---
title: "any Android app on your phone is now an open book for Claude Code the stack: Cla"
url: "https://reamcp.dev/en/cases/any-android-app-on-your-phone-is-now-an-open-book-for-claude-3a8bba"
source: "https://x.com/i/status/2114331490217591220"
source_type: "x"
author: "Theo Vance"
author_handle: "TheoVanceln"
stars: 0
category: "App feature recreation"
categories: ["app-recreation"]
tags: ["android", "apk", "claude-code", "jadx", "mcp", "reverse-engineering"]
added: "2026-10-29T02:26:24.603Z"
updated: "2026-10-29T02:26:24.612Z"
locale: "en"
content_locale: "en"
---

# any Android app on your phone is now an open book for Claude Code the stack: Cla

X post describing a Claude Code → REA (MCP) → headless JADX workflow for mapping an Android APK, tracing a feature, writing SPEC.md from observed behaviour and rebuilding the app, with setup steps and caveats about R8 obfuscation and native libraries.

## Description

any Android app on your phone is now an open book for Claude Code

the stack: Claude Code → REA (MCP) → headless JADX

apk → map → trace → spec → build

step 1 → npx rea-agents setup
step 2 → full JDK 17+ and the pinned JADX 0.7.1 jar. this is where most setups die
step 3 → map the manifest, entry points and DEX before reading any method
step 4 → investigate_feature walks UI → handler → the one method that does the work
step 5 → SPEC.md from behavior only, build your version in a fresh session

the big mistake: reading class names. R8 turns them into a.b.c. anchor on strings, resource ids, framework calls

the limit: logic hidden in native .so files or packers won't come back as clean Java. and it's static only, no running or patching

save this before you pick your first APK

## Original README

any Android app on your phone is now an open book for Claude Code

the stack: Claude Code → REA (MCP) → headless JADX

apk → map → trace → spec → build

step 1 → npx rea-agents setup
step 2 → full JDK 17+ and the pinned JADX 0.7.1 jar. this is where most setups die
step 3 → map the manifest, entry points and DEX before reading any method
step 4 → investigate_feature walks UI → handler → the one method that does the work
step 5 → SPEC.md from behavior only, build your version in a fresh session

the big mistake: reading class names. R8 turns them into a.b.c. anchor on strings, resource ids, framework calls

the limit: logic hidden in native .so files or packers won't come back as clean Java. and it's static only, no running or patching

save this before you pick your first APK