Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hqkh4nh/dejared-mcp --skill jar-analysisgit clone --depth 1 https://github.com/hqkh4nh/dejared-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis)<a href="https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis"><img src="https://agentmods.dev/badge/skills/hqkh4nh/dejared-mcp/jar-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis"><img src="https://agentmods.dev/badge/skills/hqkh4nh/dejared-mcp/jar-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00221 | $0.01286 |
| Opus 5.5 | $0.00088 | $0.00514 |
| Sonnet 5.5 | $0.00044 | $0.00257 |
| Haiku 4.5 | $0.00022 | $0.00129 |
Grade A, and why
jar-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
JAR Analysis
When This Skill Applies
Reach for these tools, never the shell, whenever the task touches the inside of a Java artifact:
| You would reach for... | Use this instead |
|---|---|
jar tf some.jar |
dejared_list_packages / dejared_list_classes |
jar tf some.jar | grep -v .class |
dejared_list_resources |
unzip -p some.jar application.yml |
dejared_read_resource |
jar tf some.jar | grep -i FooBar |
dejared_search_class |
strings some.jar | grep http |
dejared_search_string |
javap -p com.foo.Bar |
dejared_get_metadata |
javap -p across a package |
dejared_dump_package_metadata |
| Running CFR / Vineflower / Procyon manually | dejared_decompile_class |
Applies to .jar, .war, .ear, .aar and any artifact under ~/.m2/repository, ~/.gradle/caches, build/libs/, target/, lib/, or libs/. All calls need an absolute path to the archive.
Available Tools
| Tool | Cost | Purpose |
|---|---|---|
dejared_list_packages |
Cheap | List all packages with class counts |
dejared_list_classes |
Cheap | List classes in a package (recursive=true for sub-packages) |
dejared_list_resources |
Cheap | List all non-class resource files with sizes |
dejared_read_resource |
Cheap | Read a text resource file from inside a JAR (content-based detection, no extension restrictions) |
dejared_dump_package_metadata |
Cheap | Batch metadata for multiple packages at once (annotations, fields, methods via ASM) |
dejared_get_metadata |
Cheap | Single class metadata (ASM-based, no decompilation) |
dejared_search_class |
Cheap | Find classes by name keyword (case-insensitive) |
dejared_search_string |
Cheap | Find string literals in bytecode constant pools (case-insensitive) |
dejared_decompile_class |
Expensive | Full source code decompilation (CFR/vineflower/procyon) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 82 lines · 221 tokens per session scan A 8a465818dc7c
jar-analysis is a skill published in the GitHub repository hqkh4nh/dejared-mcp (7 stars, last pushed 2mo ago), licensed MIT. It adds 221 tokens to every session and 1,286 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kmp-lsp
Kotlin/Java/Swift LSP server for code navigation in Android and iOS codebases. Use when navigating Kotlin, Java, or Swift source files: finding class definitions, listing symbols, jumping to implementations, finding all usages, checking type signatures, or switching workspace between projects. Triggers for: "find this…
desktop-and-build-footguns
Desktop JVM and build traps: JNA natives, bundling, memory, packaging, code signing, R8, deep links, Gradle and CI releases. Use when a desktop build fails packaged, signed, on another OS or arch, or in CI.
maven-code-search
Use the Maven Decoder MCP server to inspect code, APIs, methods, dependencies, versions, and usage examples from Maven artifacts, both those installed in the user's local /.m2 repository and those published on Maven Central. Use when working on Java, Maven, Gradle, Spring, Jakarta, Android, or JVM projects and the…
java-kotlin
Java and Kotlin programming patterns.
gradle-groovy
Expert guidance on writing and maintaining Android Gradle build files in Groovy DSL for a Java project — product flavors, signing configs, build types, and dependency management. Use this when configuring build.gradle for new modules or flavors.
java-mvvm
Expert guidance on implementing MVVM in Java using Jetpack ViewModel and LiveData with unidirectional data flow. Use this when building screens, wiring Fragments/Activities to state holders, or reviewing MVVM code in Java.