Android Forensics ADB MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| capture_logcatA | Capture Android system logs (logcat). Critical for understanding device activity and app behavior. Args: output_file: Path to save the logcat output device_id: Optional device serial number lines: Number of log lines to capture (default 10000) filter_spec: Optional logcat filter (e.g., "*:W" for warnings+) include_timestamps: Include timestamps in output |
| capture_dmesgA | Capture kernel ring buffer (dmesg). Contains hardware events, driver messages, and security-related logs. Args: output_file: Path to save dmesg output device_id: Optional device serial number Note: May require root access on some devices. |
| check_root_statusA | Comprehensive root/jailbreak detection. Checks multiple indicators of device rooting. Args: device_id: Optional device serial number |
| get_installed_packagesA | Get list of all installed packages with details. Essential for identifying installed applications. Args: device_id: Optional device serial number include_system: Include system apps output_file: Optional path to save results as JSON |
| dump_system_settingsA | Dump all system settings (secure, system, global). Reveals device configuration, security settings, and user preferences. Args: device_id: Optional device serial number output_file: Optional path to save results as JSON |
| analyze_network_connectionsA | Analyze active network connections and configuration. Identifies connected networks, open ports, and suspicious connections. Args: device_id: Optional device serial number output_file: Optional path to save results as JSON |
| get_running_processesA | Get list of running processes. Identifies active applications and background services. Args: device_id: Optional device serial number output_file: Optional path to save results as JSON |
| extract_with_rootA | Extract files using root privileges. Bypasses Android security restrictions for forensic acquisition. Args: remote_path: Path on device (e.g., /data/data/com.whatsapp) local_path: Local destination path device_id: Optional device serial number Warning: Requires rooted device. May trigger security alerts. |
| analyze_partition_infoA | Analyze device partitions and mount points. Essential for understanding device storage layout. Args: device_id: Optional device serial number output_file: Optional path to save results as JSON |
| get_account_infoA | Get registered accounts on the device. Identifies Google, social media, and other linked accounts. Args: device_id: Optional device serial number output_file: Optional path to save results as JSON |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Each tool targets a distinct forensic data source or action: root status, logcat, dmesg, packages, settings, network, processes, file extraction, partitions, and accounts. There is no overlap; even capture_logcat and capture_dmesg are clearly differentiated as system/app logs vs kernel buffer.
All tool names follow a consistent verb_noun pattern using snake_case (check_root_status, capture_logcat, get_installed_packages, etc.). The verbs are varied but predictable, and the structure is uniform across the set.
10 tools is well-scoped for an Android forensics server, covering the major data sources without unnecessary redundancy. The count falls comfortably within the ideal 3-15 range, and each tool earns its place in the toolkit.
The set covers core forensic acquisition and analysis: device status, logs, installed apps, settings, network, processes, file extraction, partitions, and accounts. Minor gaps exist, such as dedicated tools for SMS/call logs or media files, but the generic extract_with_root can access these if the path is known, making it a workable limitation.