Android APK analysis with REA and JADX

Last updated: · By the RepoRead editorial team · Unofficial guide
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine. This page is not the official REA documentation.
Quick answer

REA 6.5.0 (October 2026) analyzes Android APKs you are authorized to inspect by driving a headless JADX engine, which needs a full JDK 17 or newer.

REA's static Android APK lane wraps a caller-supplied headless JADX engine. Upstream pins jadx-headless-mcp 0.7.1 and requires a full JDK 17 or newer (including the compiler module). Set REA_JADX_MCP_JAR, then:

rea inspect-android-package /absolute/path/Example.apk

Authorized APKs only. Do not use this for piracy, DRM bypass or unauthorized redistribution. REA does not install Java, an Android SDK, JADX, a device service or an emulator for you.

On this page

Prerequisites

ItemRequirement
REAnpm rea-agents with Android tools present (docs: family present on main and in npm 4.1.0+; use current @latest)
JADX enginejadx-headless-mcp 0.7.1 JAR; verify SHA-256 against JadxRelease.ts
Expected digest (upstream doc)6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75
JavaFull JDK 17+; optional JAVA_HOME
Linuxprocps-compatible ps on PATH

Install the pinned JAR (macOS / Linux)

mkdir -p "$HOME/.local/share/rea/android" &&
cd "$HOME/.local/share/rea/android" &&
curl -fL -o jadx-headless-mcp-0.7.1-all.jar \
  https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar &&
echo '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75  jadx-headless-mcp-0.7.1-all.jar' | sha256sum -c - &&
export REA_JADX_MCP_JAR="$PWD/jadx-headless-mcp-0.7.1-all.jar"

(Use shasum -a 256 -c on macOS if sha256sum is missing.)

export JAVA_HOME=/absolute/path/existing-jdk   # optional

Example CLI commands

rea inspect-android-package /path/Example.apk
rea search-android-classes /path/Example.apk MainActivity
rea inspect-android-class /path/Example.apk example.MainActivity
rea inspect-android-method /path/Example.apk example.MainActivity onCreate

What package inspection returns (README summary): manifest declarations, classes, decompiled methods and references — subject to engine/Evidence limits in the Android guide.

Windows notes

Upstream documents Windows x64 with matching bundled native controls; Windows arm64 is outside the provider's current native boundary. PowerShell example:

$env:REA_JADX_MCP_JAR = 'D:\tools\jadx-headless-mcp-0.7.1-all.jar'
$env:JAVA_HOME = 'D:\tools\jdk-21'
rea inspect-android-package 'D:\targets\Example.apk'

For resource decode (Apktool) and device/ADB workflows, use the separate upstream guides — they are different REA families from this static JADX lane.

FAQ

Is this the same as the GUI jadx app?

REA pins a specific headless MCP JAR (0.7.1) and verifies its digest. Use that artifact, not an arbitrary unzip, unless upstream metadata changes.

Does REA verify APK authenticity?

Docs state APK authenticity and runtime behavior remain unverified by the static package inspection path.

Can I rebuild/repack apps for piracy?

No. That use is explicitly out of scope for RepoRead and for REA's disclaimer. Apktool's own README also rejects piracy uses.

JDK 17 or 21?

Upstream Android guide: full JDK 17 or newer. Many examples use JDK 21.

Sources