Back to Browse

Android MCP Server

by dockndevai
Developer ToolsUse Caution3.8LocalNew
Free

Control Android devices over ADB from AI agents — safe-by-default, read-only by default, audited.

About

Control Android devices over ADB from AI agents — safe-by-default, read-only by default, audited.

Security Report

3.8
Use Caution3.8High Risk

This is a well-structured ADB control server with argument-array process spawning, a mode-based policy engine, gated destructive operations, and human elicitation for admin actions, and its permissions match its device-control purpose. However, the code comments claim device text and URLs cannot inject commands, which is incorrect: adb joins multiple shell arguments into one string that the device shell interprets, so unvalidated text, package names, URLs, and alarm messages can carry shell metacharacters. The elicitation fallback also fails open when the client cannot elicit or the round-trip errors, leaving destructive operations gated only by configuration flags. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 4 high severity). Package verification found 1 issue.

7 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

What You'll Need

Set these up before or after installing:

Access mode: read-only | read-write | admin.Optional

Environment variable: ANDROID_MODE

Path to the adb binary (default: adb on PATH).Optional

Environment variable: ANDROID_ADB_PATH

Target device serial from `adb devices`. Empty = the only connected device.Optional

Environment variable: ANDROID_SERIAL

Per-command adb timeout in milliseconds.Optional

Environment variable: ANDROID_TIMEOUT_MS

Comma-separated package allowlist for launch/uninstall/clear. Empty = all.Optional

Environment variable: ANDROID_PACKAGE_ALLOWLIST

Packages that can be launched/inspected but never uninstalled or data-cleared.Optional

Environment variable: ANDROID_PROTECTED_PACKAGES

Enable install_apk / uninstall_app / clear_app_data (requires admin mode too).Optional

Environment variable: ANDROID_ALLOW_INSTALL

Enable run_shell (arbitrary adb shell; requires admin mode too).Optional

Environment variable: ANDROID_ALLOW_SHELL

Validate + log write/admin actions without executing them on the device.Optional

Environment variable: ANDROID_DRY_RUN

Emit a JSON audit line to stderr per guarded operation (default true).Optional

Environment variable: ANDROID_AUDIT_LOG

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-dockndevai-mcp-android": {
      "env": {
        "ANDROID_MODE": "your-android-mode-here",
        "ANDROID_SERIAL": "your-android-serial-here",
        "ANDROID_DRY_RUN": "your-android-dry-run-here",
        "ANDROID_ADB_PATH": "your-android-adb-path-here",
        "ANDROID_AUDIT_LOG": "your-android-audit-log-here",
        "ANDROID_TIMEOUT_MS": "your-android-timeout-ms-here",
        "ANDROID_ALLOW_SHELL": "your-android-allow-shell-here",
        "ANDROID_ALLOW_INSTALL": "your-android-allow-install-here",
        "ANDROID_PACKAGE_ALLOWLIST": "your-android-package-allowlist-here",
        "ANDROID_PROTECTED_PACKAGES": "your-android-protected-packages-here"
      },
      "args": [
        "-y",
        "@dockndevai/mcp-android"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

mcp-android

CI License: MIT npm

A Model Context Protocol server to control an Android phone over ADB — the phone equivalent of the Mac-control servers. Claude can see the screen (screenshots + UI hierarchy) and tap, type, press keys, launch apps, set alarms/timers, and read notifications. Safe-by-default, with the suite's access-mode + flag model.

Runs on your computer and drives a phone connected by USB or wireless debugging (great for the Z Fold 7). It is not installed on the phone and does not need root.

iOS? A stock iPhone can't be controlled this way — Apple's sandbox forbids cross-app/system automation. See the separate mcp-ios repo for the realistic (Appium/WebDriverAgent over USB from a Mac) approach.

Quickstart

brew install android-platform-tools        # provides adb
# On the phone: Settings → Developer options → enable USB (or Wireless) debugging, then authorize this computer
adb devices                                 # confirm your device shows "device"

Run it straight from npm — no clone or build needed:

npx -y @dockndevai/mcp-android

Or add it to Claude Code in one line (start read-only):

claude mcp add android -e ANDROID_MODE="read-only" -- npx -y @dockndevai/mcp-android

See docs/CLIENTS.md for Claude Desktop, Cursor, Codex, Windsurf, and VS Code configs.

Setup from source

brew install android-platform-tools        # provides adb
adb devices                                 # confirm your device shows "device"
npm install && npm run build

Tools

Read (read-only+): list_devices, device_info, screenshot, ui_dump, current_app, list_apps, get_notifications

Write (read-write+): tap, swipe, input_text, press_key, launch_app, open_url, set_alarm, set_timer

Admin (admin): install_apk, uninstall_app, clear_app_data (need ANDROID_ALLOW_INSTALL), run_shell (needs ANDROID_ALLOW_SHELL; not registered otherwise)

The typical loop for driving the UI: screenshot → ui_dump (find bounds) → tap/input_text.

Security model

ConcernFlagDefault
What it can doANDROID_MODEread-only
Which packages in scopeANDROID_PACKAGE_ALLOWLIST(all)
Protected packages (never uninstall/clear)ANDROID_PROTECTED_PACKAGESsettings, systemui, gms
Allow install/uninstall/clearANDROID_ALLOW_INSTALLfalse
Allow raw adb shellANDROID_ALLOW_SHELLfalse
Interactive confirmation (destructive ops)MCP elicitation (client-driven)(on when the client supports it)
Preview without touching deviceANDROID_DRY_RUNfalse
Audit log (stderr)ANDROID_AUDIT_LOGtrue

When the connected client supports MCP elicitation, destructive tools (uninstall_app, clear_app_data, install_apk, run_shell) pause and ask the human to approve the exact action before it runs — the model can't approve on your behalf. When the client can't elicit, the access-mode + flag gates above are the control.

Run with Claude Desktop / Claude Code

{
  "mcpServers": {
    "android": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-android/dist/index.js"],
      "env": { "ANDROID_MODE": "read-write" }
    }
  }
}

Example prompts

  • "Take a screenshot of my phone and tell me what's on screen."
  • "Set an alarm for 6:30am labeled Gym."
  • "Open the Clock app and start a 10-minute timer."
  • "What notifications do I have piling up?"

Develop

npm run dev
npm test          # security policy
npm run typecheck

License

MIT

Reviews

No reviews yet

Be the first to review this server!