36 lines
2.1 KiB
Markdown
36 lines
2.1 KiB
Markdown
|
# Android application artifacts
|
||
|
|
|
||
|
|
Use the connected server's advertised Android tools. Repository main and npm
|
||
|
|
4.1.0 include this family. A skill installation alone cannot add it to an
|
||
|
|
older server.
|
||
|
|
|
||
|
|
Start with `inspect_android_package` on the caller's APK path for package
|
||
|
|
identity, manifest declarations, coverage, and inline Evidence. Use
|
||
|
|
`search_android_classes` to find candidates, `inspect_android_class` for one
|
||
|
|
class's members, `inspect_android_method` for decompilation, and
|
||
|
|
`trace_android_references` for incoming static references. Each call takes its
|
||
|
|
own APK path and explicit selectors; do not open a native session first.
|
||
|
|
Choose an `overload_index` from the class inventory when methods are ambiguous
|
||
|
|
instead of guessing.
|
||
|
|
|
||
|
|
The provider requires a separately supplied headless JADX MCP JAR 0.7.1 and
|
||
|
|
Java 17 or newer. `REA_JADX_MCP_JAR` selects the absolute JAR path; `JAVA_HOME`
|
||
|
|
can select Java. REA setup does not install or configure that JAR, and doctor
|
||
|
|
provider scopes cover Hopper/Ghidra rather than JADX. Use existing tools and
|
||
|
|
report missing prerequisites for the Android task specifically.
|
||
|
|
|
||
|
|
Linux and macOS use the POSIX owned-process boundary. Windows x64 requires the
|
||
|
|
matching bundled native controls and uses an owned Job Object with bidirectional
|
||
|
|
stdio. A full JDK, including `jdk.compiler`, is required on every host; Windows
|
||
|
|
`JAVA_HOME` selects `bin\java.exe`. Consult the Android guide for actual host
|
||
|
|
verification coverage. Calls use one worker and provider deadlines; optional
|
||
|
|
`REA_JADX_HEAP_MIB` selects the JVM heap and `REA_JADX_OPERATION_TIMEOUT_MS`
|
||
|
|
the per-operation deadline (default 120000 ms; the MCP client's tool timeout
|
||
|
|
must also allow it). The APK is never launched,
|
||
|
|
and no emulator is required.
|
||
|
|
|
||
|
|
Manifest entries and decompiled text are static observations, not execution or
|
||
|
|
policy enforcement. Incoming references are recovered static relationships;
|
||
|
|
reflection, dynamic loading, and unresolved calls remain unknown. Preserve
|
||
|
|
artifact digests, locations, diagnostics, and incomplete coverage. For archive
|
||
|
|
members rather than code analysis, use `open_binary` and `inspect_artifact`.
|