• Full Changelog: v4.0.0...v4.1.0

New Contributors

• @ljt270864457 made their first contribution in #50

Checksum SHA256:

• jadx-ai-mcp-4.1.0.jar: 76ac405e2cdddb4d7af48b4bee3fa046be65a63addddcdf506430130a0c0448e
• jadx-mcp-server-4.1.0.zip: 11d3e4096cb1a3d7e2ec503293fea1d2210816499ee3d23d5d1f2947188c58a6

v4.0.0 DEBUGGER MCP TOOLS

New MCP Tools

1. debug_get_stack_frames() : returns stack frame from Jadx Debugger, can be used to analyze the execution flow of the APK..
2. debug_get_threads() : returns threads insights from Jadx Debugger
3. debug_get_variables() : returns variables insights from jJadx Debugger

Demo:

adx-ai-mcp-debug-demo-1.2.mp4

What's Changed

• feat: improved message for class not found error, now this error will plrint class name as well to tell which calss is not found
• refactor: removed .idea folder
• fix: fixed following build error -> JadxAIMCP.java:[56,24] package jadx.gui.plugins does not exist
• refactor: migrated to com.zin.jadxaimcp package name

Full Changelog: v3.3.5...v4.0.0

Checksum SHA256:

• jadx-mcp-server-v4.0.0.zip : 596d8f74694ff7b14230d5825f1b33f0a35be2d4a76380808708be3a48b60585
• jadx-ai-mcp-4.0.0.jar: bb225f0eb3db9a0929df88c98a05286e351afc7ca8bd25c2f2bad6f8f70a3634