Reverse-engineering an APK usually means juggling jadx, apktool, adb, frida and a pile of terminal tabs. I built HexForge Gateway to put all of that behind one self-hosted API, and to expose it as native MCP tools so Claude can drive the whole workflow.
It runs entirely on-device (Termux + MT Manager on Android) or on a normal PC. No cloud, no accounts.
What it does
Everything flows through one model:
Workspace -> Workflow -> Jobs -> Tasks -> MCP Agents
-
8 agents: jadx, apktool, APKiD, adb, frida, a filesystem agent, an AI-provider agent, and
apkmcp, a client for MT Manager’s built-in APK MCP service - 19 MCP tools exposing those agents to Claude Desktop, Claude Code, Cursor and other MCP clients
- Job and Workflow engines to chain steps and track their state
- Knowledge engine so findings from one task are available to the next
-
Live updates over WebSocket (
task:update,job:update,workflow:update) - 9 AI providers and a plugin system, if you want to extend it
Storage is local files by default, with Supabase as an opt-in backend.
Try it
git clone https://github.com/boy-offi9-inc/hexforge-gateway
cd hexforge-gateway
npm install
cp .env.example .env
npm run dev
Enter fullscreen mode Exit fullscreen mode
The Gateway starts on http://localhost:8080 and prints copy-pasteable commands. Create a workspace:
curl -X PUT http://localhost:8080/workspaces/by-name/my-project \
-H "Content-Type: application/json" \
-d '{"targetLabel":"com.example.app"}'
Enter fullscreen mode Exit fullscreen mode
Then register the MCP server with your client. The steps are in docs/MCP_SERVER.md.
Running it on a phone
The part I’m happiest with: on Android, the Gateway runs in Termux and talks to MT Manager’s APK MCP over loopback, so the whole stack lives on one device. There’s a step-by-step guide with screenshots in docs/MT_MANAGER.md, including the one setting (the floating ball) that keeps the service alive in the background.
How it’s built
TypeScript, Fastify, Zod, Node 20+. Modules talk through an event bus. CI runs typecheck, build, a real smoke test against a live instance, and an MCP handshake check on every push. Releases are automated: bump the version in package.json and it tags and publishes.
What’s next
- Per-workspace scoping for WebSocket connections
- A web interface
- A watched folder for APKs on PC, instead of typing full paths
- Streamable HTTP transport for the MCP server, so remote clients can connect
- A proper unit and integration test suite
Use it responsibly
Only analyze apps you own or have permission to test.
MIT licensed. Feedback, issues and PRs are welcome:
boy-offi9-inc
/
hexforge-gateway
Self-hosted reverse-engineering workspace API — orchestrates jadx/apktool/adb/frida/APKiD via a job & workflow engine, exposed as native MCP tools for Claude. No cloud required.
HexForge Gateway
AI-assisted APK reverse-engineering workspace API. Dispatches tasks to MCP agents (jadx, apktool, adb, frida, filesystem, MT Manager’s APK MCP AI providers) and streams updates over WebSocket. Runs entirely on-device (Termux + MT Manager on Android) or on a normal PC – no cloud required.
Flow: Workspace -> Workflow -> Jobs -> Tasks -> MCP Agents, with modules
talking through an Event Bus. MIT licensed. Contributing: run
npm run typecheck && npm run build && ./scripts/smoke-test.sh before a
PR – see CONTRIBUTING.md.
Getting started
npm install cp .env.example .env npm run dev
Enter fullscreen mode Exit fullscreen mode
The Gateway starts on http://localhost:8080 and prints a banner with your
workspaces and copy-pasteable commands. GET / returns the same as JSON –
the quickest way to see what’s here.
Core endpoints (request/response shapes are in the linked docs):
-
GET /– live cheat sheet –GET /health– service + config status -
POST /workspaces…