jadx-ai-mcp

Least-privilege permissions

• Restrict file access: Only give the plugin permission to scan apps you own or are explicitly authorized to analyze. Avoid running it on entire system directories or shared folders.
• Limit AI service scope: If configuring which AI service receives code analysis, choose local-only options first (meaning the AI runs on your computer, not in the cloud). If using cloud services, explicitly verify with your IT team that sensitive code won't violate compliance rules.
• Control plugin features: Disable any optional features (like automatic logging, cloud backup, or integration with external services) unless you specifically need them.

Network isolation

• Inspect MCP server settings: Before using this plugin, verify where analysis results are being sent. Ask: "Is this going to our internal server only, or to the internet?" If unclear, contact the plugin maintainer or your IT team.
• Block external connections if possible: Configure your firewall or proxy to prevent the plugin from connecting to unexpected cloud services or third-party AI APIs without explicit approval.
• Use VPN for sensitive code: When analyzing proprietary applications, run the plugin through a corporate VPN or isolated network segment to prevent accidental exposure.

Monitoring

• Log all scans: Maintain records of what code was analyzed, when, and by whom. Review logs regularly for unusual activity or unexpected file access patterns.
• Check for data retention: Ask the MCP server operator (or your IT team): "How long is our analysis data stored, and where?" Ensure it's deleted according to your organization's data policies.
• Track plugin updates: Monitor when JADX or the MCP connector receive security patches, and apply them promptly. Older versions may have known vulnerabilities.

Red flags to watch for

• Analysis sent to unknown services: If the plugin sends your decompiled code to unfamiliar cloud platforms or AI services without your knowledge, stop using it immediately and contact IT security.
• Credentials appearing in results: If analysis output displays API keys, passwords, or login tokens found in the code, that data is now exposed. Flag this to your security team and assume those credentials are compromised.
• Unclear data handling: If documentation doesn't clearly explain where analysis results go, how long they're kept, or who can access them, treat the plugin as high-risk until these questions are answered by the maintainers.
• Unmaintained or unsigned plugin: If the plugin hasn't been updated in over a year or isn't digitally signed by a trusted developer, consider it a security liability and avoid deployment.