About Droidsaw
Droidsaw is an MCP server published by droidsaw in the Blockchain category: dROIDSAW unified Android reverse engineering CLI. Hermes, DEX, Dart AOT, APK signing. SQLite export, JSON output, MCP server. Bytecode is not a security layer.
The repository has 35 stars and 4 forks, with the last commit 4 months ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/droidsaw/droidsawThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (6)
Frida`frida` subcommand. Auto-generated hook stubs against functions that touch matched strings.
Parameters not published.
SQLiteEach writer produces its own schema: `scan export` → parsed-layer tables (`strings`, `functions`, `classes`, `edges`, `strings_fts`); `corpus ingest` → `apks` + `signers`; `audit --format unsigned-evidence` → the `findings` + `taint_flows` schema (rev 6). The `query` MCP tool runs read-only `SELECT` against the audit findings DB.
Parameters not published.
STIX 2.1`audit --stix-feed <path>`. Loads any STIX 2.1 bundle (file path; no network I/O). IOC matches against parsed APK content.
Parameters not published.
Semgrep`audit --mode=semgrep` / `scan semgrep --persist`. Decompiled DEX source extracted to disk and fed to Semgrep. **No rules ship bundled** — supply your own via `--rules <path>` or `DROIDSAW_SEMGREP_RULES`.
Parameters not published.
TruffleHog`audit --mode=trufflehog` / `scan trufflehog`. Extracted strings from every layer piped to TruffleHog. All hits land in the `credentials` view, each carrying TruffleHog's own `verified` flag.
Parameters not published.
YARA-X`scan yara` / bundled in `audit`. YARA-X (Rust port). Bundled rule packs; custom rules accepted. Provenance-aware suppression.
Parameters not published.
Ask AI
Ask AI about Droidsaw
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.