Claude MarketplacesSubmit
ako2345 avatar

Android Security Analyzer

ako2345/android-security-analyzer

Runs static security analysis on Android source code without requiring a build or SDK. Exposes four MCP tools: analyze_android_project scans manifests, Gradle files, Java/Kotlin source, and XML configs for 53 security issues across five categories (exported components, weak crypto, SQL injection patterns, hardcoded secrets, SSL bypasses). Each finding maps to CWE and OWASP Mobile Top 10 with severity scoring. Built on Cloudflare Workers with pattern matching and regex rules, so it's fast but won't catch dataflow issues a full SAST tool would. Useful for quick security sweeps in CI or when reviewing Android projects through Claude without spinning up heavyweight analysis infrastructure.

GitHub stars
2
tools
4
transport
HTTP
last updated
Mar 14, 2026
View on GitHub

Install

From registry metadata
$ npx add-mcp https://android-security-analyzer.ako-labs.workers.dev/mcp --name android-security-analyzer

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http android-security-analyzer https://android-security-analyzer.ako-labs.workers.dev/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 4 tools

Verified live against the running server on Nov 6, 2026.

analyze_android_projectAnalyzes an Android project's source code for security vulnerabilities. Accepts project files (AndroidManifest.xml, build.gradle, Java/Kotlin sources, XML configs) and returns a structured security report with findings, severity scores, and recommendations.3 params

Analyzes an Android project's source code for security vulnerabilities. Accepts project files (AndroidManifest.xml, build.gradle, Java/Kotlin sources, XML configs) and returns a structured security report with findings, severity scores, and recommendations.

Parameters* required
files*array
Array of project files to analyze
optionsobject
Analysis options
projectName*string
Name of the Android project being analyzed
list_android_security_checksReturns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.1 params

Returns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.

Parameters* required
categorystring
Filter rules by category (manifest, gradle, source, xml-config, secret). Leave empty for all rules.one of manifest · gradle · source · xml-config · secret
explain_findingExplains a specific security finding by its rule ID. Returns why it is a risk, how to fix it, and false positive considerations.1 params

Explains a specific security finding by its rule ID. Returns why it is a risk, how to fix it, and false positive considerations.

Parameters* required
findingId*string
The rule/finding ID (e.g., MAN-001, SRC-003, SEC-002)
healthReturns the server health status, version, and rule engine statistics.

Returns the server health status, version, and rule engine statistics.

No parameters. Call it with no arguments.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

Android Security Analyzer

MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.

What it does

Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers:

  • Manifest analysis — exported components, dangerous permissions, cleartext traffic, debug flags, backup settings, SDK versions
  • Gradle/build config — release build misconfigurations, outdated SDKs, suspicious dependencies, hardcoded secrets
  • Source code (Java/Kotlin) — insecure WebView, SSL/TLS bypass, weak crypto, SQL injection patterns, process execution, insecure file storage, PendingIntent issues
  • XML configuration — network security config weaknesses, overly broad file provider paths
  • Secret scanning — API keys, tokens, passwords, private keys, cloud credentials, high-entropy strings

All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.

Architecture

View the full README on GitHub

Details

Repository
github.com/ako2345/android-security-analyzer
Categories
Security & Pentesting, Mobile Development
Transport
HTTP
Registry
MCP registry, active
Tools verified
Nov 6, 2026

Related Security & Pentesting MCP servers

View all
1rom-baro avatarArcwall Securityrom-baro/arcwall-mcpSecurity scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks.1stars
2csoai-org avatarOwasp Agentic Mcpcsoai-org/owasp-agentic-mcpOwasp Agentic MCP Server by MEOK AI Labs0stars
3csoai-org avatarSecurity Scanner Ai Mcpcsoai-org/security-scanner-ai-mcpSecurity Scanner Ai MCP Server by MEOK AI Labs0stars
4mastrophot avatarContract Security Scannermastrophot/near-mcp-contract-securityMCP smart contract scanner with NEAR-focused security context.0stars
5viridis-security avatarInjection Detectorviridis-security/mcp-services-sdkFormally-verified injection/exfiltration detector for AI agents (MCP-02).0stars
6weiseer avatarcve-cacheweiseer/cve-cache-mcpRecent CVE + GHSA cache for AI agents auditing dependencies (npm/PyPI/Cargo/Maven/Go).0stars