Android Security Analyzer MCP Server

MCP server for static security analysis of Android source code. It is available as a remote MCP endpoint.

Teams that want a hosted browser automation endpoint instead of running a local process. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-03-14 · ★ 2 · #195 OF 196 MAINTAINED BROWSER AUTOMATION · VERIFIED 2026-08-25

TypeScript servers · how we verify → /methodology

01 · Install Android Security Analyzer

Claude Code

claude mcp add ako2345-android-security-analyzer --transport http https://android-security-analyzer.ako-labs.workers.dev/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "ako2345-android-security-analyzer": {
      "url": "https://android-security-analyzer.ako-labs.workers.dev/mcp"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://android-security-analyzer.ako-labs.workers.dev/mcp

transport: streamable-http

endpoint alive - responded to MCP initialize · probed 2026-08-25

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as remote - your agent's requests go to android-security-analyzer.ako-labs.workers.dev

endpoint auth accepted our unauthenticated MCP initialize - no credentials needed to connect

license no standard license detected - usage rights unclear; check the repo before commercial use

registry namespace io.github.ako2345 is GitHub-verified and matches the repo owner

03 · What Android Security Analyzer can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Limitations (from the README)

- Not a SAST replacement - pattern/regex-based heuristics, not full AST/dataflow analysis - No build required - analyzes raw source, so build-time transforms are not visible - False positives possible - especially for secret scanning and some code patterns - Workers constraints - 128MB memory limit, CPU time limits, no filesystem access - No APK/AAB analysis - source code only - No inter-procedural analysis - pattern

04 · Who maintains Android Security Analyzer

Android Security Analyzer is maintained by ako2345. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/ako2345/android-security-analyzer
category: browser automation - ranked #195 of 196 actively-maintained browser automation servers as of 2026-08-25.
registry: io.github.ako2345/android-security-analyzer (active, first published 2026-03-14)

06 · Android Security Analyzer FAQ

What is Android Security Analyzer?

MCP server for static security analysis of Android source code. It is available as a remote MCP endpoint.

Is Android Security Analyzer still maintained?

Yes - as of 2026-08-25, its last commit was 2026-03-14. We re-verify nightly.

How do I install Android Security Analyzer?

Run `claude mcp add ako2345-android-security-analy --transport http https://android-security-analyzer.ako-labs.workers.dev/mcp`. You can also paste the ready-made client config above.

Does Android Security Analyzer require authentication?

No - the endpoint accepted our unauthenticated MCP initialize when probed on 2026-08-25; you can connect without credentials.

07 · Alternatives to Android Security Analyzer

Alternatives to Android Security Analyzer

Maintained browser automation servers if Android Security Analyzer isn't the fit.

Pairs well with

Servers that cover what Android Security Analyzer doesn't - only shown when the pairing reason fits the companion.

More browser automation MCP servers · Anakin · Nodriver - Undetected Browser Automation · Leapfrog · Domshell · Ascript MCP

More TypeScript MCP servers · Appstoreconnect MCP · Typesense Kit · Lunch Money · Monobank · Withings Health Data · see all