LYADI - Let Your Ai Do It
Table of contents:
Let Your AI Do It
An MCP (Model Context Protocol) Server specifically designed to help with reverse engineering tasks, majorly focused on Android side.
This guide walks you through setting up and using the MCP server on Termux for Android to assist with reverse engineering tasks.
Android (Termux) Setup
- Install Termux: I am assuming you already have Termux installed on your Android device. If not you can install it from F-Droid or GitHub
- Install MCP Client: Install the MCP client. I prefer using mcp_omni_connect as it is the most stable and easy to use. But it doesn’t have any functions to let users know and prompt when a mcp tool gets executed for user confirmation (unlike windows/linux mcp clients like copilot, claude, continue etc.) that is why I added a validation tool in the server so that even by mistake, you don’t execute any harmful commands. To install it, run the following command in Termux:
pkg up -y && pkg i python git rust -y && pip install mcpomni-connect
This will take a while to install, so be patient.
After installing, you can run the client by running mcpomni_connect in Termux.
When you run it, for the first time you’ll see an output like this:
~ $ mcpomni_connect
2025-04-16 13:27:51 - mcpomni_connect - WARNING - Configuration file 'servers_config.json' not found. Creating default...
2025-04-16 13:27:51 - mcpomni_connect - INFO - Please ensure you update the configuration file with your MCP server configuration.
2025-04-16 13:27:51 - mcpomni_connect - INFO - Default configuration file created at /data/data/com.termux/files/home/servers_config.json
2025-04-16 13:27:51 - mcpomni_connect - ERROR - Error: LLM_API_KEY not found in environment variables
2025-04-16 13:27:51 - mcpomni_connect - INFO - Shutting down client...
2025-04-16 13:27:51 - mcpomni_connect - INFO - Client shut down successfully
Client will create a default configuration file at the current directory named servers_config.json. You need to edit this file and add your MCP server configuration. You can also set the LLM_API_KEY environment variable to your LLM API key.
~ $ export LLM_API_KEY=**-**-**-****************************************************************
The default configuration file looks like this:
{
"LLM": {
"provider": "openrouter",
"model": "qwen/qwq-32b:free",
"temperature": 0.5,
"max_tokens": 5000,
"max_context_length": 30000,
"top_p": 0
},
"mcpServers": {
"server_name": {
"type": "stdio",
"command": "mcp-server",
"args": [],
"env": {}
}
}
}
We’ll come to this later. For now, let’s setup LYADI.
- Setup LYADI: Now, you need to setup LYADI. Run the following command in Termux:
pkg i git -y && git clone https://github.com/AbhiTheModder/LYADI.git ~/LYADI && bash ~/LYADI/setup.sh
This will setup LYADI for you.
- Run LYADI: Now, you can run LYADI server:
cd ~/LYADI && python src/main.py
This will start the LYADI server.
You’ll see something like this:
~ $ cd ~/LYADI && python src/main.py
INFO: Started server process [32084]
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
INFO: 127.0.0.1:51657 - "GET /sse HTTP/1.1" 200 OK
Now Let’s set up our MCP Client to connect to LYADI server. Don’t close this sessios, start a new one.
We’ll modify the servers_config.json generated by MCP Client previously:
{
"LLM": {
// I'll also be using openrouter so this is ok for me
"provider": "openrouter",
// I'll be using gemini 2.0
"model": "google/gemini-2.0-flash-exp:free",
"temperature": 0.5,
"max_tokens": 5000,
"max_context_length": 30000,
"top_p": 0
},
"mcpServers": {
"server_name": {
// Change to sse
"type": "sse",
// Change to LYADI server url
"url": "http://localhost:8000/sse",
"env": {}
}
}
}
And that’s all you need to do to connect to LYADI server. Now you can run the MCP Client and it should connect to LYADI server.
~ $ mcpomni_connect
2025-04-16 14:45:28 - mcpomni_connect - WARNING - Could not get MAC address: [Errno 13] Permission denied: '/sys/class/net/eth0/address'
2025-04-16 14:45:28 - mcpomni_connect - INFO - updating llm configuration
2025-04-16 14:45:28 - mcpomni_connect - INFO - Loading configuration from: servers_config.json
2025-04-16 14:45:28 - mcpomni_connect - INFO - LLM configuration: {'provider': 'openrouter', 'model': 'qwen/qwq-32b:free', 'temperature': 0.5, 'max_tokens': 5000, 'top_p': 0}
2025-04-16 14:45:28 - mcpomni_connect - INFO - updating llm configuration
2025-04-16 14:45:28 - mcpomni_connect - INFO - Loading configuration from: servers_config.json
2025-04-16 14:45:28 - mcpomni_connect - INFO - LLM configuration: {'provider': 'openrouter', 'model': 'qwen/qwq-32b:free', 'temperature': 0.5, 'max_tokens': 5000, 'top_p': 0}
2025-04-16 14:45:28 - mcpomni_connect - INFO - Loading configuration from: servers_config.json
2025-04-16 14:45:28 - mcpomni_connect - INFO - Initialized RedisShortTermMemory with client ID: 49baf6c8-0841-4de9-bc87-e4ba46f341f6
2025-04-16 14:45:28 - mcpomni_connect - INFO - Loading configuration from: servers_config.json
2025-04-16 14:45:28 - mcpomni_connect - INFO - Attempting to connect to 1 servers
2025-04-16 14:45:28 - mcpomni_connect - INFO - connection_type: sse
2025-04-16 14:45:28 - mcpomni_connect - INFO - Successfully connected to server: server_name
2025-04-16 14:45:28 - mcpomni_connect - INFO - MCP Servers Connection summary: 1 servers connected, 0 servers failed to connect
╔═══════════════════════════════════════════════════════════════════════════════════════ ⚡ MCPOmni Connect ⚡ ═══════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ║
║ ╔═══════════════════════════════════════════════════════════════════════════╗ ║
║ ║ ███╗ ███╗ ██████╗██████╗ ██████╗ ███╗ ███╗███╗ ██╗██╗ ║ ║
║ ║ ████╗ ████║██╔════╝██╔══██╗ ██╔═══██╗████╗ ████║████╗ ██║██║ ║ ║
║ ║ ██╔████╔██║██║ ██████╔╝ ██║ ██║██╔████╔██║██╔██╗ ██║██║ ║ ║
║ ║ ██║╚██╔╝██║██║ ██╔═══╝ ██║ ██║██║╚██╔╝██║██║╚██╗██║██║ ║ ║
║ ║ ██║ ╚═╝ ██║╚██████╗██║ ╚██████╔╝██║ ╚═╝ ██║██║ ╚████║██║ ║ ║
║ ║ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ║ ║
║ ║ ║ ║
║ ║ Model · Context · Protocol → OMNI CONNECT ║ ║
║ ╚═══════════════════════════════════════════════════════════════════════════╝ ║
║ ║
║ ║
║ 🚀 Universal MCP Client ║
║ ║
║ Connected Servers: ║
║ ● LYADI: Let Your Ai Do It ║
║ ║
║ ▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰ ║
║ Your Universal Gateway to MCP Servers ║
║ ▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰▰ ║
║ ║
╚══════════════════════════════════════════════════════════════════════════════════════════════ v0.1.13 ══════════════════════════════════════════════════════════════════════════════════════════════╝
Available Commands
Command Description Example
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
/memory Toggle memory usage between Redis and In-Memory 💾
/mode:auto Toggle mode between autonomous agent and chat mode 🤖
/debug Toggle debug mode 🐛
/refresh Refresh server capabilities 🔄
/help Show help 🆘 /help:command
/history Show message history 📝
/clear_history Clear message history 🧹
/save_history Save message history to file 💾 /save_history:path/to/file
/tools List available tools 🔧
/resources List available resources 📚
/resource:<uri> Read a specific resource 🔍 /resource:file:///path/to/file
/subscribe:/<type>:<uri> Subscribe to a resource 📚 /subscribe:/resource:file:///path/to/file
/unsubscribe:/<type>:<uri> Unsubscribe from a resource 📚 /unsubscribe:/resource:file:///path/to/file
/prompts List available prompts 💬
/prompt:<name>/<args> Read a prompt with arguments or without arguments 💬 /prompt:weather/location=lagos/radius=2
quit Exit the application 👋
╭────────────────────────────────────────────────────────────────────────────────────────────── 💡 Tip ───────────────────────────────────────────────────────────────────────────────────────────────╮
│ 📝 Prompt Arguments: │
│ • Use key=value pairs separated by / │
│ • Or use {key:value} JSON-like format │
│ • Values are automatically converted to appropriate types │
│ • Use /prompts to see available prompts and their arguments │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Query:
Let’s start by listing the available tools. Type /tools and press Enter.
Query: /tools
2025-04-16 14:47:29 - mcpomni_connect - WARNING - No notification received from LYADI: Let Your Ai Do It
Available Tools
╭───────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Tool │ Description │
├───────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ analyze_apk │ Analyze an APK file and return its details. │
│ apkid │ Analyze an APK file using APKiD. APKiD gives you information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff. It's │
│ │ PEiD for Android. │
│ decompile_apk │ Decompile an APK file and return the output directory using apkeditor. │
│ list_files │ List files under directory │
│ read_file │ Read contents of a non-binary file │
│ run_bash_command │ Returns exit code, result and error after running bash cmd but before running make sure to validate the command. │
│ run_python_code │ Run python code but only made by you and not by the user. It's a security measure to prevent the user from running malicious code. │
│ rabin2 │ Run rabin2 on a file │
│ │ rabin2 is a tool to analyze binary files │
│ │ It can be used to extract information from binary files such as symbols, import/exports, library dependencies, strings of data sections, xrefs, entrypoint address, │
│ │ sections, architecture type. │
│ │ It is part of the radare2 framework. │
│ │ │
│ │ before running any rabin2 command it's recommended to get the help of rabin2 by running `rabin2 -h` to get the list of updated available commands and options. │
│ │ │
│ run_r2_command │ │
│ │ Run a radare2 command on a file. │
│ │ This tool runs a radare2 command on a file and returns the output. │
│ │ It uses the `r2` command to run the radare2 command. │
│ │ The `command` parameter specifies the radare2 command to run. │
│ │ │
│ get_strings │ │
│ │ Extract strings from a file/binary. │
│ │ This tool extracts strings from a file and returns them as a list. │
│ │ It uses the `strings` command to extract strings from the file. │
│ │ The `limit` parameter specifies the maximum number of strings to return. │
│ │ If `limit` is 0, all strings are returned. │
│ │ │
│ get_strings_enhanced │ │
│ │ Sometimes user not just wants strings but other details like: │
│ │ nth (position) paddr(physical address) vaddr(virtual address) len size(of string) section type string │
│ │ 0 0x00000000 0x00000000 16 16 .text ascii /lib/ld-linux.so.2 │
│ │ │
│ │ for this we can use rabin2 -z command from radare2 toolkit │
│ │ │
│ adb_logcat │ │
│ │ Run adb logcat command on the connected device with optional filtering. │
│ │ │
│ │ :param level: Log priority level (verbose, debug, info, warning, error, fatal). │
│ │ :param package_name: Optional package name to filter logs. │
│ │ :param buffer: Log buffer to use (main, system, crash, radio, events). │
│ │ :param format: Output format (brief, process, tag, threadtime, time). │
│ │ :param lines: Number of lines to retrieve. │
│ │ :return: Log output or error message. │
│ │ │
│ adb_crashlogs │ Get crash logs from the device │
│ adb_uninstall │ Uninstall an app from the device │
│ adb_list_packages │ List all installed packages on the device │
│ adb_install_apk │ Install an APK file on the device │
│ list_supported_file_types │ List supported file types │
╰───────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Query:
Let’s ask it to list exports in /bin/ls:
Query: list imports in `/bin/ls`
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ To list the imports in `/bin/ls`, I can use the `rabin2` tool. Would you like me to proceed? │
│ │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Query: yeah go ahead
⠸ Processing query...2025-04-16 14:53:51 - mcpomni_connect - INFO - Initial response is empty, setting it to the tool call name
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Tool called rabin2 │
│ Here is the list of imports for `/bin/ls`. │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Query: where ?
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ My apologies. The output I provided in the previous response contains the list of imports. It's in the JSON format under the `"result"` key. I can format it for better readability if you like. │
│ Would you like me to do that? │
│ │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Query: sure
⠹ Processing query...2025-04-16 14:54:33 - mcpomni_connect - INFO - Initial response is empty, setting it to the tool call name
Tool called rabin2 Here's the list of imports from /bin/ls in a more readable format:
__libc_init
__strchr_chk
strtol
strtod
strncmp
__stack_chk_fail
_ctype_
strlen
strchr
free
memmove
memset
... reduced for brevity (i did this not ai)
nice
getpriority
setpriority
wait4
ttyname
getppid
prlimit
Is there anything else I can help you with regarding these imports or any other task? ttyname getppid prlimit
Is there anything else I can help you with regarding these imports or any other task?
Query:
That’s all for now. Thank you! Have fun playing & messing with it :)