ApktoolSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) [](https://modelcontextprotocol.io/) [](https://github.com/google-gemini/gemini-cli)
A powerful Model Context Protocol (MCP) server that exposes Apktool functionality for Android APK analysis and reverse engineering. Integrates seamlessly with Gemini CLI to provide AI-powered APK security analysis, privacy auditing, and reverse engineering guidance through natural language commands.
🚀 Features
🔍 Comprehensive APK Analysis
- Decompile APKs to extract resources, manifest, and smali code
- Analyze permissions and app components for security assessment
- Extract string resources and detect hardcoded secrets
- Search smali code for specific patterns and security vulnerabilities
- Recompile modified APKs after making changes
🤖 AI-Powered Workflows
- Natural language commands for complex APK analysis tasks
- Automated security audits with AI-generated insights
- Privacy compliance checking and GDPR/CCPA analysis
- Step-by-step reverse engineering guidance
- Intelligent vulnerability detection and risk assessment
🛠 8 Core Tools
7067aeafa699OBSERVED · 2026-10-08Exposed tools (8)
7 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
analyze_manifest | read | Analyze AndroidManifest.xml from a decompiled APK |
build_apk | read | Recompile/build an APK from decompiled source directory |
decode_apk | read | Decompile an APK file to extract resources, manifest, and smali code |
extract_strings | read | Extract all string resources from a decompiled APK |
find_smali_references | read | Search for specific patterns in smali code |
get_apk_info | read | Get basic information about an APK file using aapt |
install_framework | write | Install framework APK for system app decompilation |
list_permissions | read | List all permissions requested by an APK |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
Gates applied: no_behavioural_pass, no_license.
7067aeafa699full audit observations/trust-audit/mcp-server/secfathy__apktool-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 7067aeafa699 | SAFE | B | 89 | first audit |
Questions
What tools does Apktool expose?
8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Apktool safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Apktool need?
No credential environment variables were found in its source, so it appears to need none.
How does Apktool run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (7067aeafa699), read on 2026-10-08. The repository is watched and re-audited when it changes.