jadx-ai-mcp

The server, implemented using Javalin, defaults to binding to all network interfaces (0.0.0.0) when `app.start(currentPort)` is called. This exposes all JADX functionalities, including sensitive operations like decompilation, renaming, and debugger access, to any device on the network without any authentication or access control. This is a critical security risk, especially when analyzing potentially malicious APKs. Input validation for query parameters is present for basic checks (e.g., null/empty, number format) but does not include comprehensive sanitization against maliciously crafted strings that could potentially exploit JADX internals or cause unexpected behavior.