dejared-mcp 0.1.2 → 0.1.4

package/.claude-plugin/marketplace.json

@@ -0,0 +1,24 @@
+{
+  "name": "dejared-mcp-marketplace",
+  "owner": {
+    "name": "HuynhKhanh1402",
+    "email": "huynhkhanh14022004@gmail.com"
+  },
+  "metadata": {
+    "description": "MCP server and Claude Code plugin for exploring, analyzing, and decompiling Java JAR files"
+  },
+  "plugins": [
+    {
+      "name": "dejared",
+      "source": "./",
+      "description": "Explore, analyze, and decompile Java JAR files with structured workflows.",
+      "version": "0.1.4",
+      "author": {
+        "name": "HuynhKhanh1402"
+      },
+      "license": "MIT",
+      "keywords": ["java", "jar", "decompiler", "bytecode", "reverse-engineering", "mcp"],
+      "category": "development"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -1,10 +1,17 @@
 {
   "name": "dejared",
   "description": "Explore, analyze, and decompile Java JAR files with structured workflows.",
+  "version": "0.1.4",
   "author": {
     "name": "HuynhKhanh1402"
   },
   "repository": "https://github.com/HuynhKhanh1402/dejared-mcp",
   "license": "MIT",
-  "keywords": ["java", "jar", "decompiler", "bytecode", "reverse-engineering", "mcp"]
+  "keywords": ["java", "jar", "decompiler", "bytecode", "reverse-engineering", "mcp"],
+  "mcpServers": {
+    "dejared": {
+      "command": "npx",
+      "args": ["-y", "dejared-mcp"]
+    }
+  }
 }

package/README.md

@@ -1,15 +1,51 @@
+[![npm version](https://img.shields.io/npm/v/dejared-mcp?style=flat-square)](https://www.npmjs.com/package/dejared-mcp)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue?style=flat-square)](LICENSE)
+[![Node.js](https://img.shields.io/badge/Node.js-18%2B-339933?style=flat-square&logo=node.js&logoColor=white)]()
+[![Java](https://img.shields.io/badge/Java-21%2B-ED8B00?style=flat-square&logo=openjdk&logoColor=white)]()
+
 # dejared-mcp
 
-An MCP (Model Context Protocol) server that lets AI assistants explore, analyze, and decompile Java JAR files.
+A Model Context Protocol (MCP) server for exploring, analyzing, and decompiling Java JAR files.
+Designed for AI-powered development tools, dejared-mcp connects your IDE or CLI assistant
+to inspect package structures, search bytecode, and decompile classes
+using CFR, Vineflower, or Procyon.
+
+## Table of Contents
+
+- [Overview](#overview)
+- [Prerequisites](#prerequisites)
+- [Quick Start](#quick-start)
+- [Features](#features)
+- [Decompiler Engines](#decompiler-engines)
+- [Installation and Configuration](#installation-and-configuration)
+- [Custom Java Path](#custom-java-path)
+- [Server Configuration](#server-configuration)
+- [How It Works](#how-it-works)
+- [FAQ and Troubleshooting](#faq-and-troubleshooting)
+- [Contributing](#contributing)
+- [Third-Party Licenses](#third-party-licenses)
+- [License](#license)
+
+## Overview
+
+dejared-mcp is a Java-based MCP server distributed as an npm package.
+It provides nine tools organized into three categories: discovery, hunting,
+and deep analysis. AI assistants use these tools to navigate JAR file
+structures, search for classes and string literals in bytecode, and
+decompile `.class` files back to readable Java source code.
+
+The npm package acts as a thin wrapper that downloads and caches the
+server JAR on first run, then spawns it via `java -jar` using stdio
+transport.
 
 ## Prerequisites
 
-- **Node.js 18+** - required for the `npx` wrapper (not needed for pure Java usage)
-- **Java 21+** - JRE is sufficient
+- **Node.js** 18 or later
+- **Java** 21 or later (JRE is sufficient)
 
 ## Quick Start
 
-Most MCP-compatible tools use a JSON configuration like this:
+Add the following to your MCP client configuration:
 
 ```json
 {
@@ -22,27 +58,56 @@ Most MCP-compatible tools use a JSON configuration like this:
 }
 ```
 
-See below for tool-specific instructions.
+See [Installation and Configuration](#installation-and-configuration)
+for tool-specific instructions.
 
-## MCP Registry
+## Features
 
-This server is published to the [MCP Registry](https://registry.modelcontextprotocol.io) as `io.github.huynhkhanh1402/dejared`.
+### Discovery
 
-You can verify it via the registry API:
+Browse and read JAR contents.
 
-```bash
-curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.huynhkhanh1402/dejared"
-```
+| Tool | Description |
+|------|-------------|
+| `dejared_list_packages` | List all packages with class counts |
+| `dejared_list_classes` | List classes in a specific package |
+| `dejared_list_resources` | List non-class resource files |
+| `dejared_read_resource` | Read text resources (YAML, XML, properties, JSON, and others) |
 
-## Configuration by Tool
+### Hunting
 
-<details>
-<summary><strong>Claude Desktop</strong></summary>
+Search inside JAR files.
 
-Edit the Claude Desktop config file:
+| Tool | Description |
+|------|-------------|
+| `dejared_search_class` | Search classes by name |
+| `dejared_search_string` | Search string literals in bytecode (URLs, SQL, error messages) |
 
-- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
-- **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`
+### Deep Analysis
+
+Inspect metadata and decompile classes.
+
+| Tool | Description |
+|------|-------------|
+| `dejared_get_metadata` | Extract class metadata via ASM (fast, no decompilation) |
+| `dejared_dump_package_metadata` | Batch metadata extraction for entire packages |
+| `dejared_decompile_class` | Decompile `.class` files to Java source code |
+
+## Decompiler Engines
+
+dejared-mcp supports three decompiler engines. The engine can be
+specified per request via the `dejared_decompile_class` tool.
+
+| Engine | Description |
+|--------|-------------|
+| **CFR** (default) | Reliable general-purpose decompiler |
+| **Vineflower** | Modern fork of FernFlower, handles newer Java features well |
+| **Procyon** | Alternative engine, can handle some edge cases better |
+
+## Installation and Configuration
+
+The standard configuration below works with most MCP-compatible tools.
+Expand the relevant section for tool-specific instructions.
 
 ```json
 {
@@ -55,20 +120,32 @@ Edit the Claude Desktop config file:
 }
 ```
 
-Restart Claude Desktop after saving.
+<details>
+<summary><strong>Amp</strong></summary>
 
-</details>
+Add via the Amp VS Code extension settings screen or by updating your `settings.json` file:
 
-<details>
-<summary><strong>Claude Code (CLI)</strong></summary>
+```json
+"amp.mcpServers": {
+  "dejared": {
+    "command": "npx",
+    "args": ["-y", "dejared-mcp"]
+  }
+}
+```
 
-Run this command in your terminal:
+**Amp CLI:**
 
 ```bash
-claude mcp add dejared -- npx -y dejared-mcp
+amp mcp add dejared -- npx -y dejared-mcp
 ```
 
-Or add it to your project's `.mcp.json`:
+</details>
+
+<details>
+<summary><strong>Antigravity Editor</strong></summary>
+
+Edit `~/.gemini/antigravity/mcp_config.json`:
 
 ```json
 {
@@ -81,19 +158,88 @@ Or add it to your project's `.mcp.json`:
 }
 ```
 
+Or install through the MCP Store if available.
+
 </details>
 
 <details>
-<summary><strong>Cursor</strong></summary>
+<summary><strong>Claude Code</strong></summary>
+
+```bash
+claude mcp add dejared -- npx -y dejared-mcp
+```
+
+Or add it to your project's `.mcp.json` using the standard config above.
+
+**Plugin (Marketplace)** installs both the MCP server and the `/jar-analysis` skill:
+
+```bash
+claude plugin marketplace add HuynhKhanh1402/dejared-mcp
+claude plugin install dejared@dejared-mcp-marketplace
+```
 
-Create or edit `.cursor/mcp.json` in your project root (project-level) or `~/.cursor/mcp.json` (global):
+</details>
+
+<details>
+<summary><strong>Claude Desktop</strong></summary>
+
+Edit the Claude Desktop config file:
+
+- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
+- **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`
+
+Add the standard config above and restart Claude Desktop.
+
+</details>
+
+<details>
+<summary><strong>Cline</strong></summary>
+
+Add the standard config above to your MCP settings file.
+
+</details>
+
+<details>
+<summary><strong>Codex</strong></summary>
+
+```bash
+codex mcp add dejared npx "-y dejared-mcp"
+```
+
+Or edit `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.dejared]
+command = "npx"
+args = ["-y", "dejared-mcp"]
+```
+
+</details>
+
+<details>
+<summary><strong>Copilot CLI</strong></summary>
+
+Interactive:
+
+```
+/mcp add
+```
+
+Then fill in:
+- **Server Name**: `dejared`
+- **Server Type**: `STDIO`
+- **Command**: `npx -y dejared-mcp`
+
+Or edit `~/.copilot/mcp-config.json`:
 
 ```json
 {
   "mcpServers": {
     "dejared": {
+      "type": "local",
       "command": "npx",
-      "args": ["-y", "dejared-mcp"]
+      "args": ["-y", "dejared-mcp"],
+      "tools": ["*"]
     }
   }
 }
@@ -102,29 +248,34 @@ Create or edit `.cursor/mcp.json` in your project root (project-level) or `~/.cu
 </details>
 
 <details>
-<summary><strong>VS Code (GitHub Copilot)</strong></summary>
+<summary><strong>Cursor</strong></summary>
 
-Create or edit `.vscode/mcp.json` in your project root:
+Create or edit `.cursor/mcp.json` in your project root (project-level) or `~/.cursor/mcp.json` (global) using the standard config above.
 
-```json
-{
-  "servers": {
-    "dejared": {
-      "command": "npx",
-      "args": ["-y", "dejared-mcp"]
-    }
-  }
-}
+</details>
+
+<details>
+<summary><strong>Gemini CLI</strong></summary>
+
+```bash
+gemini mcp add dejared npx -y dejared-mcp
 ```
 
-Or add to your VS Code `settings.json` for global availability.
+Or edit `~/.gemini/settings.json` (global) or `.gemini/settings.json` (project) using the standard config above.
 
-After saving, click the **Start** button that appears in the MCP config file, then use Agent mode in Copilot Chat.
+Use `/mcp` in a Gemini CLI session to verify the server is connected.
 
 </details>
 
 <details>
-<summary><strong>JetBrains IDEs (GitHub Copilot)</strong></summary>
+<summary><strong>Goose</strong></summary>
+
+Go to **Advanced settings** > **Extensions** > **Add custom extension**. Name to your liking, use type `STDIO`, and set the command to `npx -y dejared-mcp`.
+
+</details>
+
+<details>
+<summary><strong>JetBrains IDEs</strong></summary>
 
 Go to **Settings** > **Tools** > **AI Assistant** > **Model Context Protocol (MCP)**.
 
@@ -138,39 +289,47 @@ Click **+ Add** and configure:
 </details>
 
 <details>
-<summary><strong>Gemini CLI</strong></summary>
+<summary><strong>Kiro</strong></summary>
 
-**Option A** - CLI command:
+Create or edit `.kiro/settings/mcp.json` using the standard config above.
 
-```bash
-gemini mcp add dejared npx -y dejared-mcp
-```
+</details>
 
-**Option B** - Edit `~/.gemini/settings.json` (global) or `.gemini/settings.json` (project):
+<details>
+<summary><strong>opencode</strong></summary>
+
+Edit `~/.config/opencode/opencode.json`:
 
 ```json
 {
-  "mcpServers": {
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
     "dejared": {
-      "command": "npx",
-      "args": ["-y", "dejared-mcp"]
+      "type": "local",
+      "command": ["npx", "-y", "dejared-mcp"],
+      "enabled": true
     }
   }
 }
 ```
 
-Use `/mcp` in a Gemini CLI session to verify the server is connected.
+</details>
+
+<details>
+<summary><strong>Qodo Gen</strong></summary>
+
+Open [Qodo Gen](https://docs.qodo.ai/qodo-documentation/qodo-gen) chat panel in VS Code or IntelliJ > Connect more tools > + Add new MCP > Paste the standard config above > Save.
 
 </details>
 
 <details>
-<summary><strong>Antigravity Editor</strong></summary>
+<summary><strong>VS Code (GitHub Copilot)</strong></summary>
 
-Edit `~/.gemini/antigravity/mcp_config.json`:
+Create or edit `.vscode/mcp.json` in your project root:
 
 ```json
 {
-  "mcpServers": {
+  "servers": {
     "dejared": {
       "command": "npx",
       "args": ["-y", "dejared-mcp"]
@@ -179,38 +338,14 @@ Edit `~/.gemini/antigravity/mcp_config.json`:
 }
 ```
 
-Or install through the MCP Store if available.
+After saving, click the **Start** button that appears in the MCP config file, then use Agent mode in Copilot Chat.
 
 </details>
 
 <details>
-<summary><strong>GitHub Copilot CLI</strong></summary>
-
-**Option A** - Interactive:
-
-```
-/mcp add
-```
-
-Then fill in:
-- **Server Name**: `dejared`
-- **Server Type**: `STDIO`
-- **Command**: `npx -y dejared-mcp`
+<summary><strong>Windsurf</strong></summary>
 
-**Option B** - Edit `~/.copilot/mcp-config.json`:
-
-```json
-{
-  "mcpServers": {
-    "dejared": {
-      "type": "local",
-      "command": "npx",
-      "args": ["-y", "dejared-mcp"],
-      "tools": ["*"]
-    }
-  }
-}
-```
+Open Windsurf settings, navigate to MCP servers, and add a new server using the `command` type with `npx -y dejared-mcp`. Or add the standard config under `mcpServers` in your settings.
 
 </details>
 
@@ -221,31 +356,24 @@ If you prefer to run the server JAR directly without Node.js:
 
 1. Download the latest JAR from [GitHub Releases](https://github.com/HuynhKhanh1402/dejared-mcp/releases).
 
-   Direct link pattern:
-   ```
-   https://github.com/HuynhKhanh1402/dejared-mcp/releases/download/v{VERSION}/dejared-mcp-{VERSION}.jar
-   ```
-
 2. Run it:
    ```bash
-   java -jar dejared-mcp-0.1.1.jar
+   java -jar dejared-mcp-0.1.3.jar
    ```
 
-3. Configure your MCP client to use the JAR directly instead of `npx`. For example, in Claude Desktop:
+3. Configure your MCP client to use the JAR directly instead of `npx`:
 
    ```json
    {
      "mcpServers": {
        "dejared": {
          "command": "java",
-         "args": ["-jar", "/path/to/dejared-mcp-0.1.1.jar"]
+         "args": ["-jar", "/path/to/dejared-mcp-0.1.3.jar"]
        }
      }
    }
    ```
 
-   Replace `/path/to/dejared-mcp-0.1.1.jar` with the actual path where you saved the JAR. This works with any MCP client that supports stdio transport.
-
 </details>
 
 ## Custom Java Path
@@ -266,50 +394,92 @@ If Java is not in your system PATH, set the `DEJARED_JAVA_PATH` environment vari
 }
 ```
 
-## Features
+## Server Configuration
 
-**Discovery** - Browse JAR structure:
-- `dejared_list_packages` - List all packages with class counts
-- `dejared_list_classes` - List classes in a specific package
-- `dejared_list_resources` - List non-class resource files
-- `dejared_read_resource` - Read text resources (yml, xml, properties, json, etc.)
+| Property | Default | Description |
+|----------|---------|-------------|
+| `dejared.cache.max-size` | `500` | Max entries in the decompilation LRU cache |
+| `dejared.security.max-resource-size` | `5242880` | Max resource file size (bytes) |
+| `dejared.security.decompile-timeout-seconds` | `30` | Timeout per decompilation |
 
-**Hunting** - Search inside JARs:
-- `dejared_search_class` - Search classes by name
-- `dejared_search_string` - Search string literals in bytecode (URLs, SQL, error messages, etc.)
+## How It Works
 
-**Deep Analysis** - Inspect and decompile:
-- `dejared_get_metadata` - Extract class metadata via ASM (fast, no decompilation)
-- `dejared_dump_package_metadata` - Batch metadata for entire packages
-- `dejared_decompile_class` - Decompile `.class` to Java source code
+The npm package is a thin Node.js wrapper. On first run it:
 
-## Decompiler Engines
+1. Checks the platform cache directory for a cached JAR matching the current version.
+   - **Linux**: `$XDG_CACHE_HOME/dejared-mcp` (defaults to `~/.cache/dejared-mcp`)
+   - **macOS**: `~/Library/Caches/dejared-mcp`
+   - **Windows**: `%LOCALAPPDATA%\dejared-mcp`
+2. Downloads the JAR from GitHub Releases if not cached.
+3. Spawns `java -jar` with stdio inherited for MCP transport.
 
-| Engine | Description |
-|--------|-------------|
-| **CFR** (default) | Reliable general-purpose decompiler |
-| **Vineflower** | Modern fork of FernFlower, good with newer Java features |
-| **Procyon** | Alternative engine, can handle some edge cases better |
+The server communicates over stdio using the Model Context Protocol.
 
-## How It Works
+## FAQ and Troubleshooting
 
-The npm package is a thin Node.js wrapper. On first run it:
-1. Checks the platform cache directory for a cached JAR matching the current version
-   - Linux: `$XDG_CACHE_HOME/dejared-mcp` (default `~/.cache/dejared-mcp`)
-   - macOS: `~/Library/Caches/dejared-mcp`
-   - Windows: `%LOCALAPPDATA%\dejared-mcp`
-2. Downloads the JAR from GitHub Releases if not cached
-3. Spawns `java -jar` with stdio inherited for MCP transport
+**Q: Java is installed but the server cannot find it.**
 
-The server communicates over stdio.
+Set the `DEJARED_JAVA_PATH` environment variable in your MCP
+configuration. See [Custom Java Path](#custom-java-path).
 
-## Server Configuration
+**Q: The server fails to start with a permission error.**
 
-| Property | Default | Description |
-|----------|---------|-------------|
-| `dejared.cache.max-size` | `500` | Max entries in the decompilation LRU cache |
-| `dejared.security.max-resource-size` | `5242880` | Max resource file size (bytes) |
-| `dejared.security.decompile-timeout-seconds` | `30` | Timeout per decompilation |
+Ensure that the cached JAR file is readable. The cache location
+depends on your platform. See [How It Works](#how-it-works) for
+the cache directory paths.
+
+**Q: Decompilation times out or returns an error.**
+
+Some classes are difficult to decompile. Try a different engine
+by specifying `vineflower` or `procyon` in the `dejared_decompile_class`
+tool. The default timeout is 30 seconds and can be adjusted via
+`dejared.security.decompile-timeout-seconds`.
+
+**Q: Which Java version do I need?**
+
+Java 21 or later. A JRE is sufficient; you do not need a full JDK.
+
+**Q: Can I run the server without Node.js?**
+
+Yes. Download the JAR from GitHub Releases and run it directly
+with `java -jar`. See the "Pure Java" section under
+[Installation and Configuration](#installation-and-configuration).
+
+## Contributing
+
+Contributions are welcome. Please follow these guidelines:
+
+1. Fork the repository and create a feature branch from `master`.
+2. Ensure your changes compile and pass existing tests.
+3. Write clear commit messages describing the purpose of each change.
+4. Open a pull request against `master` with a description of what
+   the change does and why.
+
+### Project Structure
+
+```
+dejared-mcp/
+├── bin/            # Node.js CLI entry point
+├── lib/            # Node.js wrapper (JAR download and process management)
+├── java-mcp/       # Java MCP server (Spring Boot, Gradle)
+│   └── src/
+├── skills/         # Claude Code plugin skills
+├── package.json    # npm package manifest
+└── server.json     # MCP Registry manifest
+```
+
+### Building from Source
+
+```bash
+cd java-mcp
+./gradlew build
+```
+
+### Reporting Issues
+
+Open an issue on [GitHub Issues](https://github.com/HuynhKhanh1402/dejared-mcp/issues)
+with steps to reproduce the problem, your Java version, and your
+Node.js version.
 
 ## Third-Party Licenses
 
@@ -326,4 +496,4 @@ This project uses the following open-source libraries:
 
 ## License
 
-[MIT](LICENSE)
+This project is licensed under the [MIT License](LICENSE).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dejared-mcp",
-  "version": "0.1.2",
-  "mcpName": "io.github.huynhkhanh1402/dejared",
+  "version": "0.1.4",
+  "mcpName": "io.github.HuynhKhanh1402/dejared",
   "description": "Explore, analyze, and decompile Java JAR files via MCP",
   "bin": {
     "dejared-mcp": "bin/dejared-mcp.js"

package/skills/jar-analysis/SKILL.md

@@ -1,16 +1,13 @@
 ---
 name: jar-analysis
 description: >
-  Explore, search, and decompile Java JAR files. Three workflows: Explore
-  (top-down structure mapping), Hunt (search for specific code/strings),
-  and Deep Analysis (single-class investigation). Use the workflow that
-  matches the task.
+  Explore, search, and decompile Java JAR files. Quick use cases for
+  common tasks (lookup, read config, get signatures) and workflows for
+  deeper analysis (Explore, Hunt, Deep Analysis).
 ---
 
 # JAR Analysis
 
-Three workflows for working with Java JAR files. Pick the one that fits your goal.
-
 ## Available Tools
 
 | Tool | Cost | Purpose |
@@ -34,106 +31,23 @@ Three workflows for working with Java JAR files. Pick the one that fits your goa
 
 ---
 
-## Workflow 1: Explore
-
-Use when exploring unknown JARs or understanding JAR architecture. Top-down approach: cheap tools first, decompilation last.
-
-### Step 1: Map Package Structure
-Call `dejared_list_packages` to get the full layout.
-- Identify the root application package (highest class count, deepest nesting).
-- Distinguish app code from shaded/third-party dependencies.
-
-### Step 2: List Classes
-Call `dejared_list_classes` with `recursive=true` on the root application package to get all classes in one call.
-- For targeted exploration of specific packages, use `recursive=false`.
-
-### Step 3: Discover Resources
-Call `dejared_list_resources` to see what non-class files exist in the JAR.
+## Quick Use Cases
 
-### Step 4: Read Configuration
-Call `dejared_read_resource` for files discovered in Step 3:
-- `application.yml` / `application.yaml` / `application.properties`
-- `META-INF/spring.factories` or `META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`
-- `logback.xml` / `log4j2.xml`
+**Quick Lookup** - find a class by name (`dejared_search_class`) or find a string in bytecode (`dejared_search_string`). One call, done.
 
-### Step 5: Batch Metadata
-Call `dejared_dump_package_metadata` with **all important packages at once** (it accepts a list).
-Example: `packageNames: ["com.example.service", "com.example.config", "com.example.controller"]`
-- Returns annotations, fields, and method signatures for every class.
-- One call replaces dozens of individual `dejared_get_metadata` calls.
+**Read Config** - `dejared_list_resources` to see what's in the JAR, then `dejared_read_resource` to read it (application.yml, pom.xml, logback.xml, etc.)
 
-### Step 6: Selective Decompilation
-Call `dejared_decompile_class` ONLY for classes where you need method body logic.
-- You MUST have reviewed metadata from Step 5 first.
-- Decompile one class at a time; summarize before continuing.
-- For JARs with >20 packages, group by prefix and summarize before diving in.
+**Get Signatures** - `dejared_get_metadata` for a single class, or `dejared_dump_package_metadata` for an entire package (accepts a list). Returns class hierarchy, annotations, fields, and method signatures without decompiling.
 
 ---
 
-## Workflow 2: Hunt
-
-Use when looking for specific functionality, URLs, SQL, error messages, or credentials. Search-driven approach.
-
-### Search Tools
-
-**`dejared_search_class`** -- Find by class name.
-Case-insensitive keyword match against simple class names.
-- Find specific classes: "UserService", "DatabaseConfig"
-- Find patterns: "Controller", "Repository", "Factory", "Handler"
-
-**`dejared_search_string`** -- Find by string literal.
-Scans bytecode constant pools across all classes (case-insensitive).
-- URLs, endpoints, API paths
-- SQL queries, table names
-- Error messages, log messages
-- Config keys, credentials, secrets
-- Useful keywords for security audits: "password", "secret", "token", "key", "jdbc", "http://"
-
-### Steps
-
-1. **Search** -- Pick the right search tool based on the goal.
-2. **Triage** -- Review results, identify most relevant matches.
-3. **Inspect** -- Call `dejared_get_metadata` on promising classes to understand their role (annotations, fields, methods).
-4. **Decompile** -- Call `dejared_decompile_class` ONLY on classes where you need to see method body logic. Never skip step 3.
-5. **Report** -- Summarize findings with context and implications.
-
-Note: String search finds compiled constants only, not runtime-generated strings.
-
----
-
-## Workflow 3: Deep Analysis
-
-Use when investigating a single class in detail. Combines metadata extraction with multi-engine decompilation.
-
-### Step 1: Metadata First
-Call `dejared_get_metadata` to extract:
-- Class hierarchy (superclass, interfaces)
-- Annotations (`@Service`, `@Entity`, `@Controller`, etc.)
-- Fields (state the class holds)
-- Methods (behavior -- names, return types, parameters)
-
-This tells you the class's role and size before decompiling.
-
-### Step 2: Decompile
-Call `dejared_decompile_class` (default engine: CFR). Analyze:
-- Constructor logic and dependency injection
-- Method implementations and business logic
-- Error handling patterns
-- Interactions with other classes
+## Workflows
 
-### Step 3: Cross-Reference (if needed)
-If decompiled code references important classes:
-- `dejared_search_class` to find them by name.
-- `dejared_dump_package_metadata` on the same package to see sibling classes (accepts a list of packages).
+**Explore** - top-down JAR mapping:
+`dejared_list_packages` → `dejared_list_classes` (use `recursive=true`) → `dejared_list_resources` → `dejared_read_resource` for configs → `dejared_dump_package_metadata` (batch all important packages in one call) → selective `dejared_decompile_class` only where method body logic is needed.
 
-### Step 4: Try Alternative Engine (if needed)
-If CFR output has problems (broken lambdas, goto statements, placeholder bodies):
-- `vineflower` -- best for modern Java features.
-- `procyon` -- good for edge cases.
+**Hunt** - search-driven investigation:
+Pick search tool (`dejared_search_class` or `dejared_search_string`) → triage results → `dejared_get_metadata` on promising matches → `dejared_decompile_class` only if needed. Never skip the metadata step.
 
-### Report Structure
-1. **Role** -- What this class does (one sentence).
-2. **Framework Integration** -- Annotations, Spring beans, injection points.
-3. **Key Methods** -- Important methods and what they do.
-4. **Dependencies** -- Other classes/services it uses.
-5. **Notable Patterns** -- Design patterns, security concerns, performance notes.
+**Deep Analysis** - single class investigation:
+`dejared_get_metadata` first → `dejared_decompile_class` (CFR default) → cross-reference with `dejared_search_class` or `dejared_dump_package_metadata` if needed. If CFR output has issues (broken lambdas, `goto` statements, missing method bodies), retry with `vineflower` (best for modern Java features like records, sealed classes, pattern matching) or `procyon` (handles some obfuscated/edge-case bytecode better).