Dejared

dejared-mcp: Java decompiler MCP server

dejared-mcp is a Java decompiler and JAR analyzer that speaks the Model Context Protocol. It lets an AI coding agent (Claude Code, Codex, Cursor, VS Code) open a .jar, .war, .ear, or .aar, list what is inside, search its bytecode, and decompile any class back to Java source using CFR, Vineflower, or Procyon.

Table of Contents

• Overview
• Prerequisites
• Quick Start
• Install as a plugin (recommended)
• Install as an MCP server
• Features
• Decompiler Engines
• Custom Java Path
• Server Configuration
• How It Works
• FAQ and Troubleshooting
• Contributing
• Third-Party Licenses
• License

Overview

dejared-mcp is a Java-based MCP server distributed as an npm package. It provides nine tools organized into three categories: discovery, hunting, and deep analysis. AI assistants use these tools to navigate JAR file structures, search for classes and string literals in bytecode, and decompile .class files back to readable Java source code.

Reach for it whenever a dependency ships without sources: reading what a third-party library actually does, recovering an application.yml or MANIFEST.MF embedded in a JAR, following a stack trace into a library you have no source for, or inspecting an obfuscated plugin or mod. It replaces hand-running jar tf, unzip, javap, or a desktop decompiler.

Any ZIP-based Java archive works: .jar, .war, .ear, .aar, and Spring Boot fat-jars.

The npm package acts as a thin wrapper that downloads and caches the server JAR on first run, then spawns it via java -jar using stdio transport.

Prerequisites

• Node.js 20 or later
• Java 17 or later (JRE is sufficient)

Quick Start

The best install is the plugin. One command pair gives your agent both halves: the nine MCP tools, and the `jar-analysis` skill that tells it when to reach for them instead of shelling out to jar tf, unzip, or javap.

claude plugin marketplace add hqkh4nh/dejared-mcp

claude plugin install dejared@dejared-mcp-marketplace

Codex carries the same bundle. See Install as a plugin. Every other client takes the plain MCP config.

Install as a plugin (recommended)

The MCP server on its own gives an agent nine tools. It does not tell the agent *when* to use them, so most agents keep reaching for jar tf, unzip -p, and javap -p out of habit and never touch the tools you installed.

A plugin ships both parts together:

Two tools support that bundle today. Everything else is MCP-only.

Claude Code

claude plugin marketplace add hqkh4nh/dejared-mcp

claude plugin install dejared@dejared-mcp-marketplace

Inside a session, the same commands work as /plugin marketplace add ... and /plugin install .... If the install summary says Run /reload-plugins to activate, run it.

Codex

codex plugin marketplace add hqkh4nh/dejared-mcp

codex plugin add dejared@dejared-mcp-marketplace

Start a new session afterwards so the bundled skill and server load. Check with codex mcp list. dejared should be listed as enabled.

Install as an MCP server

For clients without a plugin system. You get the tools, but not the skill that steers the agent toward them.

Most clients accept this standard config:

{

"mcpServers": { "dejared": { "command": "npx", "args": ["-y", "dejared-mcp"] } } }

From the command line

If your tool has a CLI, one line is enough:

claude mcp add dejared -- npx -y dejared-mcp     # Claude Code

codex mcp add dejared -- npx -y dejared-mcp # Codex amp mcp add dejared -- npx -y dejared-mcp # Amp gemini mcp add dejared npx -y dejared-mcp # Gemini CLI

Where the config file lives

Drop the standard config into the file for your tool:

A few setups need more than the standard config. Expand those below.

Codex : TOML instead of JSON

codex mcp add dejared -- npx -y dejared-mcp

codex mcp list

The -- matters: everything after it is the server's launch command.

Or edit ~/.codex/config.toml (global) or .codex/config.toml (project):

[mcp_servers.dejared]

command = "npx" args = ["-y", "dejared-mcp"]

Only if Java is not on your PATH

[mcp_servers.dejared.env] DEJARED_JAVA_PATH = "/path/to/java"

VS Code (GitHub Copilot) : uses servers , not mcpServers

Create or edit .vscode/mcp.json:

{

"servers": { "dejared": { "command": "npx", "args": ["-y", "dejared-mcp"] } } }

After saving, click Start above the server entry, then use Agent mode in Copilot Chat.

opencode : command is an array

Edit ~/.config/opencode/opencode.json:

{

"$schema": "https://opencode.ai/config.json", "mcp": { "dejared": { "type": "local", "command": ["npx", "-y", "dejared-mcp"], "enabled": true } } }

Pure Java (no Node.js required)

If you prefer to run the server JAR directly without Node.js:

1. Download the latest JAR from GitHub Releases.

1. Run it:

   java -jar dejared-mcp-<version>.jar

1. Configure your MCP client to use the JAR directly instead of npx:

   {

"mcpServers": { "dejared": { "command": "java", "args": ["-jar", "/path/to/dejared-mcp- .jar"] } } }

Features

Discovery

Browse and read JAR contents.

Hunting

Search inside JAR files.

Deep Analysis

Inspect metadata and decompile classes.

Decompiler Engines

dejared-mcp supports three decompiler engines. The engine can be specified per request via the dejared_decompile_class tool.

Custom Java Path

If Java is not in your system PATH, set the DEJARED_JAVA_PATH environment variable in your MCP config. This applies to all npx-based configurations:

{

"mcpServers": { "dejared": { "command": "npx", "args": ["-y", "dejared-mcp"], "env": { "DEJARED_JAVA_PATH": "/path/to/java" } } } }

Server Configuration

How It Works

The npm package is a thin Node.js wrapper. On first run it:

1. Checks the platform cache directory for a cached JAR matching the current version.

• Linux: $XDG_CACHE_HOME/dejared-mcp (defaults to ~/.cache/dejared-mcp)
• macOS: ~/Library/Caches/dejared-mcp
• Windows: %LOCALAPPDATA%\dejared-mcp

1. Downloads the JAR from GitHub Releases if not cached.
2. Spawns java -jar with stdio inherited for MCP transport.

The server communicates over stdio using the Model Context Protocol.

FAQ and Troubleshooting

Q: Java is installed but the server cannot find it.

Set the DEJARED_JAVA_PATH environment variable in your MCP configuration. See Custom Java Path.

Q: The server fails to start with a permission error.

Ensure that the cached JAR file is readable. The cache location depends on your platform. See How It Works for the cache directory paths.

Q: Decompilation times out or returns an error.

Some classes are difficult to decompile. Try a different engine by specifying vineflower or procyon in the dejared_decompile_class tool. The default timeout is 30 seconds and can be adjusted via `dejared.security