Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hqkh4nh/dejared-mcp --skill jar-analysisgit clone --depth 1 https://github.com/hqkh4nh/dejared-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis)<a href="https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis"><img src="https://agentmods.dev/badge/skills/hqkh4nh/dejared-mcp/jar-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hqkh4nh/dejared-mcp/jar-analysis"><img src="https://agentmods.dev/badge/skills/hqkh4nh/dejared-mcp/jar-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00221 | $0.01286 |
| Opus 5 | $0.00111 | $0.00643 |
| Sonnet 5 | $0.00044 | $0.00257 |
| Haiku 4.5 | $0.00022 | $0.00129 |
Grade A, and why
jar-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
JAR Analysis
When This Skill Applies
Reach for these tools, never the shell, whenever the task touches the inside of a Java artifact:
| You would reach for... | Use this instead |
|---|---|
jar tf some.jar |
dejared_list_packages / dejared_list_classes |
jar tf some.jar | grep -v .class |
dejared_list_resources |
unzip -p some.jar application.yml |
dejared_read_resource |
jar tf some.jar | grep -i FooBar |
dejared_search_class |
strings some.jar | grep http |
dejared_search_string |
javap -p com.foo.Bar |
dejared_get_metadata |
javap -p across a package |
dejared_dump_package_metadata |
| Running CFR / Vineflower / Procyon manually | dejared_decompile_class |
Applies to .jar, .war, .ear, .aar and any artifact under ~/.m2/repository, ~/.gradle/caches, build/libs/, target/, lib/, or libs/. All calls need an absolute path to the archive.
Available Tools
| Tool | Cost | Purpose |
|---|---|---|
dejared_list_packages |
Cheap | List all packages with class counts |
dejared_list_classes |
Cheap | List classes in a package (recursive=true for sub-packages) |
dejared_list_resources |
Cheap | List all non-class resource files with sizes |
dejared_read_resource |
Cheap | Read a text resource file from inside a JAR (content-based detection, no extension restrictions) |
dejared_dump_package_metadata |
Cheap | Batch metadata for multiple packages at once (annotations, fields, methods via ASM) |
dejared_get_metadata |
Cheap | Single class metadata (ASM-based, no decompilation) |
dejared_search_class |
Cheap | Find classes by name keyword (case-insensitive) |
dejared_search_string |
Cheap | Find string literals in bytecode constant pools (case-insensitive) |
dejared_decompile_class |
Expensive | Full source code decompilation (CFR/vineflower/procyon) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 82 lines · 221 tokens per session scan A 8a465818dc7c
jar-analysis is a skill published in the GitHub repository hqkh4nh/dejared-mcp (5 stars, last pushed 20d ago), licensed MIT. It adds 221 tokens to every session and 1,286 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kmp-lsp
Kotlin/Java/Swift LSP server for code navigation in Android and iOS codebases. Use when navigating Kotlin, Java, or Swift source files: finding class definitions, listing symbols, jumping to implementations, finding all usages, checking type signatures, or switching workspace between projects. Triggers for: "find this…
maven-code-search
Use the Maven Decoder MCP server to inspect code, APIs, methods, dependencies, versions, and usage examples from Maven artifacts, both those installed in the user's local /.m2 repository and those published on Maven Central. Use when working on Java, Maven, Gradle, Spring, Jakarta, Android, or JVM projects and the…
jna-native-binding-traps
Hand-writing a JVM binding for a C library with JNA (Java Native Access) — the open-flags option that means something else on Windows, structs read by raw offset, callbacks the binding holds weakly, search paths registered too late, and proving which file was actually opened. Reach for it when a binding works on every…
desktop-deep-link-plumbing
Wiring a custom URL scheme end to end on a JVM desktop app — per-OS registration, the argument filter at startup, single-instance forwarding, and delivering a callback's token to app state. Reach for it when clicking a link or returning from a browser redirect merely brings the app to the front and the flow it was…
jvm-desktop-memory-footprint
Judge and reduce a desktop JVM application's memory honestly — read the heap-to-footprint ratio rather than the resident figure, run the one experiment that separates a leak from an allocator holding idle pages, and understand why per-thread allocator arenas make the footprint depend on the user's core count. Use when…
java-kotlin
Java and Kotlin programming patterns.