Android MCP Server

Findings (21)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.27.1: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.4: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.12.8: 32 known vulnerabilities

  GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-54fx-42gc-7vw4 +27 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.1.0: 6 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.11: 3 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.3.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.3: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.8: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.33.5: 3 known vulnerabilities

  GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.0.0: 10 known vulnerabilities

  GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +5 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.3.6: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.11: 3 known vulnerabilities

  GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @humanfs/node@0.16.7: 1 known vulnerability

  GHSA-p498-v437-472g

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.0: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.4: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.0: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.0: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json

Network activity

Tools exposed (25)

• list_devices

  List connected Android devices and emulators

• list_avds

  List available Android Virtual Devices

• start_emulator

  Start an Android emulator. Waits up to 60s for it to come online.

• screenshot

  Take a screenshot of the Android device. Returns the image for visual analysis. Optionally saves to a file path.

• get_ui_tree

  Get the UI element hierarchy of the current screen. Returns interactive elements with their bounds, text, resource IDs, and state. Use this to find elements before tapping.

• tap

  Tap at specific screen coordinates

• tap_element

  Tap a UI element by its resource-id, text, or content-desc. Finds the element in the UI tree and taps its center.

• tap_and_wait

  Tap element then wait for UI to settle and return the new UI tree. Combines tap + wait + get_ui_tree into a single fast operation.

• type_text

  Type text into the currently focused input field

• press_key

  Press a hardware/software key

• swipe

  Perform a swipe gesture on the screen

• long_press

  Long press at screen coordinates. Useful for context menus, drag handles, and press-and-hold interactions.

• double_tap

  Double tap at screen coordinates. Useful for zoom-in gestures and double-tap interactions.

• multi_tap

  Tap at the same coordinates multiple times with a fixed interval. Use for spam-tapping, incrementing counters, or testing rapid repeat actions.

• tap_sequence

  Execute a multi-step action sequence. Supports taps, waits, text input, key presses, and swipes in any order.

• scroll_to_element

  Scroll down repeatedly until an element matching the given criteria is visible

• wait_for_element

  Wait for a UI element to appear on screen. Polls every 500ms.

• launch_app

  Launch an Android app by package name

• install_apk

  Install an APK file on the device

• get_current_activity

  Get the currently displayed app and activity

• adb_shell

  Run an arbitrary ADB shell command

• get_logs

  Get device logcat output. Use to find crashes, exceptions, and errors after reproducing a bug.

• clear_logs

  Clear the logcat buffer. Call this before reproducing a bug to get clean logs.

• get_device_info

  Get device details: model, manufacturer, Android version, API level, screen size, and DPI.

• pull_file

  Pull a file from the Android device to the local filesystem.