Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| connect | Connect to the Frida gadget on the device. Performs adb port forwarding (tcp:14725) and connects to the zygisk-gadget. Call this before any other operation. |
| list_apps | List running applications on the connected device. Returns application identifier, name, and PID. |
| execute | Inject a Frida JavaScript script into the frontmost application. The script is automatically wrapped with try-catch for safety. Returns immediately after injection - use get_messages() to retrieve results after the user has triggered the target functionality. Args: script: Frida JavaScript code to inject. Use send() to return data. script_file: Path to a .js file to inject. Use this for large scripts instead of script parameter. |
| get_messages | Get messages collected from the injected script's send() calls. Call this after the user has triggered the target functionality. Args: limit: Maximum number of messages to return (default 50). offset: Skip first N messages for pagination. save_to_file: If True, save all messages to a JSON file and return the path. |
| logcat | Get Android logcat output. Useful for debugging crashes after script injection. Args: filter: Optional filter string (case-insensitive match on each line). lines: Number of recent lines to fetch (default 100). clear: If True, clear logcat buffer before fetching. |
| spawn_and_inject | Kill app, relaunch, connect, and inject script in one step. Use this when you need to hook early initialization (e.g. onCreate, static initializers). Equivalent to: kill_app -> launch_app -> connect -> execute. Args: package: The app package name (e.g. com.taobao.taobao). script: Frida JavaScript code to inject at startup. Use send() to return data. script_file: Path to a .js file to inject. Use this for large scripts. |
| launch_app | Launch an Android app by package name. Args: package: The app package name (e.g. com.example.app). |
| kill_app | Force stop an Android app by package name. Args: package: The app package name (e.g. com.example.app). |
| reconnect | Reconnect to the gadget after an app crash. Detaches current session, re-establishes adb forwarding, and reconnects. After reconnect, restart the target app and call execute() again. |
| detach | Detach from the current session and unload any injected scripts. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |