Mmcp.market

Maven Decoder MCP server

by salitaba·io.github.salitaba/maven-decoder-mcp·v1.3.2
No reviews yet

Lets AI agents read the real source of any Maven dependency, decompiled from ~/.m2 or Central.

B75/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
Growing

20 stars296 downloads/wk

Reviews

Write one

Nobody has reviewed Maven Decoder yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Maven Decoder tools (17)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_jar

    Analyze a specific jar file and extract detailed information

  • analyze_jar_structure

    Analyze the overall structure and metadata of a jar file

  • compare_versions

    Compare different versions of the same Maven artifact

  • download_artifact

    Download an artifact from the remote repository into the local analysis cache so every other tool can inspect it. Use 'latest' as the version to fetch the newest release.

  • extract_class_info

    Get detailed information about Java classes in a jar

  • extract_jar_resource

    Extract text resources from a jar, such as .proto files, service descriptors, or metadata

  • extract_method_info

    Extract specific method information from a Java class

  • extract_source_code

    Extract source code from jar (if available) or decompile bytecode

  • find_dependents

    Find artifacts that depend on a specific artifact

  • find_usage_examples

    Find usage examples of classes/methods in test jars

  • get_dependencies

    Get Maven dependencies from POM files

  • get_dependency_tree

    Get complete dependency tree for an artifact

  • get_remote_versions

    List all versions of an artifact published on the remote repository, including versions that are not installed locally

  • get_version_info

    Get all available versions of an artifact, optionally including versions published remotely

  • list_artifacts

    List all Maven artifacts in the local repository with optional filtering

  • search_classes

    Search for Java classes across all jars in the repository

  • search_maven_central

    Search Maven Central (or the configured mirror) online for artifacts, including ones not installed locally. Use this to discover coordinates or find which published artifact contains a class.

Public scan report

scanner v0.1.9 · 2026-09-19 · same rubric, same numbers if you re-run it

1 medium
  • Code scan3 source files scanned; 13 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumnpm install lifecycle script presentinstall.script
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Maven Decoder repository's README, as published. We do not edit it. Read it on GitHub

<!-- mcp-name: io.github.salitaba/maven-decoder-mcp -->

Maven Decoder MCP Server

Your agent guesses at library APIs it has never read. This makes it read them.

Lets AI agents read the actual source of any Maven dependency — decompiles jars from ~/.m2 or Maven Central, and diffs versions for breaking changes.

Ask an agent "I'm upgrading org.jsoup:jsoup from 1.17.2 to 1.23.2 — what breaks?" and without a way to read the jars it will answer from memory. With this server, compare_versions reads both jars and reports what actually changed:

Members are compared as declared, so one that moved to a supertype is reported as removed even though it may still be callable. The tool states this in its own output.

It works on artifacts that have no sources jar too: extractclassinfo falls back to javap and returns parsed fields, methods, and bytecode version — which is exactly the case for the internal artifacts in a corporate Nexus.

Try it in one command

npx skills add https://github.com/salitaba/maven-decoder-mcp --skill maven-code-search

That installs the maven-code-search agent skill, which tells your agent when to reach for these tools. For a raw MCP server setup instead, see Installation.

🚀 Features

Core Functionality

  • Jar File Analysis: Deep inspection of jar files including metadata, manifests, and structure
  • Dependency Resolution: Complete dependency tree analysis with transitive dependencies
  • Source Code Extraction: Extract source code from source jars or decompile bytecode
  • Class Information: Detailed class signatures, methods, fields, and annotations
  • Search Capabilities: Find classes, methods, and dependencies across all artifacts
  • Version Management: Compare versions, find dependents, and track version conflicts

Online Maven Support

  • Maven Central Search: Find artifacts and classes that are not installed locally
  • Remote Version Listing: See every published version, not just the ones you have
  • On-Demand Download: Fetch any artifact (jar, sources, POM) into a local cache
  • Transparent Fallback: Every analysis tool automatically downloads a missing artifact, so decompiling a dependency you never installed just works
  • Mirror Friendly: Point it at a corporate Nexus/Artifactory, with optional credentials
  • Offline Mode: A single env var restores fully local, network-free behavior

Advanced Features

  • Decompilation Support: Integrated support for multiple Java decompilers (CFR, Fernflower, Procyon)
  • Conflict Analysis: Detect and analyze dependency version conflicts
  • Repository Navigation: Browse and explore the local Maven repository structure
  • Metadata Parsing: Extract and parse Maven POM files and metadata
  • Service Discovery: Find and analyze Java services and SPI implementations
  • Response Management: Intelligent pagination and summarization for large responses
  • Method Extraction: Extract specific methods from large Java classes
  • Integrity Checking: Downloads are verified against the repository's SHA-1 checksums

📦 Installation

Prerequisites

  • Java 8+ (for decompilation features)
  • Maven local repository (~/.m2/repository)
  • One of: Python 3.8+, Node.js 14+, or Docker

🚀 Quick Install

One-Line Install (Recommended)

curl -fsSL https://raw.githubusercontent.com/salitaba/maven-decoder-mcp/main/install.sh | bash

📋 Installation Methods

Method 1: uvx (Recommended)

# Install uv (if not installed)
curl -Ls https://astral.sh/uv/install.sh | sh

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y maven-decoder-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add maven-decoder-mcp -- npx -y maven-decoder-mcp
Add to Cursor

Maven Decoder: common questions

Is Maven Decoder MCP server safe?
Mostly: it is graded B (75/100). Read the Maven Decoder safety report
How do I install Maven Decoder?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Maven Decoder need an API key?
Yes. The registry entry asks for MAVEN_REMOTE_PASSWORD.
Is Maven Decoder maintained?
The last commit was 4 days ago (2026-09-16). The latest release is v1.3.2.

More from salitaba →