Jd Mcp Duo

[English](README.md) | [中文](README_zh.md)

jd-mcp-duo

An MCP (Model Context Protocol) server and CLI toolkit for Java decompilation, powered by transformer-api.

Built on the decompilation engine suite from jd-gui-duo, this project exposes the same multi-engine decompilation and static analysis capabilities through both MCP and CLI modes — MCP mode for AI agents, and CLI mode for direct terminal use or integration into scripts.

Security Analysis Scenarios

jd-mcp-duo wraps decompilation, static call chains, cross-archive full-text search, and resource extraction into MCP tools, equipping security engineers' AI agents with the core capabilities needed for code auditing, dependency analysis, and vulnerability discovery — closed-source JARs, WARs, and APKs are no longer beyond reach.

Examples of security analysis scenarios this MCP service can support when connected to an AI agent:

• Closed-source auditing — The agent uses save_all_sources to decompile an entire JAR/WAR/APK while preserving the project directory structure, then reviews business logic class by class

``bash save_all_sources --path=target.war --output=./target-src ``

• Taint tracking — The agent leverages call_chain's CHA-resolved static call graph, combined with its own knowledge of input sources and dangerous sinks, to trace data flow from external input to sensitive operations such as command execution

``bash call_chain --path=app.jar --className=com.example.Controller --methodName=upload --direction=callees --depth=5 ``

• Hardcoded secret discovery — The agent uses search_in_jar to search for key string patterns across archives, locating hardcoded API keys, tokens, database connection strings, private keys, and other sensitive information

``bash search_in_jar --path=app.jar --query='password' --type=string ``

• Dependency risk identification — The agent uses list_dependencies to extract all embedded Maven coordinates from an archive, enabling cross-referencing with vulnerability intelligence to identify known-vulnerable dependencies

``bash list_dependencies --path=app.jar --format=text --output=deps.txt ``

• Stack trace resolution — The agent uses resolve_stacktrace to resolve each frame of an exception stack trace to a line-level position in the decompiled source, quickly pinpointing the exact code that triggered the exception

``bash resolve_stacktrace --path=app.jar --textPath=crash.log ``

Architecture

jd-mcp-duo (this project)
├── MCP protocol layer — JSON-RPC 2.0 over stdio
├── CLI mode — command-line access without MCP
├── 34 tools — decompile, search, analyze, compare
├── SQLite index — cross-archive call graph and type hierarchy
└── archive abstraction — JAR/WAR/DEX/APK/directory input

Unlike the desktop jd-gui-duo which has a Swing GUI and a multi-module SPI architecture, jd-mcp-duo is a single-module server optimized for programmatic access via MCP.

Decompiler engines

All engines are accessed through transformer-api. The engine suite includes:

| Engine | Description | |---|---| | auto | Multi-engine fallback (default) — Vineflower → CFR → JD-Core v1+v0 patch → JADX | | JD-Core v1 | Analytical decompiler with v0 method patching on failure | | JD-Core v0 | Pattern-matching decompiler (method patch source for JD-Core v1) | | CFR | Broadly compatible, stable output | | Procyon | Readable output with line-number options | | Fernflower | Classic analytical decompiler | | Vineflower | Most accurate modern Java-focused decompiler | | JADX | JVM + Android/DEX-oriented |

Download

Each release includes:

| File | For | |---|---| | jd-mcp-duo.jar | Bare JAR — requires JDK 25+ | | jd-mcp-duo-macos-arm64.tar.xz | macOS Apple Silicon (M1/M2/M3) | | jd-mcp-duo-macos-x64.tar.xz | macOS Intel | | jd-mcp-duo-linux-x64.tar.xz | Linux x64 | | jd-mcp-duo-windows-x64.zip | Windows x64 |

Platform archives include a bundled JRE (jlink) — no Java installation required.

Installation

Download the archive for your platform, extract, and run:

# macOS / Linux
# macOS / Linux (pick the right archive for your platform)
tar xf jd-mcp-duo-macos-arm64.tar.xz
./jd-mcp-duo/bin/jd-mcp-duo --help

# Windows
# Extract the zip, then:
jd-mcp-duo\bin\jd-mcp-duo.bat --help

Usage

MCP server mode

Configure your MCP client. Choose one:

# Option A: claude mcp add (recommended)
claude mcp add --transport stdio --scope user jd-mcp-duo -- /path/to/jd-mcp-duo/bin/jd-mcp-duo

# Verify it was added
claude mcp list
claude mcp get jd-mcp-duo

// Option B: directly in ~/.claude.json
{
  "mcpServers": {
    "jd-mcp-duo": {
      "type": "stdio",
      "command": "/path/to/jd-mcp-duo/bin/jd-mcp-duo",
      "args": [],
      "env": {}
    }
  }
}

The server communicates via JSON-RPC 2.0 over stdio. It supports MCP protocol versions 2025-11-25, 2025-06-18, 2025-03-26, and 2024-11-05.

CLI mode

./bin/jd-mcp-duo  [options]

Tools

All tools can be invoked via CLI (./bin/jd-mcp-duo [options]) or through MCP tool calls.

Core decompilation

decompile_class — Decompile a single class with structured metadata.

| Parameter | Required | Description | |---|---|---| | path | yes | Path to a .class file, archive, or directory | | className | no | Class name when path is an archive or directory (e.g. com.example.Main) |

If path points to a single .class file, className is inferred automatically. For archives and directories, className selects which class to decompile.

./bin/jd-mcp-duo decompile_class --path=app.jar --className=com.example.Main
./bin/jd-mcp-duo decompile_class --path=com/example/Main.class

decompile_advanced — Decompile with classpath-assisted type resolution. Resolves dependencies from sibling archives and JDK modules for more accurate output.

| Parameter | Required | Description | |---|---|---| | path | yes | Input path | | className | no | Class name when path is an archive or directory | | advancedLookup | no | Enable sibling archive and JDK module dependency resolution (default: false) | | classpath | no | Additional classpath entries |

./bin/jd-mcp-duo decompile_advanced --path=app.jar --className=com.example.Main --advancedLookup=true

decompile_jar — Decompile all classes in an archive and output a summary with per-class engine statistics.

| Parameter | Required | Description | |---|---|---| | path | yes | Path to a supported archive |

./bin/jd-mcp-duo decompile_jar --path=app.jar --engine=vineflower

Batch processing

save_all_sources — Decompile every class in an archive or directory and write the results to a directory or sources JAR. Non-class resources (XML, properties, images, templates, etc.) are preserved alongside decompiled sources. Output structure mirrors the input archive structure.

| Parameter | Required | Description | |---|---|---| | path | yes | Input archive or directory | | output | yes | Output directory or sources JAR path | | format | no | directory (default) or sources-jar | | engine | no | Decompiler engine (default: auto) |

./bin/jd-mcp-duo save_all_sources --path=app.jar --output=./app-src
./bin/jd-mcp-duo save_all_sources --path=app.jar --output=sources.jar --format=sources-jar

decompile_directory — Recursively scan a directory for .class files and supported archives, decompile them into a target directory while preserving relative paths. Non-class files are copied as-is.

| Parameter | Required | Description | |---|---|---| | path | yes | Input directory | | outputDir | yes | Output directory | | recursive | no | Recursively scan subdirectories (default: false) |

./bin/jd-mcp-duo decompile_directory --path=./input --outputDir=./output --engine=jadx

analyze_directory — Scan a directory for supported archives and report class counts and sizes without decompiling. Supports --offset/--limit pagination.

| Parameter | Required | Description | |---|---|---| | path | yes | Directory to analyze | | recursive | no | Recursively scan subdirectories (default: false) | | limit | no | Maximum archives per page (default: 200) | | offset | no | Number of archives to skip for pagination (default: 0) |

./bin/jd-mcp-duo analyze_directory --path=./libs --limit=10 --offset=0

batch_decompile — Decompile classes from a directory root, with optional limit and outputDir.

| Parameter | Required | Description | |---|---|---| | path | yes | Directory root containing class files | | limit | no | Maximum classes to decompile (default: 0 = all) |

./bin/jd-mcp-duo batch_decompile --path=./classes --limit=200

batch_decompile_jars — Decompile classes across multiple archives in a directory.

| Parameter | Required | Description | |---|---|---| | path | yes | Directory containing archives | | recursive | no | Scan subdirectories (default: false) | | pattern | no | Glob pattern filter |

./bin/jd-mcp-duo batch_decompile_jars --path=./libs --recursive=true --pattern="*.jar"

Inspection

index_scope — Build or refresh the SQLite cross-archive index. Run before search_in_jar, call_chain, etc. to avoid blocking during queries.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary archive or directory | | scopePath | no | Additional directory of archives to index | | scopeRecursive | no | Recursively scan scopePath (default: false) | | indexPath | no | Custom SQLite index path (default: ~/.jd-mcp-duo/index.sqlite) |

./bin/jd-mcp-duo index_scope --path=./app.jar --scopePath=./lib --scopeRecursive=true

list_classes — List classes in an archive or directory with normalized names and package statistics. Supports --offset/--limit pagination.

| Parameter | Required | Description | |---|---|---| | path | yes | Path to an archive or directory | | limit | no | Maximum classes per page (default: 200) | | offset | no | Number of classes to skip for pagination (default: 0) | | package | no | Optional package prefix filter | | detailed | no | Include package statistics (default: false) |

./bin/jd-mcp-duo list_classes --path=app.jar --limit=50 --offset=0

class_metadata — Inspect class-level metadata: access flags, bytecode version, superclass, interfaces, module name, methods, fields, annotations, and constant pool statistics.

| Parameter | Required | Description | |---|---|---| | path | yes | Input path | | className | no | Class name when path is an archive or directory |

./bin/jd-mcp-duo class_metadata --path=app.jar --className=com.example.Main

list_engines — List all available decompiler engines, their aliases.

./bin/jd-mcp-duo list_engines

describe_engine_options — Describe the configurable options for a specific decompiler engine.

| Parameter | Required | Description | |---|---|---| | engine | yes | Engine name (e.g. cfr, jadx, fernflower) |

./bin/jd-mcp-duo describe_engine_options --engine=cfr

Search and analysis

search_in_jar — Index-based search across classes, methods, constructors, fields, string constants, and resource files. Supports * and ? wildcards. Results include archive paths for scoped searches. Supports --offset/--limit pagination and --output for writing full results to a file.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | query | yes | Search term with wildcard support | | type | no | Filter: type, class, constructor, method, field, string, module, resource, xml, properties, service, manifest, yaml, json, all | | queryMode | no | plain (default), wildcard, or regex | | limit | no | Maximum results per page (default: 50) | | offset | no | Number of results to skip for pagination (default: 0) | | output | no | Write full results to a file (bypasses pagination) | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo search_in_jar --path=app.jar --query=getUser --type=method --limit=20 --offset=0
./bin/jd-mcp-duo search_in_jar --path=app.jar --query='password' --type=string --output=/tmp/keys.txt

type_lookup — Look up type declarations by exact name, wildcard, or regex across the current input and optional scope. Supports --offset/--limit pagination.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | query | yes | Type name (exact, *pattern, or regex) | | queryMode | no | plain (default), wildcard, or regex | | limit | no | Maximum results per page (default: 50) | | offset | no | Number of results to skip for pagination (default: 0) | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo type_lookup --path=app.jar --query='*Service' --scopePath=./libs --limit=20 --offset=0

type_hierarchy — Build supertype and subtype hierarchy trees for a class. Searches across all scoped archives using the SQLite index.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | className | no | Class name | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo type_hierarchy --path=app.jar --className=com.example.BaseService --scopePath=./libs

find_references — Find all references to a type, field, or method across the indexed scope. Resolves method-owner, field-owner, and type-usage references from bytecode instructions.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | className | yes | Target class name | | kind | no | type, method, or field | | methodName or fieldName | no | Method or field name | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo find_references --path=app.jar --className=com.example.Util --kind=method --methodName=format

method_overrides — Find override and implementation relationships for a method. Shows which methods override the target and which methods the target overrides.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | className | yes | Declaring class name | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo method_overrides --path=app.jar --className=com.example.BaseDao --methodName=save

resolve_symbol — Resolve a type, field, or method symbol to internal names, JVM descriptors, and matching declarations. Handles overloaded methods by listing all candidate descriptors.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | className | yes | Declaring class name | | className | no | Class name | | methodName or fieldName | no | Method or field name | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo resolve_symbol --path=app.jar --className=com.example.Service --methodName=process

resolve_stacktrace (alias: analyze_log) — Parse Java stack trace or log text, resolve each frame to its declaring class, method, descriptor, candidate source archives, and decompiled line number mappings.

| Parameter | Required | Description | |---|---|---| | path | yes | Primary input path | | text or textPath | yes | Stack trace text or .log file path | | scopePath | no | Multi-archive scope path |

./bin/jd-mcp-duo resolve_stacktrace --path=app.jar --textPath=stacktrace.log
./bin/jd-mcp-duo analyze_log --path=app.jar --textPath=stacktrace.log

source_lookup — Look up original source code from a local sources JAR,

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: AgeloVito
• Source: AgeloVito/jd-mcp-duo
• License: MIT

Install and usage instructions live in the source repository linked above.