DexSQL

English | 简体中文

SQL for Android binaries.

Query classes, methods, strings, and call references in APK and DEX files. Connect it to an AI agent through MCP, or use it from the command line.

Playground · Documentation · Download · Install skill · Benchmarks

Why DexSQL?

AI agents can combine signatures, strings and call relationships in one SQL query across DEX files, returning just the structured results they need. Queries can be generated, refined and saved in scripts for reuse.

DexSQL reads DEX directly and reuses loaded datasets, supporting repeated queries with low latency and a small memory footprint. See the benchmarks for measurements.

The built-in MCP server connects directly to agents, with no GUI required.

flowchart LR
    A["AI client"] -->|stdio MCP| D["DexSQL"]
    D --> F["APK / DEX"]
    A -->|stdio MCP| P["JADX-MCP · Python"]
    P -->|HTTP| J["JADX GUI + plugin · JVM"]
    J --> F

Use with an AI agent

DexSQL is listed in the official MCP Registry as org.lsposed/dexsql. Clients that install servers from the registry can add it directly, and Claude Desktop can open the dexsql.mcpb bundle from Releases. The bundle covers macOS, x86_64 Linux and x86_64 Windows; on other platforms, use the skill or manual setup below.

Install the setup skill with the Skills CLI:

npx skills add LSPosed/dexsql-release --skill install-dexsql

Then ask your agent to use install-dexsql to install DexSQL and configure its MCP connection. In Codex, invoke it as $install-dexsql.

The skill downloads a compatible binary from Releases, verifies its SHA-256 checksum, adds the MCP configuration, and checks the connection. It can also use a local executable. The command above installs the skill; the agent performs the actual setup when you invoke it.

Open Releases and choose the executable or archive that matches your operating system and CPU architecture. Check the selected release's assets and notes for availability and system requirements. Extract the archive if needed, then rename the executable to dexsql.exe on Windows or dexsql on macOS/Linux. On macOS/Linux, run chmod +x /path/to/dexsql.

Save LICENSE and LICENSE-AUXILIARY from the same Release alongside the executable, then register its absolute path. For Codex:

codex mcp add dexsql -- /absolute/path/to/dexsql mcp

For clients that use mcpServers JSON:

{
  "mcpServers": {
    "dexsql": {
      "command": "/absolute/path/to/dexsql",
      "args": ["mcp"]
    }
  }
}

On Windows, use dexsql.exe and escape backslashes in JSON, for example "D:\\Tools\\dexsql.exe". Reload the client's MCP connection if needed. See the Codex MCP documentation for client settings.

Once connected, try:

Open /path/to/app.apk. Find methods referencing this log message, list their callers, and show the relevant Smali.

The server provides its schema and documentation through MCP resources. APK parsing runs locally and leaves the input unchanged. The AI client's settings determine which results are sent to its model.

Performance

A real MCP session

An AI agent analyzed Douyin 40.7.0 (343 MiB, 56 DEX files) through the DexSQL MCP server. We replayed its analysis goals on DexSQL 0.1.1 and six other tools: rasc (the Rust implementation of ASC), DexDec, ddc, the JADX API, garlic and droidsaw.

Opening the APK once and answering 10 goals took 0.71 s with DexSQL, 1.69 s with rasc, 16 s with DexDec and from 75 s to 449 s with the others. DexSQL pays 0.38 s to open the APK once per session; rasc has no open but rereads the APK in every step, so a session with a single question finishes sooner with rasc. Some tools did not show all expected evidence; those misses are still under review. See the replay report for every goal, each tool's interface, the method and the harness.

Fixed queries on QQ

Eight queries run against the same QQ 9.3.55 APK, about 372 MiB: class and method lookup, string references, direct and two-hop callers, and compound predicates. The comparison includes JADX, zinja-coder's JADX-MCP, ASC, DexDec, ddc, garlic, and droidsaw.

Startup time includes process launch, loading and preparation, and the first exact class lookup; values are medians of three runs. The OS file cache was not flushed.

This is the beginning of the README. Read the rest at the original. Read the full README ↗