Android Security Analyzer

What Android Security Analyzer MCP server does

Android Security Analyzer MCP server reviews Android application source files for security issues without compiling the project. It accepts project file paths and contents, classifies the files, runs several focused analyzers, and returns a structured report.

Coverage includes AndroidManifest.xml settings such as exported components, permissions, cleartext traffic, debugging, backups, and SDK declarations. Gradle analysis checks release configuration, SDK versions, dependencies, and embedded secrets. Java and Kotlin checks look for patterns associated with WebView misuse, TLS or SSL bypasses, weak cryptography, SQL injection, process execution, unsafe file storage, and PendingIntent problems. XML checks cover network security configuration and broad FileProvider paths. Secret scanning searches for items such as API keys, tokens, passwords, private keys, cloud credentials, and high-entropy strings.

The rule set contains 53 checks across manifest, Gradle, source, XML configuration, and secret categories. Findings can include a stable rule identifier, severity, confidence, file path, line number when available, evidence, CWE and OWASP Mobile Top 10 mappings, and a recommended action.

How it works

The Android Security Analyzer MCP server runs as a stateless Streamable HTTP service on Cloudflare Workers. MCP JSON-RPC requests sent to /mcp are routed to the selected tool, and the analysis orchestrator combines results from independent analyzers. A lightweight XML parser is used for XML input; other checks rely on regular expressions and source or configuration patterns.

The service calculates a risk score from finding severities. Critical, high, medium, and low findings contribute different point values, while informational findings do not add points. The raw result is normalized against an expected maximum of 50 points.

Setup and configuration

The hosted endpoint is available at https://android-security-analyzer.ako-labs.workers.dev/mcp, so a local installation is not required. Add that URL as an MCP server in a compatible client. For local development, install dependencies with npm install, run npm run dev, and use http://localhost:8787/mcp.

Deployment uses npm run deploy and requires Wrangler authentication through npx wrangler login. The repository also provides commands for tests, watch mode, and TypeScript type checking. Requests can be tested directly with JSON-RPC over HTTP using tools such as curl or PowerShell.

Tools and capabilities

• analyze_android_project runs the complete analysis over supplied project files.
• list_android_security_checks returns the implemented security rules.
• explain_finding provides details for a selected rule.
• health reports server status and rule-engine statistics.

Limitations and notes

Android Security Analyzer MCP server is a pattern-based heuristic scanner, not a replacement for full SAST. It does not perform AST or data-flow analysis, and matching occurs per file rather than across call graphs. Raw source analysis also cannot reveal build-time transformations.

Secret checks and some code patterns can produce false positives. The Workers deployment has memory and CPU limits and no filesystem access. The server analyzes source code only; it does not inspect APK or AAB artifacts. Results should therefore be reviewed and validated as part of a broader security process.