hexforge-gateway
Self-hosted reverse-engineering workspace API orchestrating jadx/apktool/adb/frida/APKiD via job & workflow engine, exposed as native MCP tools for AI agents.
Ficha actualizada 23 sept 2026, 3:29 · upstream 23 sept 2026, 2:57 · release sin release detectada
Qué es hexforge-gateway
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
HexForge Gateway is a self-hosted reverse-engineering workspace API that orchestrates Android APK analysis through a modular job and workflow engine. It exposes the entire toolchain — jadx, apktool, adb, frida, APKID, and MT Manager's APK MCP agent — as native MCP tools for AI agents like Claude Desktop or Cursor. The system runs entirely on-device (Termux + MT Manager) or on a normal PC, with no cloud dependency required.
The architecture follows a clear pipeline: Workspace → Workflow → Jobs → Tasks → MCP Agents. Each module communicates via an Event Bus rather than direct calls, enabling loose coupling and extensibility. The Knowledge Engine auto-generates report entries when workflows complete, while the AI Provider Layer supports nine different providers for summarization and chat.
Key features include real-time WebSocket updates, a plugin system for custom tools, full CLI support via scripts, and optional Supabase persistence for shared state across sessions.
- Automated APK reverse-engineering: analyze an APK, extract strings, resources, and dependencies without manual inspection
- Code review automation: use AI agents to explain code changes, suggest refactors, or detect security issues in modified APKs
- Device profiling: run Frida scripts on a device while the Gateway monitors memory usage and network activity via adb/frida integration
- Build artifact analysis: compare two builds side-by-side using jadx/apktool tools to identify differences in bytecode or resources
- Security auditing: use APKID to detect obfuscation, obfuscated classes, or suspicious code patterns across multiple APKs
- Multi-language support: run jadx with different language configurations and compare outputs for localization analysis
- Runs entirely on-device — no cloud dependency required. All processing happens locally in Termux or a PC environment.
- Native MCP tool integration via the Gateway Server Frontend, allowing seamless use with Claude Desktop, Cursor, and other IDEs.
- Modular architecture with Event Bus decoupling allows adding new agents (e.g., new AI providers) without modifying core logic.
- Support for both local file storage and optional Supabase backend, enabling shared workspace state across multiple users or sessions.
- Full CLI support via scripts including a smoke-test runner that validates end-to-end workflows against live instances.
- Real-time WebSocket updates keep the user informed of task progress, job status changes, and workflow completion without polling.
- Local storage is JSON-based and can become large over time; Supabase backend requires additional setup for persistent shared state.
- The MCP Server Frontend currently uses stdio only — streaming HTTP transport support exists but is not yet implemented.
- Job retry logic relies on polling or WebSocket events rather than a dedicated queue system, which may cause race conditions under high concurrency.
- AI provider integration requires manual configuration of each provider's API endpoint and credentials per workspace.
- The plugin system supports reference plugins but lacks comprehensive type safety for custom plugin implementations.
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Install Node.js 20+ and TypeScript, then run `npm install` followed by `cp .env.example .env`. Start with `npm run dev`, which launches the server on port 8080. The Gateway exposes WebSocket connections at `/ws` for real-time updates. For local storage, set `STORAGE_BACKEND=local`; for Supabase, use `STORAGE_BACKEND=supabase`. Always verify MCP tool availability by checking `GET /plugins` before using them in AI agents.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.