MCP server for static security analysis of Android application source code.
Analyzes Android project source files — without building the project — and returns a structured security report. The analysis covers: * Manifest analysis — exported components, dangerous permissions, cleartext traffic, debug flags, backup settings, SDK versions * Gradle/build config — release build misconfigurations, outdated SDKs, suspicious dependencies, hardcoded secrets * Source code (Java/Kotlin) — insecure WebView, SSL/TLS bypass, weak crypto, SQL injection patterns, process execution, insecure file storage, PendingIntent issues * XML configuration — network security config weaknesses, overly broad file provider paths * Secret scanning — API keys, tokens, passwords, private keys, cloud credentials, high-entropy strings
All analysis is regex/pattern-based and runs natively in the Workers runtime with no external tools, Java, or Android SDK required.
Once installed, try these example prompts and explore these capabilities:
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
This is a well-architected Android security analyzer MCP server with proper input validation, clean code structure, and appropriate permissions for its purpose. A few minor code quality issues were identified but do not pose security risks. Supply chain analysis found 3 known vulnerabilities in dependencies (1 critical, 1 high severity).
Scanned 6 files · 5 findings
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Be the first to review this server!