
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
maven-decoder-mcp
Advanced tools
MCP server for reading and decompiling Maven .m2 jar files with comprehensive Java project analysis
A comprehensive Model Context Protocol (MCP) server for analyzing Maven jar files in your local repository (~/.m2). This server provides powerful tools for agentic coding assistance in Java projects, enabling AI agents to understand dependencies, analyze bytecode, extract source code, and navigate the Maven ecosystem.
~/.m2/repository)curl -fsSL https://raw.githubusercontent.com/salitaba/maven-decoder-mcp/main/install.sh | bash
# Install uv (if not installed)
curl -Ls https://astral.sh/uv/install.sh | sh
# Ensure your shell PATH is updated (restart shell or eval as printed by installer)
# Run the server via uvx (isolated, fast, no venv needed)
uvx maven-decoder-mcp
# Optional: pick a specific Python
# uvx --python 3.12 maven-decoder-mcp
# Install globally
npm install -g maven-decoder-mcp
# Or install locally
npm install maven-decoder-mcp
# Run the server
maven-decoder-mcp
# or if installed locally: npx maven-decoder-mcp
# Pull and run
docker run --rm -it \
-v ~/.m2:/home/mcpuser/.m2 \
-v $(pwd):/workspace \
ali79taba/maven-decoder-mcp:latest
# Clone repository
git clone https://github.com/salitaba/maven-decoder-mcp.git
cd maven-decoder-mcp
# Option A: Using Virtual Environment
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
pip install -r requirements.txt
pip install "git+https://github.com/modelcontextprotocol/python-sdk.git"
./setup_decompilers.sh
# Option B: System-wide Installation (not recommended)
./setup_decompilers.sh
Add to your ~/.cursor/mcp_servers.json:
{
"maven-decoder": {
"command": "uvx",
"args": ["maven-decoder-mcp"]
}
}
The server runs as a standard MCP server and can be integrated with any MCP-compatible client.
| Tool | Description |
|---|---|
list_artifacts | List artifacts in Maven repository with filtering |
analyze_jar | Analyze jar file structure and contents |
extract_class_info | Get detailed information about Java classes |
get_dependencies | Retrieve Maven dependencies from POM files |
search_classes | Search for classes across all jars |
extract_source_code | Decompile and extract Java source code |
compare_versions | Compare different versions of artifacts |
find_usage_examples | Find usage examples in test code |
get_dependency_tree | Get complete dependency tree |
find_dependents | Find artifacts that depend on a specific artifact |
get_version_info | Get all available versions of an artifact |
analyze_jar_structure | Analyze overall jar structure and metadata |
extract_method_info | Extract specific method information from Java classes |
"Show me all dependencies of org.springframework:spring-core:5.3.21"
"Decompile the class com.example.MyService from my Maven repository"
"Find all version conflicts in my Maven repository"
"Show me all public methods in the Jackson ObjectMapper class"
"List all Spring classes with pagination (page 2, 10 items per page)"
"Extract source code for a large class with summarization"
"Get method information for specific patterns in a class"
The server automatically handles large responses through intelligent pagination:
list_artifacts, extract_class_info, search_classes, get_dependencies, find_dependents, get_version_infoLarge text content is automatically summarized to improve readability:
New tool for targeted access to specific methods:
The server is built with a modular architecture:
MavenDecoderServer: Main MCP server implementationResponseManager: Handles pagination and summarizationJavaDecompiler: Handles multiple decompilation strategiesMavenDependencyAnalyzer: Analyzes Maven dependencies and metadata# Install development dependencies
pip install -e ".[dev]"
# Run tests
pytest
# Run specific test
python test_startup.py
# Build distribution
python setup.py sdist bdist_wheel
# Install locally
pip install dist/maven_decoder_mcp-*.whl
# Build Docker image
docker build -t maven-decoder-mcp .
# Run container
docker run --rm -it maven-decoder-mcp
MAVEN_HOME: Custom Maven repository location (default: ~/.m2/repository)MCP_LOG_LEVEL: Logging level (DEBUG, INFO, WARNING, ERROR)MCP_MAX_RESPONSE_SIZE: Maximum response size in bytes (default: 50000)MCP_MAX_ITEMS_PER_PAGE: Default items per page (default: 20)MCP_MAX_TEXT_LENGTH: Maximum text length before summarization (default: 10000)MCP_MAX_LINES: Maximum lines before summarization (default: 500)The server automatically detects and configures:
Server won't start
# Check Python installation
python --version
# Check Maven repository
ls ~/.m2/repository
# Check logs
maven-decoder-mcp --debug
Decompilation fails
# Check Java installation
java -version
# Setup decompilers manually
maven-decoder-setup decompilers
No artifacts found
# Verify Maven repository location
ls ~/.m2/repository
# Run a Maven build to populate repository
mvn dependency:resolve
git checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
Made with ❤️ for the Java development community
FAQs
MCP server for reading and decompiling Maven .m2 jar files with comprehensive Java project analysis
The npm package maven-decoder-mcp receives a total of 4 weekly downloads. As such, maven-decoder-mcp popularity was classified as not popular.
We found that maven-decoder-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.