Android Security Analyzer MCP Server

MCP server for static security analysis of Android source code. The android security analyzer mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 4 defined tools rather than through you.

What it actually does

MCP server for static security analysis of Android application source code. Runs on Cloudflare Workers as a remote MCP server over Streamable HTTP.

• Manifest analysis — — exported components, dangerous permissions, cleartext traffic, debug flags, backup settings, SDK versions
• Gradle/build config — — release build misconfigurations, outdated SDKs, suspicious dependencies, hardcoded secrets
• Source code (Java/Kotlin) — — insecure WebView, SSL/TLS bypass, weak crypto, SQL injection patterns, process execution, insecure file storage, PendingIntent issues
• XML configuration — — network security config weaknesses, overly broad file provider paths
• Secret scanning — — API keys, tokens, passwords, private keys, cloud credentials, high-entropy strings

Its toolset

Everything the assistant can do here goes through one of these:

• analyze_android_project — Full security analysis of project files
• list_android_security_checks — List all implemented security rules
• explain_finding — Detailed explanation of a specific rule
• health — Server status and rule engine stats

Adding it to your client

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

When to reach for it

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Android Security Analyzer's toolset — analyze_android_project, list_android_security_checks, explain_finding and 1 more — is a fair guide to whether it matches your workflow. It is maintained by ako2345; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Caveats

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the android security analyzer mcp server does with a few real requests.