Tracked packageView full profile for apktool-mcp-server

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · apktool-mcp-serverHEAD

Item: apktool-mcp-server
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 6:45:33 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

4.0/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packageapktool-mcp-server

VersionHEAD

SourceGITHUB

LicenseApache-2.0

Publisherzinja-coder

Package age1y 0m

Stars393

Downloads/wk—

Dependencies0

Repositoryhttps://github.com/zinja-coder/apktool-mcp-server

Findings

7 of 7 findings

high (2)

medium (1)

low (4)

7 findings

high (2)

AIVSS 3.8CVSS 5.5

XML parser configured without entity expansion disabled. XXE (XML external entity) attacks can read local files, exfiltrate data, and cause SSRF when the parser resolves external entities.

Evidence

content = f.read()
                
                try:
                    root = ET.fromstring(content)
                    
                    # Extract package name
                    manifest_analysis["package_name"] = root.get("package")

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Report false positive

AIVSS 3.8CVSS 5.5

XML parser configured without entity expansion disabled. XXE (XML external entity) attacks can read local files, exfiltrate data, and cause SSRF when the parser resolves external entities.

Evidence

with open(manifest_path, 'r', encoding='utf-8') as f:
                            content = f.read()
                        
                        root = ET.fromstring(content)
                        project_info["package_name"] = root.get("package")
                        
                        # Count smali directories

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Report false positive

medium (1)

AIVSS 4.0CVSS 4.9

MCP tool file registers a tool AND contains a destructive sink (fs.unlink, os.remove, shutil.rmtree, DROP/DELETE FROM/TRUNCATE/ UPDATE ... SET, HTTP DELETE/PUT/PATCH, subprocess.run, exec/spawn), but the file has no confirmation path — no `elicit()` call, no `dry_run`/`dryRun` flag, no `idempotency_key`/`idempotencyKey`, no `confirmation`/`confirm` token. A destructive handler that fires on the first call with no reversibility signal is an autonomous-action hazard (MCP Top-10 R10). Add one of:

Evidence

# /// script
# requires-python = ">=3.10"
# dependencies = [ "fastmcp", "logging", "argparse" ]
# ///

"""
Copyright (c) 2025 apktool mcp server developer(s) (https://github.com/zinja-coder/apktool-mcp-server)
See the file 'LICENSE' for copying permission
"""

import logging
import subprocess
import os
import shutil
import argparse
import json
import time
import xml.etree.ElementTree as ET
from typing import List, Union, Dict, Optional, Callable, Any
from fastmcp import FastMCP

# Set up logging

Remediation

Pick one confirmation mechanism and add it to the destructive handler: - make the client confirm via `elicit()` before touching the sink, - accept a `dry_run` / `dryRun` boolean input and branch off the sink when true (return what would change), - require an `idempotency_key` / `idempotencyKey` the caller provides on the first call and echoes back to commit, - require a `confirmation` / `confirm` token as an input field. If the destructive call is genuinely irrelevant to the tool

Report false positive

low (4)

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_path = os.path.join(root, file)
                        try:
                            dir_size += os.path.getsize(file_path)
                            file_count += 1
                        except:
                            pass
                
                # Remove directory
                shutil.rmtree(dir_path)

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_path = os.path.join(root, file)
                            try:
                                project_size += os.path.getsize(file_path)
                                file_count += 1
                            except:
                                pass
                except Exception as e:
                    logger.warning(f"Error calculating size for {item_path}: {e}")

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

total_size = 0
                        for f in files:
                            try:
                                total_size += os.path.getsize(os.path.join(type_path, f))
                            except:
                                pass
                        
                        resource_types.append({
                            "type": item,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_count += len(files)
                        for file in files:
                            try:
                                dir_size += os.path.getsize(os.path.join(root, file))
                            except:
                                pass
                    
                    directories[item] = {
                        "path": item_path,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

LLM summary— apktool-mcp-server:HEAD

This package carries a B-grade security rating with two high-severity findings related to XXE (XML External Entity) vulnerabilities that could allow attackers to read sensitive files or cause denial of service. While it has no critical issues and a decent safety score of 84/100, the XXE risks combined with four low-severity findings and readiness concerns mean you should review the specific vulnerabilities and apply input validation before deploying it to production.

Signal scores

Static100

CVE check100

Publisher identity50

Permissions100

Supply chain92

Typosquat100

Package health85

Community82

Secrets & exfil100

Injection risks60

Destructive ops92

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 7
Affected tools: 1 / 2
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 61d ago
Source: GITHUB

Tool heatmap

health_check

mMCP tool file registers a tool AND contains a destructive sink (fs.unlink, os.remove, shutil.rmtree, DROP/DELETE FROM/TRUNCATE/ UPDATE ... SET, HTTP DELETE/PUT/PATCH, subprocess.run, exec/spawn), but the file has no confirmation path — no `elicit()` call, no `dry_run`/`dryRun` flag, no `idempotency_key`/`idempotencyKey`, no `confirmation`/`confirm` token. A destructive handler that fires on the first call with no reversibility signal is an autonomous-action hazard (MCP Top-10 R10). Add one of:

MCP Server Information

Source: GITHUB
Package: apktool-mcp-server
Version: HEAD
License: Apache-2.0
Publisher: zinja-coder
Verified: No
Account age: 5y 11m
Added: 1y 0m ago
Versions: 393
Repository: https://github.com/zinja-coder/apktool-mcp-server
Ecosystem: GitHub
Stars: 393
Forks: 39
Open issues: 1
Dependencies: 0

aiandroidapktoolllmmcpmcp-servermobilereverse-engineering

AIVSS Score

4.0/ 10Low

Internal score: 84/100

Severity breakdown

Scan Details

Total findings7

Affected tools1 / 2

Scanned61d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfast7695c0998fc33961f4ee

Want deeper analysis?

Fast scan found 7 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

7 of 7 findings

high (2)

medium (1)

low (4)

7 findings

high (2)

AIVSS 3.8CVSS 5.5

XML parser configured without entity expansion disabled. XXE (XML external entity) attacks can read local files, exfiltrate data, and cause SSRF when the parser resolves external entities.

Evidence

content = f.read()
                
                try:
                    root = ET.fromstring(content)
                    
                    # Extract package name
                    manifest_analysis["package_name"] = root.get("package")

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Report false positive

AIVSS 3.8CVSS 5.5

XML parser configured without entity expansion disabled. XXE (XML external entity) attacks can read local files, exfiltrate data, and cause SSRF when the parser resolves external entities.

Evidence

with open(manifest_path, 'r', encoding='utf-8') as f:
                            content = f.read()
                        
                        root = ET.fromstring(content)
                        project_info["package_name"] = root.get("package")
                        
                        # Count smali directories

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Report false positive

medium (1)

AIVSS 4.0CVSS 4.9

Evidence

# /// script
# requires-python = ">=3.10"
# dependencies = [ "fastmcp", "logging", "argparse" ]
# ///

"""
Copyright (c) 2025 apktool mcp server developer(s) (https://github.com/zinja-coder/apktool-mcp-server)
See the file 'LICENSE' for copying permission
"""

import logging
import subprocess
import os
import shutil
import argparse
import json
import time
import xml.etree.ElementTree as ET
from typing import List, Union, Dict, Optional, Callable, Any
from fastmcp import FastMCP

# Set up logging

Remediation

Report false positive

low (4)

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_path = os.path.join(root, file)
                        try:
                            dir_size += os.path.getsize(file_path)
                            file_count += 1
                        except:
                            pass
                
                # Remove directory
                shutil.rmtree(dir_path)

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_path = os.path.join(root, file)
                            try:
                                project_size += os.path.getsize(file_path)
                                file_count += 1
                            except:
                                pass
                except Exception as e:
                    logger.warning(f"Error calculating size for {item_path}: {e}")

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

total_size = 0
                        for f in files:
                            try:
                                total_size += os.path.getsize(os.path.join(type_path, f))
                            except:
                                pass
                        
                        resource_types.append({
                            "type": item,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

AIVSS 0.5CVSS 1.0

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

Evidence

file_count += len(files)
                        for file in files:
                            try:
                                dir_size += os.path.getsize(os.path.join(root, file))
                            except:
                                pass
                    
                    directories[item] = {
                        "path": item_path,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Report false positive

1614	content = f.read()
1615
1616	try:
1617	root = ET.fromstring(content)
1618
1619	# Extract package name
1620	manifest_analysis["package_name"] = root.get("package")

1742	with open(manifest_path, 'r', encoding='utf-8') as f:
1743	content = f.read()
1744
1745	root = ET.fromstring(content)
1746	project_info["package_name"] = root.get("package")
1747
1748	# Count smali directories

1385	file_path = os.path.join(root, file)
1386	try:
1387	dir_size += os.path.getsize(file_path)
1388	file_count += 1
1389	except:
1390	pass
1391
1392	# Remove directory
1393	shutil.rmtree(dir_path)

973	total_size = 0
974	for f in files:
975	try:
976	total_size += os.path.getsize(os.path.join(type_path, f))
977	except:
978	pass
979
980	resource_types.append({
981	"type": item,

1528	file_count += len(files)
1529	for file in files:
1530	try:
1531	dir_size += os.path.getsize(os.path.join(root, file))
1532	except:
1533	pass
1534
1535	directories[item] = {
1536	"path": item_path,

1	# /// script
2	# requires-python = ">=3.10"
3	# dependencies = [ "fastmcp", "logging", "argparse" ]
4	# ///
5
6	"""
7	Copyright (c) 2025 apktool mcp server developer(s) (https://github.com/zinja-coder/apktool-mcp-server)
8	See the file 'LICENSE' for copying permission
9	"""
10
11	import logging
12	import subprocess
13	import os
14	import shutil
15	import argparse
16	import json
17	import time
18	import xml.etree.ElementTree as ET
19	from typing import List, Union, Dict, Optional, Callable, Any
20	from fastmcp import FastMCP
21
22	# Set up logging

1715	file_path = os.path.join(root, file)
1716	try:
1717	project_size += os.path.getsize(file_path)
1718	file_count += 1
1719	except:
1720	pass
1721	except Exception as e:
1722	logger.warning(f"Error calculating size for {item_path}: {e}")