MCP Server Java Decompiler for .class and JAR

Overview

This MCP server component provides on-demand Java bytecode decompilation for .class files, package names, or entire JAR archives. It wraps the CFR decompiler into an HTTP service intended to run alongside an MCP (Model Context Protocol) ecosystem or any developer tooling stack that needs readable Java source from compiled artifacts. The server accepts uploaded files or references to stored artifacts and returns decompiled source as text or as downloadable archives.

Decompiling on a central service simplifies workflows for teams that inspect bytecode, audit third‑party libraries, or integrate decompilation into continuous analysis pipelines. Instead of installing multiple decompilers locally, you point your tooling at the MCP decompiler server and retrieve consistent, parsed Java source for debugging, reverse engineering, or documentation generation.

Features

• Decompile single .class files to Java source using CFR
• Decompile entire JAR archives and return a ZIP of reconstructed source
• Decompile packages by name (when JAR or storage context is provided)
• HTTP API suitable for automation (curl, CI, or integrations)
• File upload support (multipart/form-data) for ad-hoc analysis
• Optionally integrates with storage backends to reference uploaded artifacts by name
• Configurable CFR options and server limits (max upload size, timeouts)

Installation / Configuration

Prerequisites:

• Java 11+ (or the version required by the repository)
• Maven or Gradle (if building from source) or Docker (for containerized deployment)

Clone and build (Maven example):

git clone https://github.com/idachev/mcp-javadc.git
cd mcp-javadc
mvn clean package
# Resulting artifact: target/mcp-javadc.jar (example path)
java -jar target/mcp-javadc.jar --config config.yml

Run with Docker (example):

# Build container locally (if Dockerfile present)
docker build -t mcp-javadc .

# Run container on port 8080, mounting storage directory
docker run -p 8080:8080 -v /path/to/storage:/data mcp-javadc

Example minimal configuration (YAML):

server:
  host: 0.0.0.0
  port: 8080

storage:
  dir: /data/artifacts
  max_upload_mb: 200

cfr:
  options:
    - --comments
    - --reconstruct-mapping

Adjust CFR options and resource limits in the config file to match your environment and expected artifact sizes.

Available Resources

• GitHub repository: https://github.com/idachev/mcp-javadc
• CFR decompiler: https://www.benf.org/other/cfr/ — the underlying decompiler used by the server
• Example clients: use curl, HTTP libraries (fetch, axios), or integrate via MCP tooling hooks
• Storage: local filesystem by default; can be adapted to network storage or object stores if the deployment is extended

API (Typical Endpoints)

The exact routes may vary with releases; sample endpoints commonly provided:

• POST /decompile/class

  • Form-data: [email protected]
  • Returns: Java source text

• POST /decompile/jar

  • Form-data: [email protected]
  • Returns: application/zip containing decompiled sources or a JSON list of files

• POST /decompile/package

  • JSON/Form-data: { “package”: “com.example”, “artifact”: “library.jar” }
  • Returns: all classes in package decompiled

Sample curl — decompile a .class file:

curl -X POST "http://localhost:8080/decompile/class" \
  -F "file=@/home/user/Example.class" \
  -o Example.java

Sample curl — decompile a JAR and download ZIP:

curl -X POST "http://localhost:8080/decompile/jar" \
  -F "file=@/home/user/library.jar" \
  -o library-decompiled.zip

Or reference an already uploaded artifact by name (if storage is enabled):

curl -X POST "http://localhost:8080/decompile/package" \
  -H "Content-Type: application/json" \
  -d '{"artifact":"library.jar","package":"com.example.util"}'

Use Cases

• Debugging compiled plugins: Upload a plugin JAR or class to view its source without building from original sources. Useful when source is not provided.
• Security review and auditing: Automatically decompile third-party dependencies in CI and scan the resulting source for risky patterns.
• Documentation and onboarding: Generate readable source for legacy JARs so new engineers can inspect logic and comments added by CFR.
• Automated toolchains: Integrate the decompiler endpoint into an MCP pipeline to convert bytecode artifacts to source for static analyzers, linters, or code indexers.

Notes and Best Practices

• Decompiled code is synthesized and may not exactly match original sources; use it for inspection and analysis rather than as canonical source.
• Respect software licenses — do not decompile artifacts you do not have rights to analyze.
• Tune CFR options for readability (e.g., control renaming, comment inclusion) to get better results for obfuscated code.
• If exposing the service publicly, add authentication, rate limits, and upload size limits to protect resources.

For more details and the latest API specs, see the repository: https://github.com/idachev/mcp-javadc.