jadx-daemon-mcp

The Java server defaults to listening on 'localhost', which is good for security, but can be configured to listen on other interfaces via `JADX_DAEMON_MCP_HOST`. User-provided `filePath` and `dirPath` parameters are used to create `File` objects directly. While checks for existence and file/directory type are performed, this relies on Jadx itself to safely handle potentially malicious paths (e.g., path traversal attempts if Jadx were vulnerable to reading arbitrary system files, though Jadx is designed for specific archive/binary types). There are no apparent direct command injection vulnerabilities from user input. The `preprocess_manifest` function in `server.py` attempts to sanitize XML from the Java backend to prevent parsing errors, which indicates robust handling but does not introduce new security risks.