DeepADB

MCP (Model Context Protocol) server for AI agents that need to inspect, control, test, and diagnose Android devices through ADB—or directly on-device through Termux.

209 tools, 5 resources, and 4 prompts across 49 modules—from UI automation and application management to logs, network capture, baseband, firmware, security, and hardware diagnostics.

Get started

DeepADB runs as a local MCP server. It uses ADB on a host computer and automatically switches to direct execution when running on Android (detected through /system/build.prop).

git clone https://github.com/fullread/DeepADB.git
cd DeepADB
npm ci
npm run build
npm start

Add build/index.js to your MCP client configuration, then begin with these workflows:

For a guided local connection, see MCP Client Configuration. Read SECURITY.md before exposing HTTP, WebSocket, or GraphQL transports beyond loopback.

Using llama.cpp or another local model? See Local LLM clients for direct stdio, authenticated browser HTTP, and small tool profiles. WebSocket is not required.

Architecture

┌──────────────────────────────────────────────────┐
│                   MCP Client                     │
│             (Any MCP-capable client)             │
└──────────────────────┬───────────────────────────┘
                       │ stdio (JSON-RPC), HTTP (/mcp or /sse), or WebSocket
┌──────────────────────▼───────────────────────────┐
│               DeepADB Server                     │
│                                                  │
│  ┌─────────────────────────────────────────────┐ │
│  │           Tool Modules (49)                 │ │
│  │  device │ shell │ packages │ files │ logs   │ │
│  │  diagnostics │ ui │ build │ health          │ │
│  │  wireless │ control │ logcat-watch          │ │
│  │  forwarding │ screen-record │ emulator      │ │
│  │  testing │ multi-device │ snapshot          │ │
│  │  network-capture │ ci │ plugins │ baseband  │ │
│  │  accessibility │ regression                 │ │
│  │  device-farm │ registry │ at-commands       │ │
│  │  screenshot-diff │ workflow │ sensors       │ │
│  │  split-apk │ mirroring │ test-gen           │ │
│  │  ota-monitor │ ril-intercept                │ │
│  │  device-profiles │ firmware-analysis        │ │
│  │  workflow-market │ selinux-audit            │ │
│  │  thermal-power │ network-discovery          │ │
│  │  input-gestures │ wireless-firmware         │ │
│  │  app-network │ database-inspector           │ │
│  │  runtime-audit │ wear                       │ │
│  ├─────────────────────────────────────────────┤ │
│  │  Resources (5) │ Prompts (4)                │ │
│  └───────────────────┬─────────────────────────┘ │
│                      │                           │
│  ┌───────────────────▼─────────────────────────┐ │
│  │          ToolContext (unified DI)           │ │
│  │  server │ bridge │ deviceManager            │ │
│  │  logger │ security │ config                 │ │
│  └───────────────────┬─────────────────────────┘ │
│                      │                           │
│  ┌───────────────────▼─────────────────────────┐ │
│  │           Middleware Layer                  │ │
│  │  OutputProcessor │ SecurityMiddleware       │ │
│  │  InputSanitizer │ Logger (stderr-safe)      │ │
│  └───────────────────┬─────────────────────────┘ │
│                      │                           │
│  ┌───────────────────▼─────────────────────────┐ │
│  │         Bridge Layer (auto-detect)          │ │
│  │                                             │ │
│  │  ┌─────────────┐    ┌────────────────────┐  │ │
│  │  │  ADB Bridge  │ OR │  Local Bridge      │ │ │
│  │  │  (PC mode)   │    │  (on-device mode)  │ │ │
│  │  │  via adb.exe │    │  via sh/su direct  │ │ │
│  │  └──────┬───────┘    └────────┬───────────┘ │ │
│  │         │                     │             │ │
│  │  Retry │ Timeout │ Cache │ Serial routing   │ │
│  └─────────┼─────────────────────┼─────────────┘ │
└────────────┼─────────────────────┼───────────────┘
             │                     │
     ┌───────▼───────┐    ┌───────▼───────┐
     │  ADB Binary   │    │   sh / su     │
     │  (USB/WiFi)   │    │   (local)     │
     └───────┬───────┘    └───────┬───────┘
             │                    │
       ┌─────▼────────────────────▼─────┐
       │          Android Device        │
       └────────────────────────────────┘

Dual-Mode Architecture

DeepADB operates in two modes, auto-detected at startup:

ADB Mode (default) — PC-side bridge

AI Agent (PC) ←→ MCP ←→ DeepADB (PC) ←→ ADB (USB) ←→ Android Device

Standard mode: DeepADB runs on a PC/Mac/Linux host and communicates with the device over USB via ADB. The complete 209-tool surface is registered through the ADB bridge with automatic retry on transient failures; environment-specific tools report their capability requirements when a host cannot run them.

On-Device Mode — direct local execution

AI Agent (Termux) ←→ MCP (stdio/HTTP) ←→ DeepADB (Termux) ←→ sh/su (local)

When DeepADB runs directly on the Android device (e.g., inside Termux), it auto-detects the environment and switches to LocalBridge. Commands execute directly via sh/su — no ADB server, no USB, no serialization overhead. The same 209-tool MCP surface is registered, with capability-aware guidance when an optional on-device binary such as sqlite3 is unavailable.

1.1.6 device validation (November 1, 2026): the released build’s full on-device run passed 836 checks, 0 failed, 3 skipped (839 total) across all 24 suites on the rooted Pixel 6a / Android 16, using Termux Node 24.22.1 and SQLite 3.54.1. The three skips reuse the cached Alpine kernel, initrd and disk; the actual VM boot and shutdown checks passed. Coverage includes the 28 runtime-audit regressions, device SQLite, live Shannon AT/OK, client/plugin compatibility, POSIX security cases and PIN-based UI recovery. The production installation passed eight strict checks before and after promotion, plus eight real Chromium checks and six authenticated WebSocket/GraphQL checks. Following the final documentation audit and verified redeployment, 1.1.6 is the only DeepADB installation retained on the validation Pixel; older installations and rollback copies were removed at the operator’s request. Real phone-to-watch validation remains deferred.

The earlier 1.1.6 host/ADB baseline on Windows/Node 24.22.2 passed 783 checks, 0 failed, 18 expected skips (801 total). After the oversized-header test was split into a portable regression, Node 22.23.4 device-free coverage passed 351 checks, 0 failed, 17 expected skips (368 total). Host skips cover device-only or POSIX behavior, unavailable tcpdump and Windows file-symlink privileges; they are distinct from the on-device results above.

v1.1.5 final audit-fix verification (Windows host): the ten device-free suites passed 295 checks, zero failures, and 17 expected skips (312 total) under Node 22.23.4 with coverage. The new hardening suite separately passed 41 checks on Node 24.22.2, with one Windows file-symlink capability skip; 16 other skips in the full CI set require hardware. Eight real-browser CORS/reload checks passed. The Pixel passed eight disposable POSIX path/link/race checks and five focused hardware smoke checks; the latest snapshot code also completed a real schema read through the isolated worker. These initial checks preceded the separate on-device release validation described below.

Final hardening hardware regression (October 31, 2026): all 22 host/ADB suites passed on the Pixel 6a / Android 16 using Node 24.22.2: 728 passed, 0 failed, 18 expected skips (746 total). This includes 41 audit-hardening, 33 local-LLM, 36 SDK/client/plugin compatibility, 93 security and 46 UI checks, plus live SQLite and Shannon validation. The skips are five on-device-only QEMU checks, twelve Windows/POSIX/tcpdump checks and one Windows file-symlink capability case. That last case is additionally covered by the disposable Pixel POSIX probes above. The suite exited successfully, left no ADB forwards, and made no repository file changes. This validates the host build; on-device LocalBridge execution is verified separately during release preparation.

1.1.5 release validation: the production-only package initializes with 209 tools, five resources/templates and four prompts. The staged Pixel build, using Termux Node 24.22.1 and SQLite 3.54.1, passed real SQLite schema/query reads, write rejection, runtime/health checks and a live Shannon handshake. Eight real-browser checks also passed against that on-device process, including authenticated SSE/Streamable HTTP, denied Origins and repeated page reloads. Six optional WebSocket/GraphQL checks passed with their production packages installed. The verified build was promoted to the normal installation path; Android auto-detection and all eight strict device checks passed again there. At that release’s validation, the 1.1.4 rollback copy also started on the new runtime. The final host hardware rerun passed 728 checks with zero failures and 18 skips; device-free Node 24 coverage passed 295 checks with zero failures and 17 skips. GitHub CI covers Node 22/24/26 builds and regressions, real-browser MCP compatibility, coverage and dependency auditing, with separate CodeQL analysis for application code and GitHub Actions.

Earlier unreleased host hardware validation (October 31, 2026, before the final seven-finding hardening pass): the expanded suite, including SDK migration, browser reconnect, request-ID/cancellation, plugin callback lifetime, and profile regressions, completed on Pixel 6a / Android 16 with 687 passed, 0 failed, and 17 expected skips (704 total). Live llama.cpp checks separately exercised stdio, authenticated browser Streamable HTTP, and legacy SSE with the inspect profile; see LOCAL_LLMS.md for the tested model and browser HTTP reload recovery and its limits. Phone-to-watch Wear validation is deferred.

v1.1.4 host hardware validation: the full Pixel 6a / Android 16 regression completed with 604 passed, 0 failed, and 17 expected environment-specific skips (621 total). This includes live AT/OK validation on /dev/umts_router, a guarded read-only SQLite schema snapshot with cleanup, the unified runtime audit, per-app route context, and the single-device Wear preflight. The skips are the five on-device-only QEMU checks plus twelve Windows-host or unavailable-tcpdump security checks.

v1.1.3 hardware baseline: validated on a Pixel 6a (Android 16, Termux + Magisk + QEMU 10.2.1) across a four-cell test matrix — host (ADB) and on-device (LocalBridge), each with and without a device PIN — with 0 failures in every cell. The v1.1.3 suite contained 577 tests in the host/ADB configuration and 613 on-device; the difference is the QEMU virtualization and Alpine VM-boot suites, which run only on-device:

• ADB mode, no PIN: 556 passed / 0 failed / 21 skipped (577 total). Skips: 5 QEMU (on-device only), 7 gracefulKill unit tests (require POSIX signals, skipped on the Windows host), 3 tcpdump sanitization (tcpdump is root-only and unreachable over a non-root ADB shell), 2 host-shell round-trips (require a POSIX /bin/sh), 4 screen-state (require DA_TEST_PIN).
• ADB mode, with PIN: 560 passed / 0 failed / 17 skipped (577 total). The 4 screen-state tests unlock and run.
• On-device mode, no PIN: 606 passed / 0 failed / 7 skipped (613 total). All QEMU tests run, including Alpine Linux VM boot with KVM acceleration, big.LITTLE CPU topology detection, guest ADB connectivity error handling, and clean VM shutdown; the tcpdump and gracefulKill suites also run here (root + POSIX). Skips: 3 QEMU setup steps that no-op when the Alpine kernel/initrd/disk are already cached, 4 screen-state (require PIN).
• On-device mode, with PIN: 610 passed / 0 failed / 3 skipped (613 total). Every test enabled by the environment runs; the 3 skips are the cached-VM setup steps.

Privilege escalation: In ADB mode, all shell commands run as uid=2000 (the shell user) which has system-level permissions. In Termux, commands run as a regular app user. LocalBridge automatically elevates privileged commands through su when root (Magisk) is available:

• Command allowlist: 16 system commands (settings, dumpsys, am, input, screencap, screenrecord, uiautomator, app_process, getenforce, setenforce, cmd, pm, wm, svc, ip, ifconfig) are routed through su -c to match ADB-mode behavior.
• Path-based elevation: Commands referencing /sdcard, /storage, or /system/ paths are elevated to bypass Android scoped storage restrictions.
• Root detection: Cached after a single su -c id probe at first use. Graceful degradation when root is unavailable.
• The elevation allowlist is frozen (ReadonlySet + Object.freeze) — not configurable via environment variables or runtime API.

Auto-detection: Checks for /system/build.prop (present on all Android devices, never on hosts). Override with DA_LOCAL=true or DA_LOCAL=false.

On-device setup (Termux):

pkg install nodejs-lts git sqlite
git clone https://github.com/fullread/DeepADB.git
cd DeepADB
npm ci
npm run build

Choose the launch mode for your client. For stdio, configure the MCP client to launch node with the absolute path to DeepADB/build/index.js; the client starts the process itself. To run a loopback HTTP listener instead:

DA_HTTP_HOST=127.0.0.1 DA_HTTP_PORT=3000 npm start # /mcp and legacy /sse

This listener is accessible only on the device, not directly over Wi-Fi. For browser clients, configure a bearer token and an exact Origin allowlist; see Local LLM clients. For remote access, follow the token and TLS reverse-proxy or SSH-tunnel guidance in SECURITY.md.

Use a supported Node LTS release; Node 24 is validated for this release. The sqlite package supplies the sqlite3 executable required by on-device database inspection. Production installs that omit development dependencies must install ws and/or graphql separately when those optional transports are enabled. Before replacing an existing device installation, stage the built package, keep a rollback copy, and verify its actual LocalBridge execution with the device’s runtime and binaries. Host/ADB tests alone do not validate that deployment.

MCP Client Configuration

Configure a local stdio MCP server with node as the command and the absolute path to build/index.js as its argument. The client starts the server process. For clients that use an mcpServers JSON configuration, the equivalent is:

{
  "mcpServers": {
    "deepadb": {
      "command": "node",
      "args": ["/path/to/DeepADB/build/index.js"]
    }
  }
}

Other clients may use a settings form, TOML, or a different JSON layout; enter the same command and argument using that client’s configuration format. Leave DA_HTTP_PORT, DA_WS_PORT, and DA_GRAPHQL_PORT unset for this stdio setup. See Local LLM clients for explicit environment settings and authenticated browser connections.

Available Tools (209)

Start with the capability area that matches your task; the complete reference remains below.

Complete tool reference

Health (1 tool)

• adb_health_check — Comprehensive toolchain validation: ADB binary, server, device connection, authorization, root access, and storage writability

Runtime Audit (1 tool)

• adb_runtime_audit — Unified read-only readiness audit for transport, Android userspace, root, SELinux, storage, command capabilities, UI/network diagnostics, SQLite, modem nodes, and Wear prerequisites

The audit retains successful checks when an independent probe fails. Its report labels readiness as available, unavailable (a confirmed negative result), or inconclusive (failed, timed out, incomplete, or not safely checked). Audit status: partial and the Probe issues section identify incomplete checks while preserving useful device information and snapshots. A partial report is returned normally; failure to resolve the requested device remains a tool error. complete means the checks completed, not that every capability is available. Modem node visibility does not verify an AT handshake, and Play services presence does not verify phone/watch pairing. Use the dedicated Shannon and Wear tools for those narrower checks.

SQLite readiness follows the inspector’s execution mode: host ADB uses the host’s Node SQLite backend (Node 22.16+ with node:sqlite enabled), while on-device LocalBridge uses device sqlite3. A phone’s SQLite binary cannot make a missing host backend available. Backend availability alone does not verify access to a particular app database.

Device (3 tools)

• adb_devices — List all connected devices with state, model, and product info
• adb_device_info — Detailed device properties (model, OS, SDK, build, security patch, ABI)
• adb_getprop — Read a specific system property or dump all properties

Shell (2 tools)

• adb_shell — Execute arbitrary shell commands with configurable timeout (security-checked)
• adb_root_shell — Execute commands as root via su (requires rooted device, security-checked)

Packages (12 tools)

• adb_install — Install APK with replace/downgrade options
• adb_uninstall — Remove package with optional data retention
• adb_list_packages — List packages filtered by name or type (all/system/third-party)
• adb_package_info — Detailed package info (version, permissions, paths)
• adb_clear_data — Clear all app data and cache
• adb_grant_permission — Grant a runtime permission to a package
• adb_revoke_permission — Revoke a runtime permission from a package (reset permission state for testing denial flows)
• adb_list_permissions — List all declared and granted permissions for a package, filterable by granted/denied
• adb_force_stop — Force-stop an app immediately
• adb_start_app — Launch an app by package name (resolves launcher activity)
• adb_restart_app — Force-stop then re-launch in one call (configurable delay)
• adb_resolve_intents — Discover registered activities, services, and receivers with intent filters

Room & SQLite Inspection (1 tool)

• adb_sqlite_inspect — Package-scoped listing, schema inspection and validated read-only SQL. Prefers run-as, falls back to root, rejects linked directories/files and verifies opened descriptors. Queries a private snapshot (database + WAL ≤64 MiB) with bounded execution and output, then removes it. Host inspection needs Node 22.16+ and runs in an isolated process; on-device inspection uses a trusted sqlite3 binary. Neither backend queries the live app path. Snapshots are not transactional backups; concurrent writes may require retrying with the app stopped.

Files (18 tools)

• adb_push — Push local file to device (hard-blocked kernel paths, fs-type awareness, storage reporting)
• adb_pull — Pull file from device to local filesystem
• adb_ls — List device directory contents (simple or detailed)
• adb_cat — Read text file from device with optional line limit
• adb_file_write — Create or overwrite text files via heredoc (buffer limit warning, fs-aware, post-verify)
• adb_find — Search for files by name/pattern with depth control and result capping
• adb_file_stat — File metadata: size, permissions, timestamps, ownership, SELinux context
• adb_file_checksum — SHA-256/SHA-1/MD5 hash with size-based timeout estimation
• adb_mkdir — Create directories with parent creation (-p), hard-blocked kernel paths
• adb_rm — Delete files/directories with depth-based recursive protection and symlink resolution
• adb_file_move — Move/rename with source depth protection and post-verify
• adb_file_copy — Copy with pre-flight size+space check and post-verify size match
• adb_file_chmod — Change permissions (Zod-validated octal mode, depth-based recursive protection)
• adb_file_touch — Create empty files or update timestamps (explicit timestamp support)
• adb_file_fsinfo — Filesystem report: type, mount, capacity, capabilities, SELinux, limitations
• adb_file_chown — Change ownership (root required, depth-based recursive protection)
• adb_grep — Search file contents with fixed-string default, recursive depth control, result capping
• adb_file_replace — Find/replace text in files (sed-backed, proper escaping, backup option)

Logs — Snapshots (3 tools)

• adb_logcat — Filtered logcat snapshot with tag, priority, grep, and buffer selection
• adb_logcat_clear — Clear all logcat buffers
• adb_logcat_crash — Crash buffer log snapshot

Logs — Persistent Watchers (4 tools)

• adb_logcat_start — Start a background logcat watcher with ring buffer accumulation
• adb_logcat_poll — Retrieve new lines since last poll from a running watcher
• adb_logcat_stop — Stop a watcher session (or all sessions)
• adb_logcat_sessions — List all active watcher sessions with stats

Diagnostics (9 tools)

• adb_dumpsys — Run dumpsys for any service (or list all services)
• adb_telephony — Cell info, signal strength, and network registration (parallel query)
• adb_battery — Battery status, level, temperature, and charging info
• adb_network — WiFi, cellular, and IP connectivity (parallel query)
• adb_top — CPU and memory usage snapshot
• adb_perf_snapshot — Parallel memory, frame stats, and CPU profiling for a package
• adb_bugreport — Full bug report zip capture (device state, logs, system info)
• adb_crash_logs — ANR traces and tombstone crash dumps from /data/anr/ and /data/tombstones/
• adb_heap_dump — Capture heap dump (.hprof) from a running process for memory analysis

Per-App Route Context (1 tool)

• adb_app_route_context — Resolve an installed package to its UID and correlate its effective ip rule ranges, route tables, network policy, VPN, and default-network state without changing routes or policy

UI (10 tools)

• adb_screencap — Take screenshot with filename sanitization, saves locally
• adb_screencap_annotated — Screenshot with UI element bounding boxes and numbered labels composited onto the PNG. Returns annotated image path plus a text legend. Ideal for LLM workflows that reference elements by number
• adb_current_activity — Get focused activity and top window stack
• adb_input — Send tap, swipe, text, or keyevent input
• adb_start_activity — Launch activities by intent or component name
• adb_ui_dump — Dump full UI hierarchy. Supports three output formats: text (default, human-readable), tsv (compact tab-separated for token-efficient automation loops), xml (raw uiautomator XML)
• adb_ui_find — Search UI hierarchy by text, resource-id, or content-description (returns tap coordinates)
• adb_screen_state — Combined screen state in one call: foreground activity, screen dimensions and density, orientation, battery level, and a TSV list of interactive elements. Replaces 3–4 separate tool calls
• adb_screenrecord_start — Start recording the device screen (1-180s, stored on device)
• adb_screenrecord_stop — Stop recording and pull the mp4 video file locally

Device Control (9 tools)

• adb_airplane_mode — Toggle airplane mode with broadcast and verification
• adb_airplane_cycle — Cycle airplane mode on/off to force cellular re-registration
• adb_wifi — Enable or disable WiFi
• adb_mobile_data — Enable or disable mobile data
• adb_location — Set location mode (off/sensors/battery/high)
• adb_screen — Wake, sleep, toggle, lock, or unlock the screen. Lock verifies keyguard state via dumpsys window. Unlock uses wm dismiss-keyguard (works for swipe keyguards); supply pin to perform the full PIN entry sequence: wakes screen, swipes up to reveal keypad, types PIN, confirms, and verifies the keyguard sleep token was released
• adb_settings_get — Read any Android setting from system/secure/global namespace
• adb_settings_put — Write any Android setting with read-back verification
• adb_reboot — Reboot device (normal, recovery, or bootloader mode)

Wireless Debugging (4 tools)

• adb_pair — Pair with device over WiFi using pairing code
• adb_connect — Connect to device over WiFi/TCP
• adb_disconnect — Disconnect wireless device(s)
• adb_tcpip — Switch USB device to TCP/IP mode (auto-detects device IP)

Port Forwarding (8 tools)

• adb_forward — Forward a local port to a device port (host → device)
• adb_reverse — Reverse-forward a device port to the host (device → host)
• adb_forward_list — List all active forward and reverse port mappings
• adb_forward_remove — Remove a port forward or all forwards
• adb_reverse_remove — Remove a reverse forward or all reverse forwards
• adb_tunnel_open — Open a managed tunnel with opaque ID. Auto-picks a free host port for forward direction when omitted; registers cleanup so the tunnel is removed on server exit
• adb_tunnel_list — List active managed tunnels (those opened via adb_tunnel_open). Optional device filter; shows ID, direction, endpoints, and age
• adb_tunnel_close — Close a managed tunnel by ID, or close all at once with id=“all”

Emulator Management (3 tools)

• adb_avd_list — List available AVDs (PC mode) or detect KVM/QEMU virtualization capabilities (on-device mode)
• adb_emulator_start — Launch an AVD with headless, cold boot, and GPU options (PC mode) or report QEMU alternative (on-device mode)
• adb_emulator_stop — Gracefully shut down a running emulator

QEMU/KVM Virtualization (8 tools)

• adb_qemu_setup — Check and install QEMU for on-device virtualization. Verifies KVM, reports host CPU/RAM, installs via Termux pkg
• adb_qemu_images — Manage VM disk images: list, create (qcow2/raw), delete. Path containment verification prevents traversal
• adb_qemu_start — Boot a KVM-accelerated VM with dynamic resource allocation. Auto-detects optimal CPUs (total minus 1, reserving one for host) and memory (65% of physical RAM). Supports kernel/initrd/append for Android boot, ADB port forwarding
• adb_qemu_stop — Stop a running VM (graceful SIGTERM or force SIGKILL). Auto-disconnects guest ADB before killing. Reports running VMs if no name given
• adb_qemu_status — Full status: KVM/QEMU availability, host resource budget, running VMs with PID/resources/uptime/ports/ADB connection state, image inventory
• adb_qemu_connect — Connect to a running VM’s guest ADB service. Restricted to localhost only — port derived from running VM state, never user input. Enables multi-device tools to operate on guest VMs
• adb_qemu_disconnect — Disconnect from a guest VM’s ADB service. Clears connection state and removes guest from device list
• adb_qemu_guest_shell — Execute shell commands on a guest VM via ADB. Subject to security middleware. Guest serial derived internally — no user-supplied host/IP reaches the ADB binary

Test Sessions (3 tools)

• adb_test_session_start — Start a named test session with organized output directory
• adb_test_step — Capture a numbered step with screenshot and logcat into the session
• adb_test_session_end — End session, write summary manifest, return directory path

Multi-Device Orchestration (4 tools)

• adb_multi_shell — Execute a command on all/selected devices in parallel (security-checked)
• adb_multi_install — Install an APK across multiple devices simultaneously
• adb_multi_compare — Run a command on all devices and highlight output differences
• adb_multi_test — Comparative test workflow: run predefined diagnostic profiles (firmware/security/network/identity/full) or custom command lists across all devices including QEMU guests, compare per-check, report matches and differences

Wear Data Layer (1 tool)

• adb_wear_datalayer_preflight — Read-only phone/watch role, Google Play services, Bluetooth, optional package, companion-association, and Data Layer service preflight; pairing identifiers are intentionally omitted

Input Gestures & UI Automation (15 tools)

• adb_input_drag — Drag from point A to point B (uses draganddrop with swipe fallback for older Android)
• adb_input_fling — High-velocity fling gesture for momentum-scrolling through lists and paged views (configurable duration 20-200ms)
• adb_input_long_press — Long press at coordinates with configurable hold duration
• adb_input_double_tap — Double tap with configurable interval between taps
• adb_input_text — Dedicated text input with space/special character handling
• adb_open_url — Open a URL on the device via VIEW intent
• adb_orientation — Get or set screen orientation (auto/portrait/landscape/reverse)
• adb_clipboard — Read or write device clipboard
• adb_input_pinch — Multi-touch pinch (zoom out) or spread (zoom in) gesture. Two fingers move symmetrically around a center point. Layered injection: parallel input swipe (universal, no root) or raw sendevent MT Type B protocol (true multi-touch, root required). Auto-detects touchscreen device and capabilities via getevent -p. Configurable center, radius, duration, angle, and interpolation steps
• adb_tap_element — Find element by text/resource-id/content-description and tap its center
• adb_wait_element — Poll UI hierarchy until an element appears or disappears (configurable timeout/poll interval)
• adb_wait_stable — Poll until consecutive UI dumps match (screen stabilization after transitions)
• adb_scroll_until — Scroll repeatedly until a target element is found, with optional auto-tap
• adb_screenshot_compressed — Capture screenshot with size/quality metadata for token-efficient workflows
• adb_batch_actions — Execute multiple input actions (tap/swipe/fling/long_press/double_tap/keyevent/text/drag/pinch/back/home/sleep) in a single tool call with security validation

Device Awareness (3 tools)

• adb_screen_size — Screen resolution, display density (DPI), aspect ratio, and DP width in one call
• adb_device_state — Combined snapshot: battery level/status/temp, network type, WiFi state, screen on/off, orientation, foreground activity
• adb_notifications — Parse active notifications with package, title, text, importance, channel, flags, and timestamp (filterable by package)

Snapshot/Restore (3 tools)

• adb_snapshot_capture — Save comprehensive device state (packages, settings, properties) to JSON
• adb_snapshot_compare — Diff current state against a saved snapshot (added/removed packages, changed settings)
• adb_snapshot_restore_settings — Restore global/secure settings from a saved snapshot

Network Capture (3 tools)

• adb_tcpdump_start — Start background packet capture via tcpdump (requires root)
• adb_tcpdump_stop — Stop capture and pull pcap file locally for Wireshark analysis
• adb_network_connections — Show active TCP/UDP connections (ss/netstat with /proc/net fallback)

CI/CD Integration (3 tools)

• adb_ci_wait_boot — Wait for device/emulator to fully boot with configurable timeout
• adb_ci_device_ready — Structured pass/fail readiness check (boot, PM, screen, network, disk)
• adb_ci_run_tests — Run instrumented tests via am instrument with parsed pass/fail results

Baseband/Modem (6 tools)

• adb_baseband_info — Modem firmware, RIL implementation, chipset, SIM configuration (dual SIM detection with per-slot state), network registration. IMEI retrieval is opt-in only (includeImei=true)
• adb_cell_identity — Cell ID (CID), TAC/LAC, EARFCN, PCI, PLMN from dumpsys phone for cellular network analysis
• adb_signal_detail — RSRP, RSRQ, SINR, RSSI, timing advance — raw radio measurements for signal analysis
• adb_neighboring_cells — All visible LTE/5G/WCDMA/GSM cells with identities and signal strengths
• adb_carrier_config — Carrier configuration dump, carrier ID, preferred APN
• adb_modem_logs — RIL radio buffer, telephony framework, RILJ/RILC, kernel dmesg (root) modem logs

Accessibility Auditing (3 tools)

• adb_a11y_audit — Targeted Android accessibility checks: missing labels, undersized touch targets (<48dp), duplicate descriptions, unfocusable clickables
• adb_a11y_touch_targets — List all interactive elements with touch target dimensions in dp, flag undersized
• adb_a11y_tree — Accessibility-focused UI tree showing only screen-reader-relevant elements with roles, labels, and states

Regression Detection (3 tools)

• adb_regression_baseline — Capture performance baseline (memory, CPU, frame stats, battery, network) to JSON
• adb_regression_check — Compare current performance against a saved baseline with configurable regression thresholds
• adb_regression_history — List all saved baselines with trends, optionally filtered by package

Device Farm (3 tools)

• adb_farm_run — Run instrumented tests on Firebase Test Lab across multiple device models and API levels
• adb_farm_results — Retrieve results from a Test Lab run or list recent test matrices
• adb_farm_matrix — List available device models and Android versions on Firebase Test Lab

Plugin Registry (3 tools)

• adb_registry_search — Search the community plugin registry, shows install status and available updates
• adb_registry_install — Download and install a plugin from the registry by name
• adb_registry_installed — List locally installed plugins with version and update availability

Plugins (2 tools)

• adb_plugin_list — List all loaded plugins with paths and load times
• adb_plugin_info — Plugin system documentation and example plugin format

Build (2 tools)

• adb_gradle — Run any Gradle task in a project directory
• adb_build_and_install — Build debug APK and install via ANDROID_SERIAL targeting

AT Commands (6 tools)

• adb_shannon_session — Check Shannon/Exynos chipset detection, root, character-device modem ports, and a benign AT/OK handshake together; supports Google Tensor’s /dev/umts_router, re-arms bounded CPIF reads until a terminal result, optionally sends read-only ATI, and never sends a modem configuration command
• adb_at_detect — Auto-detect modem AT command device node by chipset family (Shannon, Qualcomm, MediaTek, Unisoc, generic). Probes known paths and returns the first responding node
• adb_at_send — Send a single AT command to the modem with response capture. Auto-detects port or accepts manual override. Dangerous command blocklist with force override
• adb_at_batch — Send multiple AT commands sequentially with per-command results. Configurable inter-command delay
• adb_at_probe — Run a standard diagnostic probe: modem ID, signal quality, network registration, SIM status, operator, functionality mode
• adb_at_cross_validate — Cross-validate baseband firmware by comparing AT command responses (ATI, AT+CGMR, AT+CGMM) against system properties. Flags discrepancies as potential firmware tampering, incomplete OTA, or property spoofing. Shannon-specific AT+DEVCONINFO support. Requires root

Screenshot Diffing (3 tools)

• adb_screenshot_baseline — Capture and save a named screenshot baseline with metadata (dimensions, SHA-256, timestamp)
• adb_screenshot_diff — Compare current screen against a saved baseline using pixel-level PNG decoding. Reports changed pixel count/percentage, bounding box of changed region, and supports a tolerance threshold for absorbing dynamic elements like clocks
• adb_screenshot_history — List all saved screenshot baselines with metadata

Workflow Orchestration (3 tools)

• adb_workflow_run — Execute a JSON-defined workflow: sequential device operations with variable substitution, conditional steps, loops, and result capture. Actions: shell, root_shell, install, screenshot, logcat, getprop, sleep
• adb_workflow_validate — Validate workflow structure without executing. Shows execution plan
• adb_workflow_list — List saved workflow files in the workflows directory

Split APK Management (4 tools)

• adb_install_bundle — Install split APKs (app bundles) via install-multiple with replace and downgrade options
• adb_list_splits — Show all APK split paths for a package with classification (base, config.density, config.language, etc.) and total size
• adb_extract_apks — Pull all splits for a package to a local directory for analysis or backup
• adb_apex_list — List installed APEX modules with version info

Device Mirroring (3 tools)

• adb_mirror_start — Start live screen mirroring via scrcpy. Supports windowed and headless modes, recording, bitrate/FPS/resolution control, stay-awake, and screen-off
• adb_mirror_stop — Stop mirroring for a device or all devices
• adb_mirror_status — Check scrcpy availability and list active mirroring sessions

Automated Test Generation (3 tools)

• adb_test_gen_from_ui — Analyze the current screen’s interactive elements and generate a workflow that taps each one, screenshots, and checks for crashes
• adb_test_gen_from_intents — Analyze a package’s registered activities and generate a workflow that launches each exported activity with crash detection
• adb_test_gen_save — Save a generated workflow JSON to the workflows directory for later execution

OTA Update Monitoring (3 tools)

• adb_ota_fingerprint — Capture system fingerprint: build ID, Android version, security patch, bootloader, baseband firmware, kernel, A/B slot
• adb_ota_check — Compare current system state against a saved fingerprint to detect OTA updates. Identifies changed fields and recommends re-baselining
• adb_ota_history — List all saved fingerprints for a device with version progression over time

RIL Message Interception (3 tools)

• adb_ril_start — Start capturing RIL messages from the radio logcat buffer. Categorizes registration, cell info, signal, network, security, handover, and NAS events
• adb_ril_poll — Retrieve captured RIL messages with optional category filtering. Shows category distribution
• adb_ril_stop — Stop a RIL capture session with category summary

Device Profiles (3 tools)

• adb_profile_detect — Auto-detect and build a device profile: hardware ID, chipset family, modem nodes, root status, 5G support, dual SIM configuration. Matches against built-in library for known quirks
• adb_profile_save — Save a device profile to the profiles library
• adb_profile_list — List built-in and user-saved device profiles

Modem Firmware Analysis (3 tools)

• adb_firmware_probe — Comprehensive firmware identification: parses baseband (Shannon/Qualcomm/MediaTek/Unisoc/HiSilicon/Intel), bootloader, and RIL implementation into structured components. Reports kernel, security patch, A/B slot, verified boot state, VBMeta, hypervisor, and OTA partition inventory
• adb_firmware_diff — Compare all firmware components (baseband, bootloader, kernel, security patch, build ID, Android version, RIL) between saved fingerprints or live device. Deep parsed diffs for baseband and bootloader when changes detected
• adb_firmware_history — Track firmware progression across all saved OTA fingerprints with multi-component change detection (baseband, bootloader, kernel, security patch, build ID, Android version) and parsed baseband diffs

Wireless Firmware (4 tools)

• adb_wifi_firmware — WiFi chipset and firmware identification: driver version, firmware version, supported bands (2.4/5/6 GHz), WiFi standard detection (5/6/6E/7), current connection info. MAC address opt-in only
• adb_bluetooth_firmware — Bluetooth firmware and chipset identification: firmware version, BT version (4.0–5.4 from LMP), adapter state, LE capabilities (2M PHY, Coded PHY, extended advertising), active profiles (A2DP/HFP/HID/LE Audio), bonded device count. MAC/name opt-in only
• adb_nfc_firmware — NFC controller firmware: controller type (NXP/Broadcom/Samsung/ST), firmware version, supported technologies (NFC-A/B/F/V, MIFARE), secure element (eSE/UICC), HCE support
• adb_gps_firmware — GNSS/GPS chipset and firmware identification: hardware model (manufacturer, chip, firmware), supported constellations (GPS/GLONASS/Galileo/BeiDou/QZSS/NavIC/SBAS), signal types with frequencies, dual-frequency (L1+L5) detection, raw GNSS measurement capabilities, A-GPS modes (MSB/MSA), SUPL server configuration, carrier phase measurements

Workflow Marketplace (3 tools)

• adb_market_search — Search the workflow marketplace for community-shared workflow definitions with keyword and tag filtering. Shows install status
• adb_market_install — Download, validate (JSON structure + SHA-256 integrity), and install a marketplace workflow for immediate use with adb_workflow_run
• adb_market_export — Package a local workflow with marketplace metadata (author, version, tags, SHA-256) and generate a registry manifest entry for sharing

SELinux & Permission Auditing (3 tools)

• adb_selinux_status — SELinux enforcement mode, policy version, shell context, recent AVC denial count. Root provides kernel dmesg denial stats
• adb_selinux_denials — List recent AVC denial messages with parsed source/target contexts, permission classes, and denied operations. Supports process filtering
• adb_permission_audit — Audit runtime permission grants for a package grouped by dangerous permission category (Camera, Location, Phone, SMS, etc.). Flags high-sensitivity grants

Thermal & Power Profiling (3 tools)

• adb_thermal_snapshot — Capture all thermal zone temperatures, per-CPU frequencies/governors, cooling device states, battery temperature/current/voltage/power draw. Optional save as JSON baseline
• adb_thermal_compare — Compare current thermal state against a saved baseline with per-zone temperature deltas and battery current changes
• adb_battery_drain — Measure battery drain rate over a configurable duration (3-60s). Reports average mA, mW, estimated %/hour. Optional package-specific batterystats

Network Discovery (3 tools)

• adb_network_scan — Scan the local network for ADB-enabled devices via ARP table and optional IP range sweep. Probes ports 5555-5558 with batched parallel TCP probes
• adb_network_device_ip — Get the WiFi IP of a connected device via multiple methods. Shows ADB TCP status and wireless connection instructions
• adb_network_auto_connect — One-step discover + connect: scans for ADB devices and automatically runs adb connect on each found listener

Hardware Sensor Access (2 tools)

• adb_sensor_read — Read current hardware sensor values via dumpsys sensorservice. Enumerates all sensors with vendor, type, mode, rate range, and wake capability. Returns last-known readings with timestamps and axis-labeled formatting. Category filter (13 categories) and listOnly discovery mode. No root required
• adb_iio_read — Read raw hardware data from the Linux IIO subsystem. Auto-discovers IIO devices, classifies by kernel driver. On Tensor/Exynos: exposes per-rail ODPM power monitors showing real-time power consumption per SoC subsystem. Generic IIO path handles raw channels with calibrated scale+offset. Root required

Result Handles (3 tools)

• adb_result_list — List active result handles in the tempdir-backed cache. Shows tool, name, size, age, and remaining TTL for each handle
• adb_result_get — Retrieve the content of a stored handle by tool + name. Returns the original content blocks as the source tool produced them; updates last-accessed time. For URI-based retrieval, use the result://{tool}/{name} MCP Resource instead
• adb_result_drop — Delete a stored result handle, or clear all handles in the current namespace. Pass both tool and name to drop one specific handle, or all: true to drop everything. Useful before changing DA_AUTH_TOKEN (which would otherwise leave orphans under the old token-hash directory)

MCP Resources (5)

Read-only device state surfaces accessible by MCP clients:

• device://list — List of all connected devices with state and model info
• device://info/{serial} — Device properties (model, OS, build, ABI)
• device://battery/{serial} — Parsed battery status (level, charging, temperature, voltage)
• device://telephony/{serial} — Telephony registry state for cellular analysis
• result://{tool}/{name} — Stored tool result handle. Resolve by URI; created by tools that opt into result-handle storage via the result_handle parameter. Listed by adb_result_list

MCP Prompts (4)

Pre-built workflow templates for common multi-step debugging tasks:

• debug-crash — Clear logcat → restart app → wait for reproduction → capture crash buffer → analyze
• deploy-and-test — Build → install → clear logcat → start watcher → launch → screenshot → report
• telephony-snapshot — Capture telephony state, SIM/network operator, network type → summarize anomalies
• airplane-cycle-test — Start watcher → baseline telephony → cycle airplane mode → compare pre/post state

Key Features

Device Caching

Device discovery results are cached with a configurable TTL (default 5s), eliminating redundant adb devices subprocess calls during rapid tool sequences. Cache auto-invalidates on connection errors and after wireless connect/disconnect/pair operations.

Transient Failure Retry

The ADB bridge automatically retries on transient failures (device offline, connection reset, protocol fault) with configurable retry count and exponential backoff. Diagnostic commands skip retries to surface real issues immediately.

Output Protection

All ADB output passes through the OutputProcessor which normalizes line endings, enforces configurable character limits, and provides contextual truncation at logical boundaries (line breaks, section separators) rather than cutting mid-line. Includes structured parsers for battery, meminfo, and getprop output.

Persistent Logcat Streaming

Background logcat watchers run as spawned processes with ring buffer accumulation. Each poll returns only new lines since the last read. Supports multiple concurrent sessions (up to 10) with independent filters. Process cleanup handlers prevent orphaned adb logcat processes on server exit.

UI Hierarchy Analysis

Full view tree capture via uiautomator dump with parsed XML extraction. Returns structured element data including text, resource-id, content-description, class names, bounds coordinates with tap-ready center points, and interaction flags. Pre-compiled regex attribute extraction for efficient parsing.

Security Middleware

DA_SECURITY=true enables command blocklist/allowlist filtering and rate limiting on middleware-checked paths, including generic shell, workflow shell steps, and selected input/automation tools. Checked commands are logged with credential redaction by default. These controls are not a global per-tool policy or complete audit trail: dedicated tools such as adb_reboot and adb_wifi call the bridge directly. Use DA_TOOL_PROFILE=inspect for an enforced three-tool read-only catalog; command allowlisting alone does not make full read-only. See SECURITY.md for deployment recipes and limits.

Input Sanitization

All tools that interpolate user-supplied parameters into shell command strings validate inputs against shell metacharacters before execution. Package names, property keys, service names, setting keys, test identifiers, network interface names, and tcpdump filters are all validated through a centralized validateShellArg() function that rejects ;, |, &, $, backticks, parentheses, and other injection vectors. File paths use single-quoted shell escaping to prevent $() command substitution. The adb_input tool applies type-specific validation: tap/swipe accept only numeric coordinates, keyevent accepts only alphanumeric keycodes, and text is shell-escaped for literal delivery. The adb_batch_actions tool enforces the same per-action-type validation (digits-only for coordinates, alphanumeric for keycodes, shell-escape for text) and routes every assembled command through the security middleware. Deserialized JSON from snapshot files is validated before shell interpolation. Every z.number() parameter across all 209 tools has explicit .min()/.max() Zod bounds to prevent resource exhaustion from extreme values. The LocalBridge has explicit handlers for every ADB subcommand used by tool modules, preventing unquoted fallthrough to the default shell handler. In on-device mode, privilege escalation uses a frozen 16-command allowlist and restricted-path regex — the elevation set is ReadonlySet + Object.freeze, not configurable at runtime. The HTTP/SSE transport denies cross-origin requests by default (configurable via DA_HTTP_CORS_ORIGIN), the plugin registry verifies SHA-256 integrity hashes and prevents path traversal via directory containment checks, and the workflow engine enforces step count (200), sleep duration (5 min), and repeat iteration (100) limits. Fetch helpers enforce a 5 MB response body limit. Getprop output parsing handles Windows \r\n line endings via .trim() before regex matching, and dual SIM slot counts are capped at 4 to prevent resource exhaustion from corrupted device properties.

Multi-Device Orchestration

Run commands, install APKs, and compare outputs across multiple connected devices in parallel. Essential for comparative testing across Android versions and device models.

Snapshot/Restore

Capture comprehensive device state snapshots (packages, settings across all namespaces, system properties) to JSON files. Compare current state against saved snapshots to detect drift. Restore settings from snapshots for reproducible test environments.

Network Traffic Capture

On-device packet capture via tcpdump with pcap file pull for Wireshark analysis. Includes active connection listing via ss/netstat with /proc/net fallback for devices without those tools.

CI/CD Integration

Purpose-built tools for automated pipelines: wait for device boot with polling, structured readiness checks, and instrumented test execution with parsed pass/fail results.

Plugin Architecture

Dynamic tool module loading from a configurable plugins directory. Plugins are standard JavaScript ESM modules that export a register(ctx) function receiving the full ToolContext. Loaded at server startup, enabling community contributions without modifying core code.

The SDK v2 server preserves legacy plugin .tool(), .prompt(), .resource(), and register*() calls through a compatibility adapter, including Zod 3/4 validation, prompt argument completions, callback context, and registration updates. Async registration is awaited. Existing v1 SDK imports remain available. Cancelled or disconnected plugin callbacks cannot use their retained legacy or adapted v2 request/notification helpers to contact the next client. Typed plugins keep ToolContext for legacy callback fields such as extra.signal; new plugins can use NativePluginToolContext for v2 fields such as context.mcpReq. Direct low-level SDK request handlers require migration to v2; SDK-private internals and experimental task APIs are outside this adapter.

Community Plugin Registry

Search, install, and manage plugins from an operator-configured registry URL. DeepADB ships no default registry; set DA_REGISTRY_URL to a manifest URL you trust before searching or installing. Shows install status, version comparison, and available updates. Downloads plugin files with companion metadata into the plugins directory for loading on next restart. Installation requires a matching SHA-256 hash in the manifest; missing or mismatched hashes are rejected. Other checks include path traversal protection and register() export sanity checking. A matching hash verifies consistency with the manifest, not the trustworthiness of its publisher or plugin code.

Baseband/Modem Integration

Deep cellular radio inspection tools for advanced Android development and research. Extracts modem firmware identification, cell identity parameters (CID, TAC, EARFCN, PCI), raw signal measurements (RSRP, RSRQ, SINR), neighboring cell surveys, carrier configuration, and multi-source modem logs (RIL radio buffer, telephony framework, kernel dmesg). Supports Shannon/Exynos, Qualcomm, MediaTek, and Unisoc chipset families via standard Android telephony APIs. Includes Google Tensor SoC detection (gs101/gs201/zuma/zumapro) for automatic Shannon modem path routing on Pixel 6–9 devices. Dual SIM detection reports per-slot SIM state, operator, network type, and country for DSDS, DSDA, and TSTS configurations.

Accessibility Auditing

Targeted accessibility checks on the live Android UI hierarchy. Detects missing labels on interactive elements, undersized touch targets below the Android 48dp recommendation (density-aware), images without content-descriptions, clickable elements missing focusability, and duplicate content-descriptions. Generates structured reports with severity levels and includes an accessibility tree view for screen reader debugging. These checks do not constitute a complete WCAG conformance assessment or replace testing with assistive technology.

Regression Detection

Capture performance baselines (memory, CPU, frame stats, battery, network state) and compare subsequent runs against them. Configurable regression thresholds for memory (+20%), CPU (+50%), and jank rate (+25%). Maintains a history of baselines for trend analysis across releases.

Device Farm Integration

Cloud-based test execution via Firebase Test Lab through the gcloud CLI. Run instrumented tests across multiple device models and API levels, retrieve structured results, and list available test matrix configurations. Graceful fallback with setup instructions if gcloud is unavailable.

HTTP Transport and Tool Profiles

The SDK v2 migration retains existing client configurations: stdio remains the default, /sse and /message retain the legacy SSE protocol, and /ws remains available. Negotiated protocol revisions through 2025-11-25 are preserved. Streamable HTTP is available at /mcp on the same HTTP port. The 2026-07-28 protocol lifecycle is not enabled.

Alternative to stdio for browser-based and native MCP clients. Set DA_HTTP_PORT to start an HTTP server providing /mcp (Streamable HTTP), /sse (legacy client subscription), /message (legacy JSON-RPC), and /health endpoints. Set DA_HTTP_CORS_ORIGIN to an exact HTTP(S) origin or comma-separated list. Unlisted Origins are rejected with HTTP 403 before session handling. Browser preflights permit MCP-Protocol-Version; actual MCP requests still require the configured bearer token. Requests without Origin remain supported for native clients.

/mcp supports POST, GET and DELETE with an exposed Mcp-Session-Id header. One client is active across /mcp and legacy SSE. A new /mcp session cannot displace an active SSE client, and a new SSE client cannot displace an active /mcp session; these attempts receive 409. A second authorized SSE client replaces the previous SSE connection for compatibility. Competing /mcp initializations receive 409 except for the guarded browser-reload recovery described below. Streamable HTTP sessions expire after 30 idle minutes by default; active MCP requests and bounded uploads suspend the countdown until work completes. An open notification stream alone does not prevent expiry, and DELETE can still terminate an active session. If a browser loses its ID on reload, a valid initialization from the same Origin can reclaim the slot after its notification stream disconnects and all active calls, uploads and response streams finish. Native/POST-only clients retain explicit DELETE/expiry behavior; an open client or server-initiated stream close cannot trigger this recovery. Legacy SSE messages must use the current connection’s advertised sessionId; stale messages cannot execute after replacement. Plugins and device managers initialize once per process, including across reconnects.

/mcp rejects duplicate in-flight request IDs and repeated IDs within a batch before dispatch (HTTP 400, JSON-RPC -32600), so a conflicting request cannot release another tool’s protection against expiry or reconnect. Rejected batches execute no partial work.

DA_TOOL_PROFILE=full preserves the full catalog and existing plugins. DA_TOOL_PROFILE=inspect exposes only adb_devices, adb_device_info and adb_getprop. Excluded tools cannot be called directly; plugins, workflows, resources and prompts are unavailable, and configuring GraphQL fails startup. See Local LLM clients for setup and session behavior.

Test Session Management

Structured test workflows with numbered steps. Each step captures a screenshot and logcat snapshot into an organized directory with a Markdown manifest. Designed for reproducible test documentation.

AT Command Interface

Direct AT command passthrough to the modem via root access, enabling raw interrogation beyond the Android telephony framework. Multi-chipset support auto-detects device nodes for Samsung Shannon/Exynos, Qualcomm Snapdragon, MediaTek, Unisoc/Spreadtrum, and generic USB modems. Input validation rejects shell metacharacters from both AT command strings and device node paths before root shell interpolation. A safety blocklist prevents accidental execution of dangerous commands (AT+CFUN=0, AT+EGMR, etc.) with an explicit force override.

Screenshot Diffing

True pixel-level visual regression detection. Captures named screenshot baselines and compares the current screen state by decoding PNG pixel data (IHDR parsing, IDAT decompression, all 5 PNG filter types) and comparing actual RGB values. Reports changed pixel count and percentage, bounding box of the changed region with vertical screen position, and dimension/size deltas. Supports a tolerancePercent parameter (0–100) that absorbs minor dynamic changes like clock displays or notification badges — a 1% tolerance reliably absorbs nav bar clock changes (~0.5% of pixels) while catching any real UI regression. SHA-256 fast-path for exact matches. Zero external dependencies.

Workflow Orchestration

Declarative JSON workflow engine for repeatable multi-step device operations. Supports variable substitution ({{pkg}}), conditional steps (if expressions with ==, !=, contains), loops (repeat, capped at 100 iterations), and result capture into variables for downstream steps. Actions map directly to ADB bridge operations with full security middleware enforcement. Workflow validation enforces a 200-step maximum and 5-minute sleep cap per step to prevent resource exhaustion from malicious or malformed workflow definitions.

Split APK Management

Support for modern Android delivery formats. Install app bundles via install-multiple, inspect split APK structure (base + config splits for language, density, ABI), extract all splits locally for analysis, and list APEX modules.

Device Mirroring

Live screen mirroring via scrcpy integration. Supports windowed mode for visual feedback and headless mode for recording-only workflows. Per-device session tracking enables simultaneous mirroring of multiple connected devices. Process cleanup handlers prevent orphaned scrcpy processes.

Automated Test Generation

Analyzes live UI hierarchy and package intent registrations to auto-generate test workflow JSON compatible with the workflow orchestration engine. UI-based generation taps each interactive element, screenshots, and checks for crashes. Intent-based generation launches each exported activity with crash detection.

OTA Update Monitoring

Tracks comprehensive system fingerprint (build ID, Android version, security patch, bootloader, baseband firmware, kernel version, A/B partition slot) across sessions. Compares current state against saved fingerprints to detect OTA updates. Identifies exactly which fields changed and recommends re-baselining performance metrics and screenshots after updates.

RIL Message Interception

Persistent Radio Interface Layer message capture from the Android radio logcat buffer. Spawns a background process that accumulates and categorizes RIL messages into: registration, cell_info, signal, network, security, handover, data, radio_state, sms, and NAS events. Poll-based retrieval with category filtering. Useful for passive monitoring of baseband-framework communication for radio diagnostics and cellular network research. Session limit (5) and process cleanup handlers prevent resource exhaustion.

Device Profile Library

Device-specific knowledge base containing hardware identification, chipset family, known modem device nodes, AT command compatibility, root requirements, dual SIM slot count, and quirks. Auto-detects profiles from connected devices and matches against a built-in library of known devices. Saved profiles persist across sessions and improve auto-detection accuracy for tools like adb_at_detect. Community-extensible through saved profile files.

WebSocket Transport

Alternative to stdio and HTTP for native clients that support WebSocket. Requires the optional ws npm package. Set DA_WS_PORT to enable. Authentication and Origin checks run before upgrade; a second active client receives HTTP 409. Browser clients needing bearer headers should use Streamable HTTP or legacy SSE because the native browser WebSocket API cannot set arbitrary Authorization headers.

Modem Firmware Analysis

Comprehensive multi-component firmware identification, diffing, and history tracking. Parses baseband version strings for 6 chipset families: Shannon/Exynos (including Google Pixel/Tensor g5123b-* format and classic Samsung S5123AP_CL* format), Qualcomm MPSS branch/version/build, MediaTek MOLY branch/release/milestone, Unisoc/Spreadtrum SoC model/version, HiSilicon/Kirin model/carrier code, and Intel XMM model/branch. Also parses bootloader versions (Pixel codename/version/build, Samsung model/carrier/revision) and RIL implementation strings (Samsung S.LSI vendor/id/API/build date, Qualcomm, MediaTek). The firmware probe reports 8 sections: baseband, bootloader, RIL, kernel, security/build, partition/boot (A/B slot, secure boot, verified boot, flash lock), VBMeta integrity, and OTA partition inventory. The diff tool compares all firmware components between saved fingerprints or live device state, with deep parsed sub-diffs for baseband and bootloader. The history tool tracks multi-component firmware progression across OTA fingerprints.

Workflow Marketplace

Community sharing layer for the workflow orchestration engine. DeepADB ships no default marketplace; configure a trusted manifest with DA_WORKFLOW_REGISTRY_URL, or derive it from DA_REGISTRY_URL by replacing registry.json with workflows.json. Search for shared test workflows, diagnostic sequences, and audit procedures. Download and install workflows for execution with adb_workflow_run; installation requires a matching SHA-256 hash in the manifest. Export local workflows with marketplace metadata and auto-generated registry manifest entries for submission. Review the source and workflow actions before running them.

GraphQL API

Optional HTTP endpoint serving a GraphQL API for composed device queries. Enables clients to fetch device info, battery, network, and arbitrary properties in a single request instead of multiple MCP tool calls. POST body size limited to 1 MiB. Device properties are pre-fetched once per resolution to minimize subprocess calls. Requires the optional graphql npm package. Set DA_GRAPHQL_PORT to enable in the full profile; query and work budgets are documented in SECURITY.md.

Request validation and known limit errors remain actionable. Unexpected request/resolver failures return generic errors, with backend diagnostics kept on server stderr. GraphQL execution errors retain the normal errors[]/data shape with HTTP 200; unexpected request-handler failures use HTTP 500. See SECURITY.md for the error boundary.

SELinux & Permission Auditing

Inspects SELinux enforcement mode, queries AVC denials from logcat and kernel audit logs, and audits runtime permission grants per package. Groups granted permissions by dangerous category (Camera, Location, Phone, SMS, etc.) and flags high-sensitivity grants like background location and manage-external-storage. Extends the security auditing surface to the OS permission layer.

Thermal & Power Profiling

Captures thermal zone temperatures from sysfs, per-CPU frequency scaling states and governors, cooling device activity, and battery drain rates. Complements regression detection with thermal/power baselines for issues that manifest as heat or battery drain rather than frame drops. Includes timed drain measurement with mA/mW/estimated-%per-hour calculations.

Network Device Discovery

Scans the local network for ADB-enabled devices via ARP table queries and optional IP range sweeps. Probes common ADB ports (5555-5558) with batched parallel TCP connection attempts. Extracts device WiFi IPs via multiple methods. Auto-connect mode discovers and connects to devices in one step. Streamlines wireless debugging workflows.

QEMU/KVM Virtualization

On-device virtual machine management using QEMU with KVM hardware acceleration. Enables running guest Android VMs directly on the physical device — a capability unique to DeepADB. Dynamic resource allocation auto-detects host CPU cores and physical RAM, reserving 1 core and 35% of memory for the host OS to prevent starvation. Multi-VM support tracks resource consumption across concurrent VMs, refusing new VMs when the pool is exhausted rather than degrading host performance. Disk image management with qcow2 (sparse, snapshot-capable) and raw formats. ADB port forwarding to guest VMs enables DeepADB’s full tool suite to target both host and guest devices simultaneously. Process lifecycle tracked via the centralized cleanup registry with SIGTERM/SIGKILL shutdown. Path containment verification on all image operations prevents directory traversal.

ToolContext Architecture

All 49 built-in tool modules receive a unified BuiltinToolContext dependency bundle containing server, bridge, deviceManager, logger, security, and config. Adding new cross-cutting dependencies requires no module signature changes.

Environment Variables

Project Structure

DeepADB/
├── src/
│   ├── index.ts                # Entry point — stdio, HTTP, WebSocket, plus optional GraphQL
│   ├── server.ts               # MCP server wiring, config, module registration (exports CreateServerResult)
│   ├── http-transport.ts       # Shared HTTP router, Origin/auth checks and legacy SSE
│   ├── streamable-http.ts      # Bounded /mcp session and Streamable HTTP lifecycle
│   ├── tool-profile.ts         # Startup profile validation and tool admission guards
│   ├── plugin-compat.ts        # Legacy plugin APIs adapted to the v2 server
│   ├── ws-transport.ts         # WebSocket transport (optional `ws` package)
│   ├── graphql-api.ts          # GraphQL API endpoint (optional `graphql` package)
│   ├── tool-context.ts         # Unified dependency bundle (ToolContext interface)
│   ├── bridge/
│   │   ├── adb-bridge.ts       # Core ADB subprocess wrapper, retry logic, error types
│   │   ├── local-bridge.ts     # On-device direct execution bridge with privilege escalation (Termux/local mode)
│   │   └── device-manager.ts   # Device discovery, TTL cache, serial routing
│   ├── tools/
│   │   ├── health.ts           # Toolchain health check (1 tool)
│   │   ├── runtime-audit.ts    # Unified read-only runtime readiness audit (1 tool)
│   │   ├── device.ts           # Device info and properties (3 tools)
│   │   ├── shell.ts            # Shell and root command execution (2 tools)
│   │   ├── packages.ts         # App lifecycle, install, permissions, intents (12 tools)
│   │   ├── database-inspector.ts # Package-scoped read-only Room/SQLite inspection (1 tool)
│   │   ├── files.ts            # File operations — push, pull, write, find, grep, replace, stat, checksum, chmod, chown, touch, fsinfo (18 tools)
│   │   ├── logs.ts             # Logcat snapshots — filtered (3 tools)
│   │   ├── logcat-watch.ts     # Persistent logcat with ring buffer and poll (4 tools)
│   │   ├── diagnostics.ts      # dumpsys, telephony, battery, network, perf, bugreport, crash logs, heap dump (9 tools)
│   │   ├── ui.ts               # Screenshots, input, activity, UI hierarchy, annotated screencap, screen state (8 tools)
│   │   ├── input-gestures.ts   # Drag, long press, double tap, text, URL, orientation, clipboard, tap-element, wait-element, wait-stable, scroll-until, compressed screenshot, batch actions, fling, pinch, screen size, device state, notifications (18 tools)
│   │   ├── screen-record.ts    # Screen video recording start/stop (2 tools)
│   │   ├── control.ts          # Airplane, WiFi, data, location, screen, settings, reboot (9 tools)
│   │   ├── wireless.ts         # WiFi pairing, connect, disconnect, TCP/IP (4 tools)
│   │   ├── forwarding.ts       # Port forwarding — forward, reverse, list, remove, managed tunnels with auto-port-pick (8 tools)
│   │   ├── emulator.ts         # AVD list, start, stop with on-device KVM/QEMU detection (3 tools)
│   │   ├── qemu.ts             # QEMU/KVM VM management — setup, images, start, stop, status, guest ADB connect/disconnect/shell (8 tools)
│   │   ├── testing.ts          # Structured test sessions with numbered steps (3 tools)
│   │   ├── multi-device.ts     # Multi-device shell, install, compare, comparative testing (4 tools)
│   │   ├── snapshot.ts         # Device state capture, compare, restore (3 tools)
│   │   ├── network-capture.ts  # tcpdump start/stop, network connections (3 tools)
│   │   ├── ci.ts               # CI wait-boot, device-ready, run-tests (3 tools)
│   │   ├── plugins.ts          # Plugin loader, info, and dynamic tool loading (2 tools)
│   │   ├── baseband.ts         # Modem/baseband inspection and radio diagnostics (6 tools)
│   │   ├── accessibility.ts    # Targeted Android UI accessibility checks (3 tools)
│   │   ├── regression.ts       # Performance baseline and regression detection (3 tools)
│   │   ├── device-farm.ts      # Firebase Test Lab integration via gcloud (3 tools)
│   │   ├── registry.ts         # Community plugin registry search/install (3 tools)
│   │   ├── at-commands.ts      # AT command modem interface, Shannon session, cross-validation (6 tools)
│   │   ├── screenshot-diff.ts  # Visual regression — screenshot baseline/diff (3 tools)
│   │   ├── workflow.ts         # Declarative workflow orchestration engine (3 tools)
│   │   ├── split-apk.ts        # App bundles, split APKs, APEX modules (4 tools)
│   │   ├── mirroring.ts        # Live screen mirroring via scrcpy (3 tools)
│   │   ├── test-gen.ts         # Automated test workflow generation (3 tools)
│   │   ├── ota-monitor.ts      # OTA update monitoring and fingerprinting (3 tools)
│   │   ├── ril-intercept.ts    # RIL message interception from radio buffer (3 tools)
│   │   ├── device-profiles.ts  # Device profile library with built-in entries (3 tools)
│   │   ├── firmware-analysis.ts # Modem firmware version parsing and diffing (3 tools)
│   │   ├── workflow-market.ts  # Workflow marketplace — search, install, export (3 tools)
│   │   ├── selinux-audit.ts    # SELinux status, AVC denials, permission auditing (3 tools)
│   │   ├── thermal-power.ts    # Thermal zones, CPU frequency, battery drain (3 tools)
│   │   ├── network-discovery.ts # ADB-over-network scanning and auto-connect (3 tools)
│   │   ├── app-network.ts      # Per-app UID routing and network-policy context (1 tool)
│   │   ├── wear.ts             # Wear OS Data Layer phone/watch preflight (1 tool)
│   │   ├── sensors.ts          # Hardware sensor enumeration, IIO power monitor reading (2 tools)
│   │   ├── result-handles.ts   # Tempdir-backed result handles — list, get, drop (3 tools) + the result://{tool}/{name} resource
│   │   ├── wireless-firmware.ts # WiFi, Bluetooth, NFC, GPS firmware identification (4 tools)
│   │   ├── build.ts            # Gradle build and install (2 tools)
│   │   ├── resources.ts        # MCP Resources — 4 device-state surfaces: device://info|battery|telephony|list (5th, result://, lives in result-handles.ts)
│   │   └── prompts.ts          # MCP Prompts — workflow templates (4 prompts)
│   ├── middleware/
│   │   ├── auth.ts             # Bearer token authentication for network transports (DA_AUTH_TOKEN)
│   │   ├── origin.ts           # Exact browser Origin and preflight checks
│   │   ├── http-url.ts         # HTTP URL authority formatting, including IPv6 hosts
│   │   ├── graphql-budget.ts   # GraphQL complexity limits and device-operation budgets
│   │   ├── graphql-errors.ts   # Safe public GraphQL errors and internal error masking
│   │   ├── output-processor.ts # Contextual truncation, structured parsers, settledValue helper
│   │   ├── security.ts         # Command filtering, rate limiting, audit logging with redaction
│   │   ├── sanitize.ts         # Shell injection prevention — validateShellArg/validateShellArgs/shellEscape
│   │   ├── chipset.ts          # Shared chipset family detection, modem path mapping, SIM config detection
│   │   ├── fetch-utils.ts      # Shared HTTP helpers with 5 MB streaming response size limit
│   │   ├── png-utils.ts        # Zero-dependency PNG decode/encode/draw primitives for screenshot annotation and diffing
│   │   ├── ui-dump.ts          # Shared uiautomator XML capture with concurrent-safe paths, on-device /data/local/tmp routing, and cleanup
│   │   ├── cleanup.ts          # Centralized process cleanup registry for SIGINT/SIGTERM/exit
│   │   ├── logger.ts           # stderr-safe logging (MCP-compliant)
│   │   ├── fs-utils.ts         # Filename sanitization, atomic write, private-dir helpers, within-dir containment check
│   │   ├── sqlite-path.ts      # Package/database path containment and symlink guards
│   │   ├── sqlite-query.ts     # Bounded, cancellable SQLite query subprocess management
│   │   ├── sqlite-worker.ts    # Read-only host SQLite worker with memory and output limits
│   │   ├── parse-utils.ts      # Shared parseIntSafe for env-var numeric parsing (single source of truth)
│   │   └── result-handle.ts    # Tempdir-backed tool result content cache with TTL, LRU, and token-hash isolation
│   └── config/
│       └── config.ts           # Configuration, env vars, startup validation
├── package.json
├── tsconfig.json
├── server.json                  # MCP Registry metadata (io.github.fullread/deepadb)
├── .gitignore
├── README.md
├── LOCAL_LLMS.md                # stdio/browser setup, tool profiles and session behavior
├── SECURITY.md                  # Threat model, security architecture, deployment hardening, vulnerability reporting
├── CHANGELOG.md                 # Version history from v0.1.0 to current
├── LICENSE                      # Apache 2.0 license
└── tests/
    ├── run-all.mjs              # Run all test suites sequentially with summary (tracks skipped counts)
    ├── test-hw.mjs              # Hardware core: health, identity, baseband, thermal, profiles, wireless firmware, crash analysis (34 tests)
    ├── test-shell-files.mjs     # Shell, filesystem, packages, diagnostics (24 tests)
    ├── test-ui-control.mjs      # UI hierarchy, screenshots, settings, input gestures, UI automation, device awareness, accessibility, screen lock/unlock, multi-touch (46 tests)
    ├── test-monitoring.mjs      # Logcat watchers, snapshots, OTA, regression, workflows (43 tests)
    ├── test-security.mjs        # Input sanitization, shell injection, AT command safety, QEMU shell escaping, heap-dump validation (116 on-device, 105 host)
    ├── test-lifecycle.mjs       # App lifecycle, file push/pull, input, port forwarding, screen recording, test sessions (24 tests)
    ├── test-analysis.mjs        # Thermal/snapshot/regression comparison, firmware diff, screenshot diff, test gen, RIL intercept, AT cross-validation, permission management (23 tests)
    ├── test-boundaries.mjs      # Zod bounds enforcement, input injection, error paths, sensitive data protection, wireless ADB coverage, multi-device basics, tunnel automation, device-free coverage boundaries (78 tests)
    ├── test-sensors.mjs         # HAL sensors, IIO power monitors, category filters, formatting, wake-up, rate display (30 tests)
    ├── test-files-extended.mjs  # File tool coverage — write, find, stat, checksum, mkdir, rm, move, copy, chmod, touch, fsinfo, chown, grep, replace; push safety; sed-escape regression (95 tests)
    ├── test-result-handles.mjs # Result handle store — listing, retrieval, drop, isolation, eviction (19 tests)
    ├── test-qemu.mjs            # QEMU/KVM setup, image management, VM status, guest connectivity errors (13 on-device tests)
    ├── test-qemu-boot.mjs       # QEMU Alpine VM boot with auto-fetch of kernel/initrd, KVM acceleration, topology detection, guest ADB connectivity (17 on-device tests)
    ├── test-supply-chain.mjs    # Supply-chain hardening checks for fetch and network paths (24 tests)
    ├── test-sanitize-fuzz.mjs   # Property-based fuzzing of shell sanitizers — shellQuote/shellEscape round-trip, validateShellArg rejection (19 tests)
    ├── test-transports.mjs      # Transport smoke — HTTP/SSE + WebSocket MCP round-trip, GraphQL devices query and introspection (8 tests)
    ├── test-sdk-compat.mjs      # SDK v1/v2 clients, plugin compatibility, auth and reconnects (37 tests)
    ├── test-browser-access.mjs  # Origin, CORS, auth and WebSocket upgrade checks (14 tests)
    ├── test-local-llm.mjs       # Streamable HTTP lifecycle, clients, plugins and profile restrictions (34 tests)
    ├── test-next-version.mjs    # Focused diagnostic validation and device-free boundaries
    ├── test-runtime-audit.mjs   # Partial failures, backend readiness and retained results (28 checks)
    ├── test-next-version-device.mjs # Live runtime, SQLite, route, Wear and Shannon checks
    ├── test-audit-hardening.mjs # SQLite isolation, path guards, GraphQL budgets and runner failures
    ├── test-code-scanning.mjs   # Bounded auth, safe GraphQL errors and split-APK quoting
    ├── browser/cors.mjs         # Separate real Chromium HTTP/SSE checks (8 tests)
    └── lib/
        └── harness.mjs          # Shared test harness (stdio JSON-RPC transport, assertion primitives)

Tech Stack

• Runtime: Node.js ≥22 (ES2024, ESM)
• Development: a supported LTS Node release, at least 22.16 on the Node 22 line or Node 24+, for the full toolchain and SQLite regression tests. c8 coverage alone requires Node 22.12+ on the Node 22 line.
• Language: TypeScript 6.0 (strict mode, NodeNext module resolution)
• MCP SDK: @modelcontextprotocol/server ^2.4.0 (resolves to 2.4.0); server-legacy 2.4.0 and SDK v1 1.32.2 retained for existing SSE clients and plugins
• Validation: Zod ^4.6.7
• Transport: stdio (JSON-RPC), Streamable HTTP and legacy HTTP/SSE (Node adapter 2.1.2), WebSocket (optional ws), GraphQL API (optional graphql, full profile only)

License

Apache License 2.0 — see LICENSE and NOTICE. The v1.1.2 release migrated from MIT to Apache 2.0 for the explicit patent grant and contributor attribution requirements; existing forks/installs remain valid under the prior MIT terms.