PackagePrivacy

MCP server that runs privacy compliance analyses for Android apps/SDKs, enabling end-to-end workflows with decompilation, code analysis, and reporting.

other

2

GitHub Stars

other

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "stonehill-2345-package-privacy": {
      "command": "uv",
      "args": [
        "run",
        "privacy-check-mcp"
      ]
    }
  }
}

PackagePrivacy’s MCP Server enables interactive privacy analysis workflows by connecting with large-model MCP clients. It orchestrates file retrieval, decompilation, information extraction, code privacy analysis, and report generation, all through a streamlined MCP interface.

How to use

You connect to the MCP Server using an MCP client to perform a end-to-end privacy analysis workflow. The server exposes a complete set of tools for acquiring Android apps or SDKs, decompiling them, extracting basic and privacy-related information, inspecting code for sensitive API usage, and producing structured reports. You can run analyses interactively, request detailed reports, and view formatted results suitable for review with model-assisted insight.

How to install

cd mcp_server

uv sync

uv run privacy-check-mcp

After starting, the MCP server is ready to accept MCP client connections for privacy analysis workflows.

## Notes and tips

Prerequisites include having the UV tooling available on your system. Ensure you can run the commands above from the mcp\_server directory. The server supports a full privacy analysis workflow, including file retrieval, decompilation, information extraction, code analysis, and report generation. If you plan to integrate with clients or automate workflows, you can orchestrate multistep MCP interactions to trigger the entire analysis pipeline end-to-end.

## Available tools

### download\_maven\_lib

Downloads jar or aar files from Maven repositories to a specified output directory, auto-detects formats, supports full Maven coordinates, and provides progress and error reporting.

### decompile\_with\_jadx

Uses JADX to decompile jar, aar, or apk files with options for GUI/non-GUI modes, Java path specification, and automatic installation checks for JADX.

### analysis\_common\_info

Parses JAR/AAR/APK files to extract basic info, AndroidManifest data, JNI libraries, architecture support, and component details with a structured report.

### analysis\_code\_invoke\_info

Analyzes decompiled code to detect privacy-sensitive API calls, using rule-based configurations, and outputs a detailed JSON report organized by privacy category.

### generate\_analysis\_report

Generates a comprehensive Markdown report by aggregating common info and privacy analysis, including compliance recommendations and API call inventories.

### privacy\_mcp\_flow

Unified workflow tool that coordinates download, decompilation, information analysis, code analysis, and report generation within the MCP framework.