rea/docs/android-analysis.md

Static Android APK analysis

REA wraps an existing headless JADX engine through src/android/. Its source is kept as an unmodified, commit-pinned Git submodule; see upstream provenance. CLI and MCP use the same application workflow and return artifact-bound Evidence inline.

This family is present on repository main and in npm 4.1.0. Check the released package boundary and the connected server's tool list before selecting it.

On Linux, JADX launches an REA-owned process and requires a procps-compatible ps on REA's PATH; see the shared Linux process prerequisite.

Optional package delivery

The MCP inspect_android_package request keeps complete output when detail is omitted or "complete". Select detail: "summary" explicitly to receive all package, SDK and permission declarations, engine identity and class/resource counts without decoded manifest text or duplicate raw provider replies. A retaining session keeps the complete original Evidence and returns a distinct linked inspect_analysis_view summary. This changes delivery, not JADX analysis.

Use the returned normalized_result.parent_evidence_id with inspect_analysis_view, source kind retained-evidence, and view: {kind: "android", facet: "manifest", offset: 0, limit: 4096} to read the exact decoded manifest without reopening the APK. Offsets and limits count UTF-16 code units; follow coverage.next_offset. The page preserves source_status and reported_total_bytes: exhausting retained text does not make a partial decoded manifest complete. Complete source Evidence remains exportable under the existing session lifetime. Servers without retention reject summary before starting JADX. One-shot CLI output remains complete by default. Select --detail summary with --evidence_output /local/capture.json to retain complete Evidence before returning a linked view. Older servers require the existing complete request after schema discovery. APK authenticity and runtime behavior remain unverified.

Manifest component projection

inspect_android_package also returns a static inventory of declared activities, aliases, services, receivers and providers from the decoded manifest. The binary XML decoder preserves component class spelling, including $ in nested classes, without applying JADX class aliases. declared_name preserves the decoded source attribute; name resolves a relative name only when the manifest package is known and the resolved copy fits the UTF-8 byte budget. An unresolved package or exhausted name budget retains the declared name and marks the inventory partial. Empty component names and names with forbidden DEX characters retain their raw spelling and are not treated as identities. Valid DEX spaces, including boundary spaces, are preserved when resolving component names and matching alias targets. Whitespace in the manifest package is rejected by its separate package grammar. Component permissions inherit the application permission when no component permission is declared, except an activity alias with no permission: Android documents that case as requiring no permission through the alias. permission_source distinguishes a local declaration, inherited value, no requirement (including an explicit empty override), and a value omitted because its resource/manifest-placeholder token is unresolved or the total permission-byte budget was reached. Resource and placeholder references are not expanded at this parser boundary. Repeated inherited values share one inventory-wide byte budget. Provider android:readPermission and android:writePermission overrides are not projected as separate fields; their presence marks the inventory partial and is called out in limita