# jar-analyzer/jar-analyzer

Jar Analyzer - 一个 JAR 包 GUI 分析工具，内置 AI 助手协助分析，支持 JAR DIFF 分析，方法调用关系搜索，方法调用链 DFS 算法分析，模拟 JVM 的污点分析验证 DFS 结果，字符串搜索，Java Web 组件入口分析，CFG 程序分析，JVM 栈帧分析，自定义表达式搜索等

Repository: https://github.com/jar-analyzer/jar-analyzer
Canonical: https://ross.abutalabs.com/products/jar-analyzer
Homepage: https://jar-analyzer.github.io
Language: Java
License: GPL-3.0
License Family: copyleft
Topics: java-asm, java-decompiler, static-analysis, vulnerability, jar, java-bytecode, java-gui, program-analysis, bytecode, java-debugger, java-security, java-vulnerability, web-vulnerability
Last push: 2026-08-26T16:58:29+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 99, longevity 75
- inputs: {"age_days": 1061, "days_push": 7, "days_rel": 7, "gap_med": 20.0, "n_releases_24m": 33}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2158, forks 202 (observed 2026-08-28T04:06:19.861124+00:00)

## What it is
A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysis, CFG and JVM stack frame inspection, string search, and JAR diff. It also includes a built-in AI assistant and MCP service for hybrid manual/AI-assisted analysis.

## Use cases
- analyze java jar file call chains
- find method call relationships in a jar
- static analysis of java bytecode for vulnerabilities
- diff two jar versions
- search strings inside java jars
- analyze java web component entry points
- build call graph and cfg for java methods
- taint analysis to find gadget chains

## When to choose
- you need precise, reproducible static analysis of large Java codebases that exceeds LLM context windows
- you must keep proprietary code local and offline
- you want interactive GUI exploration of call chains, CFGs, and stack frames
- you are doing Java security auditing or vulnerability research

## When to avoid
- you need dynamic runtime debugging rather than static analysis
- your target is not Java/JVM bytecode
- you prefer a headless CLI-only pipeline without a GUI

## Facets
- artifact type: application
- maturity: active
- function: reverse-engineering, security, gui, search-engine, mcp
- domain: security, reverse-engineering, developer-tools
- platform: cross-platform, jvm, cli
- tags: jar-analysis, static-analysis, bytecode-analysis, call-graph, taint-analysis, vulnerability-research, java-security, decompiler, cfg, ai-assistant, java, desktop

## Member repositories
- jar-analyzer/jar-analyzer (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:19.861124+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:50:22.528020+00:00, confidence not recorded.
  - readme: https://github.com/jar-analyzer/jar-analyzer (fetched 2026-08-28T04:06:19.861124+00:00, sha 3d3f5514f665)
  - homepage: https://jar-analyzer.github.io (fetched 2026-08-29T10:30:16.565856+00:00, sha 96d6df5718ea)
- Data as of 2026-08-30T08:39:29.467469+00:00.