Termux-MCP

A lightweight HTTP server that runs inside Termux on Android, exposing shell execution and device capabilities as a streaming API. Built for AI agents, LLM tool-calling, and automation scripts.

AI Agent --> POST /run {"cmd": "ls -la"} --> Termux-MCP --> Termux Shell
                                                  |
                      <-- chunked streaming output -+

Two commands — which do I run?

Both install together via pkg install termux-mcp and run as separate processes — starting termux-native-mcp never touches the REST daemon’s port, state or behavior.

termux-mcp                  # REST API on 127.0.0.1:8080
termux-native-mcp           # native MCP, Streamable HTTP on 127.0.0.1:8081
termux-native-mcp --stdio   # native MCP over stdin/stdout (desktop clients)

RikkaHub (same phone):

{
  "type": "http",
  "url": "http://127.0.0.1:8081/mcp",
  "commonOptions": {
    "name": "Termux",
    "enable": true,
    "headers": [["Authorization", "Bearer "]]
  }
}

Desktop MCP client (over ssh): {"command": "ssh", "args": ["android", "termux-native-mcp", "--stdio"]}

Full guide, env vars and tool list: docs/mcp.md. Both servers share the same safety system (risk gates, file snapshots, trash) because they run the same handler code.

Installation

pip (recommended)

pkg update && pkg install python -y
pip install termux-mcp
termux-mcp

This installs a global termux-mcp command — it runs from any directory, and pip install -U termux-mcp upgrades it.

From a clone

pkg update && pkg install python git -y
git clone https://github.com/termuxgpt/termux-mcp
cd termux-mcp
pip install .
termux-mcp

pip install . registers the command globally, so the cd is only needed for the install itself. Without it, python -m termux_mcp only works from inside the clone.

Package repository

curl -fSL https://termux-mcp.pages.dev/add-repo.sh | bash
pkg install termux-mcp
termux-mcp

Quick Test

curl http://localhost:8080/ping
curl -X POST http://localhost:8080/run -H "Content-Type: application/json" -d '{"cmd": "ls ~"}'

Termux Tutorial Apps (AD)

Configuration

Set TERMUX_MCP_AUTH_TOKEN to a value 16+ characters long to require authentication on all endpoints. When binding to a non-loopback address, authentication is mandatory.

Endpoints

Shell & Filesystem

System Monitor & Management

Cron Scheduler

Backup, Restore & Cloud Sync

Code & Files

Device & Sensors

Communication

Network

Media

Smart Tools

Git Operations

SSH, Services & Migration

Other

Streaming Output

The /run endpoint and most tool endpoints use HTTP chunked transfer encoding. Output is sent line-by-line as the command produces it. Clients should read the response as a stream and process each chunk as it arrives.

For long-running commands, a watchdog thread enforces the timeout. Package install commands automatically receive -y flags and DEBIAN_FRONTEND=noninteractive to prevent prompts.

Security

• Command injection. Every parameter interpolated into a shell command is quoted with shell_quote, and every numeric parameter is validated by require_number/require_int — a value that is not a number is rejected, not passed through. Parameters embedded in double-quoted echo arguments are quoted as whole strings, since double quotes still permit $(...).
• Risk gate. Commands are assessed before execution. The DANGEROUS tier (e.g. rm -rf /, mkfs., writes to /dev/, chmod -R 777) is refused on every shell-backed endpoint — the check lives in the shared executor, so a new endpoint cannot forget it. The WARNING tier (package removals, recursive deletes) requires an explicit confirmed: true on /run.
• Sensitive writes. /write and /patch can edit anything outside /dev, /proc and /sys — that is the point of them — but paths that grant persistence require confirmation: ~/.ssh/, ~/.bashrc, ~/.profile, ~/.termux/ (including boot/), and anything under $PREFIX. These are an SSH backdoor, code run on shell start, and code run at device boot respectively.
• Authentication. With TERMUX_MCP_AUTH_TOKEN set, every endpoint requires a Bearer token — POST, GET (except /ping, which the client’s connectivity probe needs before it holds a token), and the WebSocket, which accepts the token via the Authorization header or a ?token= query parameter. Non-loopback binding enforces mandatory authentication.
• Network. A request carrying an Origin header is rejected unless that origin is allowlisted, so a page open on the device cannot reach the server by resolving its own hostname to loopback. Requests with no Origin (the app, curl, stdio clients) are unaffected.
• Request body size is capped at 5 MB; WebSocket frames at 8 MB.
• Request bodies are not logged — only their size.
• Each WebSocket connection keeps its own cd state. Over HTTP the working directory is process-wide and shared between clients, so one caller’s cd affects the next; chain cd x && cmd if you need isolation.

License

GNU Affero General Public License v3.0 (AGPL-3.0)

Copyleft — anyone who distributes a modified version, or hosts it as a service (SaaS), must release their changes under the same license.

Note: versions up to 0.8.3 were released under the MIT License; those releases keep their MIT terms. AGPL-3.0 applies from 0.8.4 onward.