DeepADB
MCP (Model Context Protocol) server providing full Android Debug Bridge (ADB) integration for AI agents. Enables MCP clients to directly interact with connected Android devices — inspecting state, running commands, managing apps, capturing logs, controlling device settings, analyzing UI hierarchies, recording screens, managing emulators, running structured test sessions, orchestrating multi-device operations, capturing network traffic, running CI pipelines, auditing accessibility, detecting performance regressions, executing cloud device farm tests, debugging over WiFi, building projects, and managing community plugins.
204 tools, 5 resources, and 4 prompts across 45 modules — the most comprehensive ADB MCP server available, with triple transport (stdio + HTTP/SSE + WebSocket), optional GraphQL API, defense-in-depth security, modem firmware analysis, workflow marketplace, AT command interface with multi-chipset support, RIL message interception, device profiling, baseband/modem integration, automated test generation, OTA update monitoring, SELinux auditing, thermal/power profiling, network device discovery, visual regression detection, workflow orchestration, accessibility auditing, and contextual truncation.
Architecture
┌──────────────────────────────────────────────────┐
│ MCP Client │
│ (Claude Code / claude.ai) │
└──────────────────────┬───────────────────────────┘
│ stdio (JSON-RPC) or HTTP/SSE or WebSocket
┌──────────────────────▼───────────────────────────┐
│ DeepADB Server │
│ │
│ ┌─────────────────────────────────────────────┐ │
│ │ Tool Modules (45) │ │
│ │ device │ shell │ packages │ files │ logs │ │
│ │ diagnostics │ ui │ build │ health │ │
│ │ wireless │ control │ logcat-watch │ │
│ │ forwarding │ screen-record │ emulator │ │
│ │ testing │ multi-device │ snapshot │ │
│ │ network-capture │ ci │ plugins │ baseband │ │
│ │ accessibility │ regression │ │
│ │ device-farm │ registry │ at-commands │ │
│ │ screenshot-diff │ workflow │ sensors │ │
│ │ split-apk │ mirroring │ test-gen │ │
│ │ ota-monitor │ ril-intercept │ │
│ │ device-profiles │ firmware-analysis │ │
│ │ workflow-market │ selinux-audit │ │
│ │ thermal-power │ network-discovery │ │
│ │ input-gestures │ wireless-firmware │ │
│ ├─────────────────────────────────────────────┤ │
│ │ Resources (5) │ Prompts (4) │ │
│ └───────────────────┬─────────────────────────┘ │
│ │ │
│ ┌───────────────────▼─────────────────────────┐ │
│ │ ToolContext (unified DI) │ │
│ │ server │ bridge │ deviceManager │ │
│ │ logger │ security │ config │ │
│ └───────────────────┬─────────────────────────┘ │
│ │ │
│ ┌───────────────────▼─────────────────────────┐ │
│ │ Middleware Layer │ │
│ │ OutputProcessor │ SecurityMiddleware │ │
│ │ InputSanitizer │ Logger (stderr-safe) │ │
│ └───────────────────┬─────────────────────────┘ │
│ │ │
│ ┌───────────────────▼─────────────────────────┐ │
│ │ Bridge Layer (auto-detect) │ │
│ │ │ │
│ │ ┌─────────────┐ ┌────────────────────┐ │ │
│ │ │ ADB Bridge │ OR │ Local Bridge │ │ │
│ │ │ (PC mode) │ │ (on-device mode) │ │ │
│ │ │ via adb.exe │ │ via sh/su direct │ │ │
│ │ └──────┬───────┘ └────────┬───────────┘ │ │
│ │ │ │ │ │
│ │ Retry │ Timeout │ Cache │ Serial routing │ │
│ └─────────┼─────────────────────┼─────────────┘ │
└────────────┼─────────────────────┼───────────────┘
│ │
┌───────▼───────┐ ┌───────▼───────┐
│ ADB Binary │ │ sh / su │
│ (USB/WiFi) │ │ (local) │
└───────┬───────┘ └───────┬───────┘
│ │
┌─────▼────────────────────▼─────┐
│ Android Device │
└────────────────────────────────┘
Dual-Mode Architecture
DeepADB operates in two modes, auto-detected at startup:
ADB Mode (default) — PC-side bridge
AI Agent (PC) ←→ MCP ←→ DeepADB (PC) ←→ ADB (USB) ←→ Android Device
Standard mode: DeepADB runs on a PC/Mac/Linux host and communicates with the device over USB via ADB. All 204 tools work through the ADB bridge with automatic retry on transient failures.
On-Device Mode — direct local execution
AI Agent (Termux) ←→ MCP (stdio/HTTP) ←→ DeepADB (Termux) ←→ sh/su (local)
When DeepADB runs directly on the Android device (e.g., inside Termux), it auto-detects the environment and switches to LocalBridge. Commands execute directly via sh/su — no ADB server, no USB, no serialization overhead. All 204 tools work identically, with significantly lower latency.
Validated on hardware (Pixel 6a, Android 16, Termux + Magisk + QEMU 10.2.1) across a four-cell test matrix — host (ADB) and on-device (LocalBridge), each with and without a device PIN — with 0 failures in every cell. The full suite is 577 tests in the host/ADB configuration and 613 on-device; the difference is the QEMU virtualization and Alpine VM-boot suites, which run only on-device:
- ADB mode, no PIN: 556 passed / 0 failed / 21 skipped (577 total). Skips: 5 QEMU (on-device only), 7 gracefulKill unit tests (require POSIX signals, skipped on the Windows host), 3 tcpdump sanitization (tcpdump is root-only and unreachable over a non-root ADB shell), 2 host-shell round-trips (require a POSIX /bin/sh), 4 screen-state (require DA_TEST_PIN).
- ADB mode, with PIN: 560 passed / 0 failed / 17 skipped (577 total). The 4 screen-state tests unlock and run.
- On-device mode, no PIN: 606 passed / 0 failed / 7 skipped (613 total). All QEMU tests run, including Alpine Linux VM boot with KVM acceleration, big.LITTLE CPU topology detection, guest ADB connectivity error handling, and clean VM shutdown; the tcpdump and gracefulKill suites also run here (root + POSIX). Skips: 3 QEMU setup steps that no-op when the Alpine kernel/initrd/disk are already cached, 4 screen-state (require PIN).
- On-device mode, with PIN: 610 passed / 0 failed / 3 skipped (613 total). Every test enabled by the environment runs; the 3 skips are the cached-VM setup steps.
Privilege escalation: In ADB mode, all shell commands run as uid=2000 (the shell user) which has system-level permissions. In Termux, commands run as a regular app user. LocalBridge automatically elevates privileged commands through su when root (Magisk) is available:
- Command allowlist: 16 system commands (
settings,dumpsys,am,input,screencap,screenrecord,uiautomator,app_process,getenforce,setenforce,cmd,pm,wm,svc,ip,ifconfig) are routed throughsu -cto match ADB-mode behavior. - Path-based elevation: Commands referencing
/sdcard,/storage, or/system/paths are elevated to bypass Android scoped storage restrictions. - Root detection: Cached after a single
su -c idprobe at first use. Graceful degradation when root is unavailable. - The elevation allowlist is frozen (
ReadonlySet+Object.freeze) — not configurable via environment variables or runtime API.
Auto-detection: Checks for /system/build.prop (present on all Android devices, never on hosts). Override with DA_LOCAL=true or DA_LOCAL=false.
On-device setup (Termux):
pkg install nodejs-lts git
git clone <deepadb-repo> && cd deepadb
npm install && npm run build
npm start # stdio — for local AI agents (Claude Code, OpenCode)
DA_HTTP_PORT=3000 npm start # HTTP/SSE — for remote AI access over WiFi
Quick Start
npm install
npm run build
npm run inspector # Test with MCP Inspector
npm start # Run directly (stdio mode)
# HTTP/SSE mode for browser-based clients
DA_HTTP_PORT=3000 npm start
# WebSocket mode (requires: npm install ws)
DA_WS_PORT=3001 npm start
# GraphQL API (requires: npm install graphql) — runs alongside any transport
DA_GRAPHQL_PORT=4000 npm start
Claude Code Configuration
{
"mcpServers": {
"deepadb": {
"command": "node",
"args": ["/path/to/DeepADB/build/index.js"]
}
}
}
Available Tools (204)
Health (1 tool)
adb_health_check— Comprehensive toolchain validation: ADB binary, server, device connection, authorization, root access, and storage writability
Device (3 tools)
adb_devices— List all connected devices with state, model, and product infoadb_device_info— Detailed device properties (model, OS, SDK, build, security patch, ABI)adb_getprop— Read a specific system property or dump all properties
Shell (2 tools)
adb_shell— Execute arbitrary shell commands with configurable timeout (security-checked)adb_root_shell— Execute commands as root via su (requires rooted device, security-checked)
Packages (12 tools)
adb_install— Install APK with replace/downgrade optionsadb_uninstall— Remove package with optional data retentionadb_list_packages— List packages filtered by name or type (all/system/third-party)adb_package_info— Detailed package info (version, permissions, paths)adb_clear_data— Clear all app data and cacheadb_grant_permission— Grant a runtime permission to a packageadb_revoke_permission— Revoke a runtime permission from a package (reset permission state for testing denial flows)adb_list_permissions— List all declared and granted permissions for a package, filterable by granted/deniedadb_force_stop— Force-stop an app immediatelyadb_start_app— Launch an app by package name (resolves launcher activity)adb_restart_app— Force-stop then re-launch in one call (configurable delay)adb_resolve_intents— Discover registered activities, services, and receivers with intent filters
Files (18 tools)
adb_push— Push local file to device (hard-blocked kernel paths, fs-type awareness, storage reporting)adb_pull— Pull file from device to local filesystemadb_ls— List device directory contents (simple or detailed)adb_cat— Read text file from device with optional line limitadb_file_write— Create or overwrite text files via heredoc (buffer limit warning, fs-aware, post-verify)adb_find— Search for files by name/pattern with depth control and result cappingadb_file_stat— File metadata: size, permissions, timestamps, ownership, SELinux contextadb_file_checksum— SHA-256/SHA-1/MD5 hash with size-based timeout estimationadb_mkdir— Create directories with parent creation (-p), hard-blocked kernel pathsadb_rm— Delete files/directories with depth-based recursive protection and symlink resolutionadb_file_move— Move/rename with source depth protection and post-verifyadb_file_copy— Copy with pre-flight size+space check and post-verify size matchadb_file_chmod— Change permissions (Zod-validated octal mode, depth-based recursive protection)adb_file_touch— Create empty files or update timestamps (explicit timestamp support)adb_file_fsinfo— Filesystem report: type, mount, capacity, capabilities, SELinux, limitationsadb_file_chown— Change ownership (root required, depth-based recursive protection)adb_grep— Search file contents with fixed-string default, recursive depth control, result cappingadb_file_replace— Find/replace text in files (sed-backed, proper escaping, backup option)
Logs — Snapshots (3 tools)
adb_logcat— Filtered logcat snapshot with tag, priority, grep, and buffer selectionadb_logcat_clear— Clear all logcat buffersadb_logcat_crash— Crash buffer log snapshot
Logs — Persistent Watchers (4 tools)
adb_logcat_start— Start a background logcat watcher with ring buffer accumulationadb_logcat_poll— Retrieve new lines since last poll from a running watcheradb_logcat_stop— Stop a watcher session (or all sessions)adb_logcat_sessions— List all active watcher sessions with stats
Diagnostics (9 tools)
adb_dumpsys— Run dumpsys for any service (or list all services)adb_telephony— Cell info, signal strength, and network registration (parallel query)adb_battery— Battery status, level, temperature, and charging infoadb_network— WiFi, cellular, and IP connectivity (parallel query)adb_top— CPU and memory usage snapshotadb_perf_snapshot— Parallel memory, frame stats, and CPU profiling for a packageadb_bugreport— Full bug report zip capture (device state, logs, system info)adb_crash_logs— ANR traces and tombstone crash dumps from /data/anr/ and /data/tombstones/adb_heap_dump— Capture heap dump (.hprof) from a running process for memory analysis
UI (10 tools)
adb_screencap— Take screenshot with filename sanitization, saves locallyadb_screencap_annotated— Screenshot with UI element bounding boxes and numbered labels composited onto the PNG. Returns annotated image path plus a text legend. Ideal for LLM workflows that reference elements by numberadb_current_activity— Get focused activity and top window stackadb_input— Send tap, swipe, text, or keyevent inputadb_start_activity— Launch activities by intent or component nameadb_ui_dump— Dump full UI hierarchy. Supports three output formats:text(default, human-readable),tsv(compact tab-separated for token-efficient automation loops),xml(raw uiautomator XML)adb_ui_find— Search UI hierarchy by text, resource-id, or content-description (returns tap coordinates)adb_screen_state— Combined screen state in one call: foreground activity, screen dimensions and density, orientation, battery level, and a TSV list of interactive elements. Replaces 3–4 separate tool callsadb_screenrecord_start— Start recording the device screen (1-180s, stored on device)adb_screenrecord_stop— Stop recording and pull the mp4 video file locally
Device Control (9 tools)
adb_airplane_mode— Toggle airplane mode with broadcast and verificationadb_airplane_cycle— Cycle airplane mode on/off to force cellular re-registrationadb_wifi— Enable or disable WiFiadb_mobile_data— Enable or disable mobile dataadb_location— Set location mode (off/sensors/battery/high)adb_screen— Wake, sleep, toggle, lock, or unlock the screen. Lock verifies keyguard state viadumpsys window. Unlock useswm dismiss-keyguard(works for swipe keyguards); supplypinto perform the full PIN entry sequence: wakes screen, swipes up to reveal keypad, types PIN, confirms, and verifies the keyguard sleep token was releasedadb_settings_get— Read any Android setting from system/secure/global namespaceadb_settings_put— Write any Android setting with read-back verificationadb_reboot— Reboot device (normal, recovery, or bootloader mode)
Wireless Debugging (4 tools)
adb_pair— Pair with device over WiFi using pairing codeadb_connect— Connect to device over WiFi/TCPadb_disconnect— Disconnect wireless device(s)adb_tcpip— Switch USB device to TCP/IP mode (auto-detects device IP)
Port Forwarding (8 tools)
adb_forward— Forward a local port to a device port (host → device)adb_reverse— Reverse-forward a device port to the host (device → host)adb_forward_list— List all active forward and reverse port mappingsadb_forward_remove— Remove a port forward or all forwardsadb_reverse_remove— Remove a reverse forward or all reverse forwardsadb_tunnel_open— Open a managed tunnel with opaque ID. Auto-picks a free host port for forward direction when omitted; registers cleanup so the tunnel is removed on server exitadb_tunnel_list— List active managed tunnels (those opened via adb_tunnel_open). Optional device filter; shows ID, direction, endpoints, and ageadb_tunnel_close— Close a managed tunnel by ID, or close all at once with id="all"
Emulator Management (3 tools)
adb_avd_list— List available AVDs (PC mode) or detect KVM/QEMU virtualization capabilities (on-device mode)adb_emulator_start— Launch an AVD with headless, cold boot, and GPU options (PC mode) or report QEMU alternative (on-device mode)adb_emulator_stop— Gracefully shut down a running emulator
QEMU/KVM Virtualization (8 tools)
adb_qemu_setup— Check and install QEMU for on-device virtualization. Verifies KVM, reports host CPU/RAM, installs via Termux pkgadb_qemu_images— Manage VM disk images: list, create (qcow2/raw), delete. Path containment verification prevents traversaladb_qemu_start— Boot a KVM-accelerated VM with dynamic resource allocation. Auto-detects optimal CPUs (total minus 1, reserving one for host) and memory (65% of physical RAM). Supports kernel/initrd/append for Android boot, ADB port forwardingadb_qemu_stop— Stop a running VM (graceful SIGTERM or force SIGKILL). Auto-disconnects guest ADB before killing. Reports running VMs if no name givenadb_qemu_status— Full status: KVM/QEMU availability, host resource budget, running VMs with PID/resources/uptime/ports/ADB connection state, image inventoryadb_qemu_connect— Connect to a running VM's guest ADB service. Restricted to localhost only — port derived from running VM state, never user input. Enables multi-device tools to operate on guest VMsadb_qemu_disconnect— Disconnect from a guest VM's ADB service. Clears connection state and removes guest from device listadb_qemu_guest_shell— Execute shell commands on a guest VM via ADB. Subject to security middleware. Guest serial derived internally — no user-supplied host/IP reaches the ADB binary
Test Sessions (3 tools)
adb_test_session_start— Start a named test session with organized output directoryadb_test_step— Capture a numbered step with screenshot and logcat into the sessionadb_test_session_end— End session, write summary manifest, return directory path
Multi-Device Orchestration (4 tools)
adb_multi_shell— Execute a command on all/selected devices in parallel (security-checked)adb_multi_install— Install an APK across multiple devices simultaneouslyadb_multi_compare— Run a command on all devices and highlight output differencesadb_multi_test— Comparative test workflow: run predefined diagnostic profiles (firmware/security/network/identity/full) or custom command lists across all devices including QEMU guests, compare per-check, report matches and differences
Input Gestures & UI Automation (15 tools)
adb_input_drag— Drag from point A to point B (usesdraganddropwith swipe fallback for older Android)adb_input_fling— High-velocity fling gesture for momentum-scrolling through lists and paged views (configurable duration 20-200ms)adb_input_long_press— Long press at coordinates with configurable hold durationadb_input_double_tap— Double tap with configurable interval between tapsadb_input_text— Dedicated text input with space/special character handlingadb_open_url— Open a URL on the device via VIEW intentadb_orientation— Get or set screen orientation (auto/portrait/landscape/reverse)adb_clipboard— Read or write device clipboardadb_input_pinch— Multi-touch pinch (zoom out) or spread (zoom in) gesture. Two fingers move symmetrically around a center point. Layered injection: parallelinput swipe(universal, no root) or rawsendeventMT Type B protocol (true multi-touch, root required). Auto-detects touchscreen device and capabilities viagetevent -p. Configurable center, radius, duration, angle, and interpolation stepsadb_tap_element— Find element by text/resource-id/content-description and tap its centeradb_wait_element— Poll UI hierarchy until an element appears or disappears (configurable timeout/poll interval)adb_wait_stable— Poll until consecutive UI dumps match (screen stabilization after transitions)adb_scroll_until— Scroll repeatedly until a target element is found, with optional auto-tapadb_screenshot_compressed— Capture screenshot with size/quality metadata for token-efficient workflowsadb_batch_actions— Execute multiple input actions (tap/swipe/fling/long_press/double_tap/keyevent/text/drag/pinch/back/home/sleep) in a single tool call with security validation
Device Awareness (3 tools)
adb_screen_size— Screen resolution, display density (DPI), aspect ratio, and DP width in one calladb_device_state— Combined snapshot: battery level/status/temp, network type, WiFi state, screen on/off, orientation, foreground activityadb_notifications— Parse active notifications with package, title, text, importance, channel, flags, and timestamp (filterable by package)
Snapshot/Restore (3 tools)
adb_snapshot_capture— Save comprehensive device state (packages, settings, properties) to JSONadb_snapshot_compare— Diff current state against a saved snapshot (added/removed packages, changed settings)adb_snapshot_restore_settings— Restore global/secure settings from a saved snapshot
Network Capture (3 tools)
adb_tcpdump_start— Start background packet capture via tcpdump (requires root)adb_tcpdump_stop— Stop capture and pull pcap file locally for Wireshark analysisadb_network_connections— Show active TCP/UDP connections (ss/netstat with /proc/net fallback)
CI/CD Integration (3 tools)
adb_ci_wait_boot— Wait for device/emulator to fully boot with configurable timeoutadb_ci_device_ready— Structured pass/fail readiness check (boot, PM, screen, network, disk)adb_ci_run_tests— Run instrumented tests viaam instrumentwith parsed pass/fail results
Baseband/Modem (6 tools)
adb_baseband_info— Modem firmware, RIL implementation, chipset, SIM configuration (dual SIM detection with per-slot state), network registration. IMEI retrieval is opt-in only (includeImei=true)adb_cell_identity— Cell ID (CID), TAC/LAC, EARFCN, PCI, PLMN from dumpsys phone for cellular network analysisadb_signal_detail— RSRP, RSRQ, SINR, RSSI, timing advance — raw radio measurements for signal analysisadb_neighboring_cells— All visible LTE/5G/WCDMA/GSM cells with identities and signal strengthsadb_carrier_config— Carrier configuration dump, carrier ID, preferred APNadb_modem_logs— RIL radio buffer, telephony framework, RILJ/RILC, kernel dmesg (root) modem logs
Accessibility Auditing (3 tools)
adb_a11y_audit— Automated WCAG audit: missing labels, undersized touch targets (<48dp), duplicate descriptions, unfocusable clickablesadb_a11y_touch_targets— List all interactive elements with touch target dimensions in dp, flag undersizedadb_a11y_tree— Accessibility-focused UI tree showing only screen-reader-relevant elements with roles, labels, and states
Regression Detection (3 tools)
adb_regression_baseline— Capture performance baseline (memory, CPU, frame stats, battery, network) to JSONadb_regression_check— Compare current performance against a saved baseline with configurable regression thresholdsadb_regression_history— List all saved baselines with trends, optionally filtered by package
Device Farm (3 tools)
adb_farm_run— Run instrumented tests on Firebase Test Lab across multiple device models and API levelsadb_farm_results— Retrieve results from a Test Lab run or list recent test matricesadb_farm_matrix— List available device models and Android versions on Firebase Test Lab
Plugin Registry (3 tools)
adb_registry_search— Search the community plugin registry, shows install status and available updatesadb_registry_install— Download and install a plugin from the registry by nameadb_registry_installed— List locally installed plugins with version and update availability
Plugins (2 tools)
adb_plugin_list— List all loaded plugins with paths and load timesadb_plugin_info— Plugin system documentation and example plugin format
Build (2 tools)
adb_gradle— Run any Gradle task in a project directoryadb_build_and_install— Build debug APK and install via ANDROID_SERIAL targeting
AT Commands (5 tools)
adb_at_detect— Auto-detect modem AT command device node by chipset family (Shannon, Qualcomm, MediaTek, Unisoc, generic). Probes known paths and returns the first responding nodeadb_at_send— Send a single AT command to the modem with response capture. Auto-detects port or accepts manual override. Dangerous command blocklist with force overrideadb_at_batch— Send multiple AT commands sequentially with per-command results. Configurable inter-command delayadb_at_probe— Run a standard diagnostic probe: modem ID, signal quality, network registration, SIM status, operator, functionality modeadb_at_cross_validate— Cross-validate baseband firmware by comparing AT command responses (ATI, AT+CGMR, AT+CGMM) against system properties. Flags discrepancies as potential firmware tampering, incomplete OTA, or property spoofing. Shannon-specific AT+DEVCONINFO support. Requires root
Screenshot Diffing (3 tools)
adb_screenshot_baseline— Capture and save a named screenshot baseline with metadata (dimensions, SHA-256, timestamp)adb_screenshot_diff— Compare current screen against a saved baseline using pixel-level PNG decoding. Reports changed pixel count/percentage, bounding box of changed region, and supports a tolerance threshold for absorbing dynamic elements like clocksadb_screenshot_history— List all saved screenshot baselines with metadata
Workflow Orchestration (3 tools)
adb_workflow_run— Execute a JSON-defined workflow: sequential device operations with variable substitution, conditional steps, loops, and result capture. Actions: shell, root_shell, install, screenshot, logcat, getprop, sleepadb_workflow_validate— Validate workflow structure without executing. Shows execution planadb_workflow_list— List saved workflow files in the workflows directory
Split APK Management (4 tools)
adb_install_bundle— Install split APKs (app bundles) viainstall-multiplewith replace and downgrade optionsadb_list_splits— Show all APK split paths for a package with classification (base, config.density, config.language, etc.) and total sizeadb_extract_apks— Pull all splits for a package to a local directory for analysis or backupadb_apex_list— List installed APEX modules with version info
Device Mirroring (3 tools)
adb_mirror_start— Start live screen mirroring via scrcpy. Supports windowed and headless modes, recording, bitrate/FPS/resolution control, stay-awake, and screen-offadb_mirror_stop— Stop mirroring for a device or all devicesadb_mirror_status— Check scrcpy availability and list active mirroring sessions
Automated Test Generation (3 tools)
adb_test_gen_from_ui— Analyze the current screen's interactive elements and generate a workflow that taps each one, screenshots, and checks for crashesadb_test_gen_from_intents— Analyze a package's registered activities and generate a workflow that launches each exported activity with crash detectionadb_test_gen_save— Save a generated workflow JSON to the workflows directory for later execution
OTA Update Monitoring (3 tools)
adb_ota_fingerprint— Capture system fingerprint: build ID, Android version, security patch, bootloader, baseband firmware, kernel, A/B slotadb_ota_check— Compare current system state against a saved fingerprint to detect OTA updates. Identifies changed fields and recommends re-baseliningadb_ota_history— List all saved fingerprints for a device with version progression over time
RIL Message Interception (3 tools)
adb_ril_start— Start capturing RIL messages from the radio logcat buffer. Categorizes registration, cell info, signal, network, security, handover, and NAS eventsadb_ril_poll— Retrieve captured RIL messages with optional category filtering. Shows category distributionadb_ril_stop— Stop a RIL capture session with category summary
Device Profiles (3 tools)
adb_profile_detect— Auto-detect and build a device profile: hardware ID, chipset family, modem nodes, root status, 5G support, dual SIM configuration. Matches against built-in library for known quirksadb_profile_save— Save a device profile to the profiles libraryadb_profile_list— List built-in and user-saved device profiles
Modem Firmware Analysis (3 tools)
adb_firmware_probe— Comprehensive firmware identification: parses baseband (Shannon/Qualcomm/MediaTek/Unisoc/HiSilicon/Intel), bootloader, and RIL implementation into structured components. Reports kernel, security patch, A/B slot, verified boot state, VBMeta, hypervisor, and OTA partition inventoryadb_firmware_diff— Compare all firmware components (baseband, bootloader, kernel, security patch, build ID, Android version, RIL) between saved fingerprints or live device. Deep parsed diffs for baseband and bootloader when changes detectedadb_firmware_history— Track firmware progression across all saved OTA fingerprints with multi-component change detection (baseband, bootloader, kernel, security patch, build ID, Android version) and parsed baseband diffs
Wireless Firmware (4 tools)
adb_wifi_firmware— WiFi chipset and firmware identification: driver version, firmware version, supported bands (2.4/5/6 GHz), WiFi standard detection (5/6/6E/7), current connection info. MAC address opt-in onlyadb_bluetooth_firmware— Bluetooth firmware and chipset identification: firmware version, BT version (4.0–5.4 from LMP), adapter state, LE capabilities (2M PHY, Coded PHY, extended advertising), active profiles (A2DP/HFP/HID/LE Audio), bonded device count. MAC/name opt-in onlyadb_nfc_firmware— NFC controller firmware: controller type (NXP/Broadcom/Samsung/ST), firmware version, supported technologies (NFC-A/B/F/V, MIFARE), secure element (eSE/UICC), HCE supportadb_gps_firmware— GNSS/GPS chipset and firmware identification: hardware model (manufacturer, chip, firmware), supported constellations (GPS/GLONASS/Galileo/BeiDou/QZSS/NavIC/SBAS), signal types with frequencies, dual-frequency (L1+L5) detection, raw GNSS measurement capabilities, A-GPS modes (MSB/MSA), SUPL server configuration, carrier phase measurements
Workflow Marketplace (3 tools)
adb_market_search— Search the workflow marketplace for community-shared workflow definitions with keyword and tag filtering. Shows install statusadb_market_install— Download, validate (JSON structure + SHA-256 integrity), and install a marketplace workflow for immediate use with adb_workflow_runadb_market_export— Package a local workflow with marketplace metadata (author, version, tags, SHA-256) and generate a registry manifest entry for sharing
SELinux & Permission Auditing (3 tools)
adb_selinux_status— SELinux enforcement mode, policy version, shell context, recent AVC denial count. Root provides kernel dmesg denial statsadb_selinux_denials— List recent AVC denial messages with parsed source/target contexts, permission classes, and denied operations. Supports process filteringadb_permission_audit— Audit runtime permission grants for a package grouped by dangerous permission category (Camera, Location, Phone, SMS, etc.). Flags high-sensitivity grants
Thermal & Power Profiling (3 tools)
adb_thermal_snapshot— Capture all thermal zone temperatures, per-CPU frequencies/governors, cooling device states, battery temperature/current/voltage/power draw. Optional save as JSON baselineadb_thermal_compare— Compare current thermal state against a saved baseline with per-zone temperature deltas and battery current changesadb_battery_drain— Measure battery drain rate over a configurable duration (3-60s). Reports average mA, mW, estimated %/hour. Optional package-specific batterystats
Network Discovery (3 tools)
adb_network_scan— Scan the local network for ADB-enabled devices via ARP table and optional IP range sweep. Probes ports 5555-5558 with batched parallel TCP probesadb_network_device_ip— Get the WiFi IP of a connected device via multiple methods. Shows ADB TCP status and wireless connection instructionsadb_network_auto_connect— One-step discover + connect: scans for ADB devices and automatically runs adb connect on each found listener
Hardware Sensor Access (2 tools)
adb_sensor_read— Read current hardware sensor values via dumpsys sensorservice. Enumerates all sensors with vendor, type, mode, rate range, and wake capability. Returns last-known readings with timestamps and axis-labeled formatting. Category filter (13 categories) and listOnly discovery mode. No root requiredadb_iio_read— Read raw hardware data from the Linux IIO subsystem. Auto-discovers IIO devices, classifies by kernel driver. On Tensor/Exynos: exposes per-rail ODPM power monitors showing real-time power consumption per SoC subsystem. Generic IIO path handles raw channels with calibrated scale+offset. Root required
Result Handles (3 tools)
adb_result_list— List active result handles in the tempdir-backed cache. Shows tool, name, size, age, and remaining TTL for each handleadb_result_get— Retrieve the content of a stored handle by tool + name. Returns the original content blocks as the source tool produced them; updates last-accessed time. For URI-based retrieval, use theresult://{tool}/{name}MCP Resource insteadadb_result_drop— Delete a stored result handle, or clear all handles in the current namespace. Pass bothtoolandnameto drop one specific handle, orall: trueto drop everything. Useful before changing DA_AUTH_TOKEN (which would otherwise leave orphans under the old token-hash directory)
MCP Resources (5)
Read-only device state surfaces accessible by MCP clients:
device://list— List of all connected devices with state and model infodevice://info/{serial}— Device properties (model, OS, build, ABI)device://battery/{serial}— Parsed battery status (level, charging, temperature, voltage)device://telephony/{serial}— Telephony registry state for cellular analysisresult://{tool}/{name}— Stored tool result handle. Resolve by URI; created by tools that opt into result-handle storage via theresult_handleparameter. Listed by adb_result_list
MCP Prompts (4)
Pre-built workflow templates for common multi-step debugging tasks:
debug-crash— Clear logcat → restart app → wait for reproduction → capture crash buffer → analyzedeploy-and-test— Build → install → clear logcat → start watcher → launch → screenshot → reporttelephony-snapshot— Capture telephony state, SIM/network operator, network type → summarize anomaliesairplane-cycle-test— Start watcher → baseline telephony → cycle airplane mode → compare pre/post state
Key Features
Device Caching
Device discovery results are cached with a configurable TTL (default 5s), eliminating redundant adb devices subprocess calls during rapid tool sequences. Cache auto-invalidates on connection errors and after wireless connect/disconnect/pair operations.
Transient Failure Retry
The ADB bridge automatically retries on transient failures (device offline, connection reset, protocol fault) with configurable retry count and exponential backoff. Diagnostic commands skip retries to surface real issues immediately.
Output Protection
All ADB output passes through the OutputProcessor which normalizes line endings, enforces configurable character limits, and provides contextual truncation at logical boundaries (line breaks, section separators) rather than cutting mid-line. Includes structured parsers for battery, meminfo, and getprop output.
Persistent Logcat Streaming
Background logcat watchers run as spawned processes with ring buffer accumulation. Each poll returns only new lines since the last read. Supports multiple concurrent sessions (up to 10) with independent filters. Process cleanup handlers prevent orphaned adb logcat processes on server exit.
UI Hierarchy Analysis
Full view tree capture via uiautomator dump with parsed XML extraction. Returns structured element data including text, resource-id, content-description, class names, bounds coordinates with tap-ready center points, and interaction flags. Pre-compiled regex attribute extraction for efficient parsing.
Security Middleware
Multi-layered security activated via DA_SECURITY=true. Provides command blocklist/allowlist filtering, rate limiting (commands per minute), and audit logging with automatic credential redaction. Security checks are integrated into adb_shell, adb_root_shell, adb_multi_shell, adb_multi_compare, adb_input, adb_batch_actions, and adb_start_activity. Configurable via environment variables for different deployment scenarios.
Input Sanitization
All tools that interpolate user-supplied parameters into shell command strings validate inputs against shell metacharacters before execution. Package names, property keys, service names, setting keys, test identifiers, network interface names, and tcpdump filters are all validated through a centralized validateShellArg() function that rejects ;, |, &, $, backticks, parentheses, and other injection vectors. File paths use single-quoted shell escaping to prevent $() command substitution. The adb_input tool applies type-specific validation: tap/swipe accept only numeric coordinates, keyevent accepts only alphanumeric keycodes, and text is shell-escaped for literal delivery. The adb_batch_actions tool enforces the same per-action-type validation (digits-only for coordinates, alphanumeric for keycodes, shell-escape for text) and routes every assembled command through the security middleware. Deserialized JSON from snapshot files is validated before shell interpolation. Every z.number() parameter across all 204 tools has explicit .min()/.max() Zod bounds to prevent resource exhaustion from extreme values. The LocalBridge has explicit handlers for every ADB subcommand used by tool modules, preventing unquoted fallthrough to the default shell handler. In on-device mode, privilege escalation uses a frozen 16-command allowlist and restricted-path regex — the elevation set is ReadonlySet + Object.freeze, not configurable at runtime. The HTTP/SSE transport denies cross-origin requests by default (configurable via DA_HTTP_CORS_ORIGIN), the plugin registry verifies SHA-256 integrity hashes and prevents path traversal via directory containment checks, and the workflow engine enforces step count (200), sleep duration (5 min), and repeat iteration (100) limits. Fetch helpers enforce a 5 MB response body limit. Getprop output parsing handles Windows \r\n line endings via .trim() before regex matching, and dual SIM slot counts are capped at 4 to prevent resource exhaustion from corrupted device properties.
Multi-Device Orchestration
Run commands, install APKs, and compare outputs across multiple connected devices in parallel. Essential for comparative testing across Android versions and device models.
Snapshot/Restore
Capture comprehensive device state snapshots (packages, settings
No comments yet
Be the first to share your take.