dejared-mcp 1.1.0 → 1.2.1

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
     {
       "name": "dejared",
       "source": "./",
-      "description": "Explore, analyze, and decompile Java JAR files with structured workflows.",
-      "version": "1.1.0",
+      "description": "Java decompiler and JAR analyzer. Decompile classes, search bytecode, and read resources embedded in JAR, WAR, EAR, and AAR archives.",
+      "version": "1.2.1",
       "author": {
         "name": "hqkh4nh"
       },
       "license": "MIT",
-      "keywords": ["java", "jar", "decompiler", "bytecode", "reverse-engineering", "mcp"],
+      "keywords": ["java", "java-decompiler", "jar", "war", "aar", "decompiler", "decompile", "bytecode", "class-file", "cfr", "vineflower", "procyon", "reverse-engineering", "mcp"],
       "category": "development"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,13 +1,13 @@
 {
   "name": "dejared",
-  "description": "Explore, analyze, and decompile Java JAR files with structured workflows.",
-  "version": "1.1.0",
+  "description": "Java decompiler and JAR analyzer. Decompile classes, search bytecode, and read resources embedded in JAR, WAR, EAR, and AAR archives.",
+  "version": "1.2.1",
   "author": {
     "name": "hqkh4nh"
   },
   "repository": "https://github.com/hqkh4nh/dejared-mcp",
   "license": "MIT",
-  "keywords": ["java", "jar", "decompiler", "bytecode", "reverse-engineering", "mcp"],
+  "keywords": ["java", "java-decompiler", "jar", "war", "aar", "decompiler", "decompile", "bytecode", "class-file", "cfr", "vineflower", "procyon", "reverse-engineering", "mcp"],
   "mcpServers": {
     "dejared": {
       "command": "npx",

package/.codex-plugin/plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "dejared",
+  "version": "1.2.1",
+  "description": "Java decompiler and JAR analyzer. Decompile classes, search bytecode, and read resources embedded in JAR, WAR, EAR, and AAR archives.",
+  "author": {
+    "name": "hqkh4nh"
+  },
+  "homepage": "https://github.com/hqkh4nh/dejared-mcp",
+  "repository": "https://github.com/hqkh4nh/dejared-mcp",
+  "license": "MIT",
+  "keywords": ["java", "java-decompiler", "jar", "war", "aar", "decompiler", "decompile", "bytecode", "class-file", "cfr", "vineflower", "procyon", "reverse-engineering", "mcp"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "DeJared",
+    "shortDescription": "Decompile and search Java archives",
+    "longDescription": "Nine tools for navigating JAR, WAR, EAR, AAR, and Spring Boot fat-jars: list packages and resources, search classes and bytecode string literals, read embedded configs, extract class metadata via ASM, and decompile with CFR, Vineflower, or Procyon.",
+    "category": "Developer Tools"
+  }
+}

package/README.md

@@ -4,24 +4,28 @@
 [![npm downloads](https://img.shields.io/npm/dt/dejared-mcp?style=flat-square&color=cb3837&label=downloads)](https://www.npmjs.com/package/dejared-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue?style=flat-square)](LICENSE)
 
-# dejared-mcp
+# dejared-mcp: Java decompiler MCP server
 
-A Model Context Protocol (MCP) server for exploring, analyzing, and decompiling Java JAR files.
-Designed for AI-powered development tools, dejared-mcp connects your IDE or CLI assistant
-to inspect package structures, search bytecode, and decompile classes
-using CFR, Vineflower, or Procyon.
+dejared-mcp is a Java decompiler and JAR analyzer that speaks the Model Context
+Protocol. It lets an AI coding agent (Claude Code, Codex, Cursor, VS Code)
+open a `.jar`, `.war`, `.ear`, or `.aar`, list what is inside, search its
+bytecode, and decompile any class back to Java source using CFR, Vineflower,
+or Procyon.
 
+[![Claude Code](https://img.shields.io/badge/Claude_Code-plugin-D97757?style=for-the-badge&logo=claude&logoColor=white)](#claude-code)
+[![Codex](https://img.shields.io/badge/Codex-plugin-000000?style=for-the-badge&logo=openai&logoColor=white)](#codex)
 [![Install in VS Code](https://img.shields.io/badge/Install_in-VS_Code-0098FF?style=for-the-badge&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=dejared&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22dejared-mcp%22%5D%7D)
-[![Add to Cursor](https://img.shields.io/badge/Add_to-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](cursor://anysphere.cursor-deeplink/mcp/install?name=dejared&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImRlamFyZWQtbWNwIl19)
+[![Add to Cursor](https://img.shields.io/badge/Add_to-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](https://cursor.com/install-mcp?name=dejared&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImRlamFyZWQtbWNwIl19)
 
 ## Table of Contents
 
 - [Overview](#overview)
 - [Prerequisites](#prerequisites)
 - [Quick Start](#quick-start)
+- [Install as a plugin (recommended)](#install-as-a-plugin-recommended)
+- [Install as an MCP server](#install-as-an-mcp-server)
 - [Features](#features)
 - [Decompiler Engines](#decompiler-engines)
-- [Installation and Configuration](#installation-and-configuration)
 - [Custom Java Path](#custom-java-path)
 - [Server Configuration](#server-configuration)
 - [How It Works](#how-it-works)
@@ -38,6 +42,12 @@ and deep analysis. AI assistants use these tools to navigate JAR file
 structures, search for classes and string literals in bytecode, and
 decompile `.class` files back to readable Java source code.
 
+Reach for it whenever a dependency ships without sources: reading what a
+third-party library actually does, recovering an `application.yml` or
+`MANIFEST.MF` embedded in a JAR, following a stack trace into a library you
+have no source for, or inspecting an obfuscated plugin or mod. It replaces
+hand-running `jar tf`, `unzip`, `javap`, or a desktop decompiler.
+
 Any ZIP-based Java archive works: `.jar`, `.war`, `.ear`, `.aar`, and
 Spring Boot fat-jars.
 
@@ -52,66 +62,60 @@ transport.
 
 ## Quick Start
 
-Add the following to your MCP client configuration:
+The best install is the plugin. One command pair gives your agent both halves:
+the **nine MCP tools**, and the **`jar-analysis` skill** that tells it when to
+reach for them instead of shelling out to `jar tf`, `unzip`, or `javap`.
 
-```json
-{
-  "mcpServers": {
-    "dejared": {
-      "command": "npx",
-      "args": ["-y", "dejared-mcp"]
-    }
-  }
-}
+```bash
+claude plugin marketplace add hqkh4nh/dejared-mcp
+claude plugin install dejared@dejared-mcp-marketplace
 ```
 
-See [Installation and Configuration](#installation-and-configuration)
-for tool-specific instructions.
+Codex carries the same bundle. See
+[Install as a plugin](#install-as-a-plugin-recommended).
+Every other client takes the [plain MCP config](#install-as-an-mcp-server).
 
-## Features
+## Install as a plugin (recommended)
 
-### Discovery
+The MCP server on its own gives an agent nine tools. It does not tell the agent
+*when* to use them, so most agents keep reaching for `jar tf`, `unzip -p`, and
+`javap -p` out of habit and never touch the tools you installed.
 
-Browse and read JAR contents.
+A plugin ships both parts together:
 
-| Tool | Description |
-|------|-------------|
-| `dejared_list_packages` | List all packages with class counts |
-| `dejared_list_classes` | List classes in a specific package |
-| `dejared_list_resources` | List non-class resource files |
-| `dejared_read_resource` | Read text resources (YAML, XML, properties, JSON, and others) |
-
-### Hunting
+| Part | What it does |
+|------|--------------|
+| MCP server | The nine tools listed under [Features](#features) |
+| `jar-analysis` skill | Routes JAR questions to those tools, picks the cheap tool before the expensive one, and knows which decompiler to retry with |
 
-Search inside JAR files.
+Two tools support that bundle today. Everything else is
+[MCP-only](#install-as-an-mcp-server).
 
-| Tool | Description |
-|------|-------------|
-| `dejared_search_class` | Search classes by name |
-| `dejared_search_string` | Search string literals in bytecode (URLs, SQL, error messages) |
+### Claude Code
 
-### Deep Analysis
+```bash
+claude plugin marketplace add hqkh4nh/dejared-mcp
+claude plugin install dejared@dejared-mcp-marketplace
+```
 
-Inspect metadata and decompile classes.
+Inside a session, the same commands work as `/plugin marketplace add ...` and
+`/plugin install ...`. If the install summary says `Run /reload-plugins to
+activate`, run it.
 
-| Tool | Description |
-|------|-------------|
-| `dejared_get_metadata` | Extract class metadata via ASM (fast, no decompilation) |
-| `dejared_dump_package_metadata` | Batch metadata extraction for entire packages |
-| `dejared_decompile_class` | Decompile `.class` files to Java source code |
+### Codex
 
-## Decompiler Engines
+```bash
+codex plugin marketplace add hqkh4nh/dejared-mcp
+codex plugin add dejared@dejared-mcp-marketplace
+```
 
-dejared-mcp supports three decompiler engines. The engine can be
-specified per request via the `dejared_decompile_class` tool.
+Start a new session afterwards so the bundled skill and server load. Check with
+`codex mcp list`. `dejared` should be listed as `enabled`.
 
-| Engine | Description |
-|--------|-------------|
-| **CFR** (default) | Reliable general-purpose decompiler |
-| **Vineflower** | Modern fork of FernFlower, handles newer Java features well |
-| **Procyon** | Alternative engine, can handle some edge cases better |
+## Install as an MCP server
 
-## Installation and Configuration
+For clients without a plugin system. You get the tools, but not the skill that
+steers the agent toward them.
 
 Most clients accept this standard config:
 
@@ -126,6 +130,8 @@ Most clients accept this standard config:
 }
 ```
 
+### From the command line
+
 If your tool has a CLI, one line is enough:
 
 ```bash
@@ -154,10 +160,10 @@ Drop the standard config into the file for your tool:
 | JetBrains IDEs | Settings → Tools → AI Assistant → Model Context Protocol (MCP) |
 | Qodo Gen | Chat panel → Connect more tools → + Add new MCP |
 
-A few setups need more than the standard config — expand those below.
+A few setups need more than the standard config. Expand those below.
 
 <details>
-<summary><strong>Codex</strong> — TOML instead of JSON</summary>
+<summary><strong>Codex</strong>: TOML instead of JSON</summary>
 
 ```bash
 codex mcp add dejared -- npx -y dejared-mcp
@@ -181,7 +187,7 @@ DEJARED_JAVA_PATH = "/path/to/java"
 </details>
 
 <details>
-<summary><strong>VS Code (GitHub Copilot)</strong> — uses <code>servers</code>, not <code>mcpServers</code></summary>
+<summary><strong>VS Code (GitHub Copilot)</strong>: uses <code>servers</code>, not <code>mcpServers</code></summary>
 
 Create or edit `.vscode/mcp.json`:
 
@@ -201,7 +207,7 @@ After saving, click **Start** above the server entry, then use Agent mode in Cop
 </details>
 
 <details>
-<summary><strong>opencode</strong> — command is an array</summary>
+<summary><strong>opencode</strong>: command is an array</summary>
 
 Edit `~/.config/opencode/opencode.json`:
 
@@ -220,16 +226,6 @@ Edit `~/.config/opencode/opencode.json`:
 
 </details>
 
-<details>
-<summary><strong>Claude Code plugin</strong> — also installs the <code>/jar-analysis</code> skill</summary>
-
-```bash
-claude plugin marketplace add hqkh4nh/dejared-mcp
-claude plugin install dejared@dejared-mcp-marketplace
-```
-
-</details>
-
 <details>
 <summary><strong>Pure Java (no Node.js required)</strong></summary>
 
@@ -257,6 +253,49 @@ If you prefer to run the server JAR directly without Node.js:
 
 </details>
 
+## Features
+
+### Discovery
+
+Browse and read JAR contents.
+
+| Tool | Description |
+|------|-------------|
+| `dejared_list_packages` | List all packages with class counts |
+| `dejared_list_classes` | List classes in a specific package |
+| `dejared_list_resources` | List non-class resource files |
+| `dejared_read_resource` | Read text resources (YAML, XML, properties, JSON, and others) |
+
+### Hunting
+
+Search inside JAR files.
+
+| Tool | Description |
+|------|-------------|
+| `dejared_search_class` | Search classes by name |
+| `dejared_search_string` | Search string literals in bytecode (URLs, SQL, error messages) |
+
+### Deep Analysis
+
+Inspect metadata and decompile classes.
+
+| Tool | Description |
+|------|-------------|
+| `dejared_get_metadata` | Extract class metadata via ASM (fast, no decompilation) |
+| `dejared_dump_package_metadata` | Batch metadata extraction for entire packages |
+| `dejared_decompile_class` | Decompile `.class` files to Java source code |
+
+## Decompiler Engines
+
+dejared-mcp supports three decompiler engines. The engine can be
+specified per request via the `dejared_decompile_class` tool.
+
+| Engine | Description |
+|--------|-------------|
+| **CFR** (default) | Reliable general-purpose decompiler |
+| **Vineflower** | Modern fork of FernFlower, handles newer Java features well |
+| **Procyon** | Alternative engine, can handle some edge cases better |
+
 ## Custom Java Path
 
 If Java is not in your system PATH, set the `DEJARED_JAVA_PATH` environment variable in your MCP config. This applies to all `npx`-based configurations:
@@ -324,7 +363,7 @@ Java 17 or later. A JRE is sufficient; you do not need a full JDK.
 
 Yes. Download the JAR from GitHub Releases and run it directly
 with `java -jar`. See the "Pure Java" section under
-[Installation and Configuration](#installation-and-configuration).
+[Install as an MCP server](#install-as-an-mcp-server).
 
 ## Contributing
 
@@ -336,17 +375,25 @@ Contributions are welcome. Please follow these guidelines:
 4. Open a pull request against `master` with a description of what
    the change does and why.
 
+Every manifest listed under [Project Structure](#project-structure) carries a
+`version` field, and CI fails the build if any of them drifts from
+`package.json`. Bump them together.
+
 ### Project Structure
 
 ```
 dejared-mcp/
-├── bin/            # Node.js CLI entry point
-├── lib/            # Node.js wrapper (JAR download and process management)
-├── java-mcp/       # Java MCP server (Spring Boot, Gradle)
+├── bin/                    # Node.js CLI entry point
+├── lib/                    # Node.js wrapper (JAR download and process management)
+├── java-mcp/               # Java MCP server (Spring Boot, Gradle)
 │   └── src/
-├── skills/         # Claude Code plugin skills
-├── package.json    # npm package manifest
-└── server.json     # MCP Registry manifest
+├── skills/                 # Agent skills, shared by every plugin manifest below
+├── .mcp.json               # MCP server definition, shared the same way
+├── .claude-plugin/         # Claude Code plugin + marketplace manifests
+├── .codex-plugin/          # Codex plugin manifest
+├── .agents/plugins/        # Codex marketplace manifest
+├── package.json            # npm package manifest
+└── server.json             # MCP Registry manifest
 ```
 
 ### Building from Source

package/lib/jar-runner.js

@@ -133,7 +133,7 @@ async function ensureJar() {
   }
 }
 
-/** Entry point – resolves Java, ensures the JAR is cached, then spawns it. */
+/** Entry point: resolves Java, ensures the JAR is cached, then spawns it. */
 async function run() {
   const javaPath = resolveJava();
   await ensureJar();

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dejared-mcp",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "mcpName": "io.github.hqkh4nh/dejared",
-  "description": "Explore, analyze, and decompile Java JAR files via MCP",
+  "description": "Java decompiler MCP server for AI coding agents. Explore, search, and decompile JAR, WAR, EAR, and AAR bytecode with CFR, Vineflower, or Procyon.",
   "bin": {
     "dejared-mcp": "bin/dejared-mcp.js"
   },
@@ -11,6 +11,7 @@
     "lib/",
     "skills/",
     ".claude-plugin/",
+    ".codex-plugin/",
     ".mcp.json",
     "README.md",
     "LICENSE"
@@ -23,11 +24,23 @@
   },
   "keywords": [
     "mcp",
+    "mcp-server",
+    "model-context-protocol",
     "java",
-    "jar",
+    "java-decompiler",
     "decompiler",
+    "decompile",
+    "jar",
+    "war",
+    "aar",
+    "class-file",
     "bytecode",
-    "reverse-engineering"
+    "cfr",
+    "vineflower",
+    "procyon",
+    "reverse-engineering",
+    "claude-code",
+    "codex"
   ],
   "engines": {
     "node": ">=20"

package/skills/jar-analysis/SKILL.md

@@ -12,7 +12,7 @@ description: >
   `~/.m2/repository`, `~/.gradle/caches`, `build/libs/`, `target/`,
   `lib/`, and `libs/`. Prefer the dejared MCP tools over `jar tf`,
   `jar xf`, `unzip`, `javap -p`, `javap -c`, `javap -v`, or running a
-  decompiler manually — even if the user doesn't explicitly ask for
+  decompiler manually, even if the user doesn't explicitly ask for
   "the dejared tools" or "decompilation".
 ---
 
@@ -20,7 +20,7 @@ description: >
 
 ## When This Skill Applies
 
-Reach for these tools — never the shell — whenever the task touches the **inside** of a Java artifact:
+Reach for these tools, never the shell, whenever the task touches the **inside** of a Java artifact:
 
 | You would reach for...                       | Use this instead                                       |
 |----------------------------------------------|--------------------------------------------------------|
@@ -52,8 +52,8 @@ Applies to `.jar`, `.war`, `.ear`, `.aar` and any artifact under `~/.m2/reposito
 ## Shared Rules
 
 - All tool calls require the **absolute path** to the JAR file.
-- Prefer these MCP tools over shelling out to jar/javap/unzip/strings or asking the user to decompile manually — structured output is faster and safer for the agent to consume.
-- Check metadata before decompiling — it often provides enough information without the cost of full decompilation.
+- Prefer these MCP tools over shelling out to jar/javap/unzip/strings or asking the user to decompile manually. Structured output is faster and safer for the agent to consume.
+- Check metadata before decompiling: it often provides enough information without the cost of full decompilation.
 - Default decompiler: CFR. If output is broken, try `vineflower` or `procyon`.
 - Report results in structured format.
 
@@ -61,21 +61,21 @@ Applies to `.jar`, `.war`, `.ear`, `.aar` and any artifact under `~/.m2/reposito
 
 ## Quick Use Cases
 
-**Quick Lookup** — find a class by name (`dejared_search_class`) or find a string in bytecode (`dejared_search_string`). One call, done.
+**Quick Lookup**: find a class by name (`dejared_search_class`) or find a string in bytecode (`dejared_search_string`). One call, done.
 
-**Read Config** — `dejared_list_resources` to see what's in the JAR, then `dejared_read_resource` to read it (application.yml, pom.xml, logback.xml, etc.).
+**Read Config**: `dejared_list_resources` to see what's in the JAR, then `dejared_read_resource` to read it (application.yml, pom.xml, logback.xml, etc.).
 
-**Get Signatures** — `dejared_get_metadata` for a single class, or `dejared_dump_package_metadata` for an entire package (accepts a list). Returns class hierarchy, annotations, fields, and method signatures without decompiling.
+**Get Signatures**: `dejared_get_metadata` for a single class, or `dejared_dump_package_metadata` for an entire package (accepts a list). Returns class hierarchy, annotations, fields, and method signatures without decompiling.
 
 ---
 
 ## Workflows
 
-**Explore** — top-down JAR mapping:
+**Explore**: top-down JAR mapping:
 `dejared_list_packages` → `dejared_list_classes` (use `recursive=true`) → `dejared_list_resources` → `dejared_read_resource` for configs → `dejared_dump_package_metadata` (batch all important packages in one call) → selective `dejared_decompile_class` only where method body logic is needed. If CFR output has issues, retry with `vineflower` or `procyon`.
 
-**Hunt** — search-driven investigation:
+**Hunt**: search-driven investigation:
 Pick search tool (`dejared_search_class` or `dejared_search_string`) → triage results → `dejared_get_metadata` on promising matches → `dejared_decompile_class` only if needed.
 
-**Deep Analysis** — single class investigation:
+**Deep Analysis**: single class investigation:
 `dejared_get_metadata` first → `dejared_decompile_class` (CFR default) → cross-reference with `dejared_search_class` or `dejared_dump_package_metadata` if needed. If CFR output has issues (broken lambdas, `goto` statements, missing method bodies), retry with `vineflower` (best for modern Java features like records, sealed classes, pattern matching) or `procyon` (handles some obfuscated/edge-case bytecode better).