# Android Security Analyzer [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/ako2345/android-security-analyzer  
**GitHub Stars:** 3  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/android-security-analyzer

## Description
MCP server for static security analysis of Android source code

## Tools
Capabilities this server exposes over MCP:

- **analyze_android_project** — Analyzes an Android project's source code for security vulnerabilities. Accepts project files (AndroidManifest.xml, build.gradle, Java/Kotlin sources, XML configs) and returns a structured security report with findings, severity scores, and recommendations.
- **list_android_security_checks** — Returns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.
- **explain_finding** — Explains a specific security finding by its rule ID. Returns why it is a risk, how to fix it, and false positive considerations.
- **health** — Returns the server health status, version, and rule engine statistics.

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "android-security-analyzer": {
    "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
  }
}
```

## Documentation

## What Android Security Analyzer MCP server does

Android Security Analyzer MCP server reviews Android application source files for security issues without compiling the project. It accepts project file paths and contents, classifies the files, runs several focused analyzers, and returns a structured report.

Coverage includes AndroidManifest.xml settings such as exported components, permissions, cleartext traffic, debugging, backups, and SDK declarations. Gradle analysis checks release configuration, SDK versions, dependencies, and embedded secrets. Java and Kotlin checks look for patterns associated with WebView misuse, TLS or SSL bypasses, weak cryptography, SQL injection, process execution, unsafe file storage, and PendingIntent problems. XML checks cover network security configuration and broad FileProvider paths. Secret scanning searches for items such as API keys, tokens, passwords, private keys, cloud credentials, and high-entropy strings.

The rule set contains 53 checks across manifest, Gradle, source, XML configuration, and secret categories. Findings can include a stable rule identifier, severity, confidence, file path, line number when available, evidence, CWE and OWASP Mobile Top 10 mappings, and a recommended action.

## How it works

The Android Security Analyzer MCP server runs as a stateless Streamable HTTP service on Cloudflare Workers. MCP JSON-RPC requests sent to `/mcp` are routed to the selected tool, and the analysis orchestrator combines results from independent analyzers. A lightweight XML parser is used for XML input; other checks rely on regular expressions and source or configuration patterns.

The service calculates a risk score from finding severities. Critical, high, medium, and low findings contribute different point values, while informational findings do not add points. The raw result is normalized against an expected maximum of 50 points.

## Setup and configuration

The hosted endpoint is available at `https://android-security-analyzer.ako-labs.workers.dev/mcp`, so a local installation is not required. Add that URL as an MCP server in a compatible client. For local development, install dependencies with `npm install`, run `npm run dev`, and use `http://localhost:8787/mcp`.

Deployment uses `npm run deploy` and requires Wrangler authentication through `npx wrangler login`. The repository also provides commands for tests, watch mode, and TypeScript type checking. Requests can be tested directly with JSON-RPC over HTTP using tools such as `curl` or PowerShell.

## Tools and capabilities

- `analyze_android_project` runs the complete analysis over supplied project files.
- `list_android_security_checks` returns the implemented security rules.
- `explain_finding` provides details for a selected rule.
- `health` reports server status and rule-engine statistics.

## Limitations and notes

Android Security Analyzer MCP server is a pattern-based heuristic scanner, not a replacement for full SAST. It does not perform AST or data-flow analysis, and matching occurs per file rather than across call graphs. Raw source analysis also cannot reveal build-time transformations.

Secret checks and some code patterns can produce false positives. The Workers deployment has memory and CPU limits and no filesystem access. The server analyzes source code only; it does not inspect APK or AAB artifacts. Results should therefore be reviewed and validated as part of a broader security process.

_Full upstream README: https://allmcps.com/mcp/android-security-analyzer/readme_