| Tool | Version | Why |
|---|---|---|
| Python | 3.12+ | Runs all Python MCP servers |
| uv | 0.5+ | Workspace + dependency management |
| Node.js | 24+ | Runs the TypeScript mcp_bridge |
| pnpm | 10+ | Workspace + Node dependency management |
| Java | 17+ | Runs Apktool, jadx, uber-apk-signer |
| Android Platform Tools | latest | adb for device interaction |
| git-lfs | latest | Stores APK/.so/.jar fixtures |
A rooted Android device or emulator is required only for dynamic analysis skills (Phase 3+). Static analysis works entirely on-host.
git clone https://github.com/Heretek-AI/Android-RE.git
cd Android-RE
./bin/install.sh --fullThis will:
- Sync the uv workspace (
uv sync --all-packages). - Install pnpm dependencies (
pnpm install). - Build the TypeScript bridge (
pnpm build). - Vendor the latest jadx, apktool, uber-apk-signer, and frida-server into
./vendor/. - Symlink all 11 skills into
~/.claude/skills/.
If you prefer to manage the Python/Node packages yourself:
./bin/install.sh --skills-onlyINSTALL_DIR=./.claude/skills ./bin/install.sh --skills-only./bin/doctor.shYou should see green checkmarks for: adb, java, frida-server (if a
device is connected), uv, pnpm, and the Python packages.
# In a Claude Code session
claude
> /android-re-static-triage
> /path/to/app.apkOr invoke the orchestrator directly:
> /android-re-triage-orchestrator
> Triage /path/to/app.apk and produce a MASVS report.
Every Android-RE run produces a directory tree under
Output/<apk-basename>-<short-sha>/<subdir>/<file> at the repo root.
For example, a triage of <your-app>.apk (SHA-256 starts <first-8-of-sha>) lands at:
Output/<your-app>-<first-8-of-sha>/<triage-id>/triage-<id>.md
Output/<your-app>-<first-8-of-sha>/masvs/coverage.json
Output/<your-app>-<first-8-of-sha>/masvs/report.sarif
Output/<your-app>-<first-8-of-sha>/secrets/secrets-findings.json
Output/<your-app>-<first-8-of-sha>/native/native-report.json
Output/<your-app>-<first-8-of-sha>/dynamic/session-report.json
The Output/ directory is git-ignored. Override the base path with:
export ANDROID_RE_OUTPUT_DIR=/scratch/android-re-output # set BEFORE launching claudeSet this env var before launching Claude Code (it's read once at
import time of android_re_core.paths). See
output-convention.md for the full convention and the per-skill
output paths.
- Architecture — how the pieces fit together.
- MCP Tool Reference — every tool, every input.
- Skills — every skill, every trigger phrase.
- Contributing a Tool — add your own MCP tool.