Skip to main content
Glama

android_api_extractor

Decompile an APK to extract Retrofit and OkHttp3 API endpoints from smali bytecode, then output a plain endpoint list or Postman collection for API analysis.

Instructions

Decompiles an APK and extracts Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode. Outputs a list of API endpoints or a Postman collection.

Input Schema

NameRequiredDescriptionDefault
apk_pathNoAbsolute path to the APK file to decompile and analyze
smali_folderNoAbsolute path to an already-decompiled smali folder (skips apktool step)
output_formatNoOutput format: plain text list or Postman collection JSONtxt

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.1.1

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure, and it does reveal the two-phase nature (decompile, then extract) and the two output shapes. It omits important operational context: external dependencies such as apktool/Java, expected runtime on large APKs, and what happens when no annotations are found or the APK fails to decompile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the primary action and data source front-loaded and the output described last. Nothing is repeated and nothing needs trimming.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but the description still names both return shapes, which is what an agent needs to pick an output_format. Combined with full schema coverage of inputs, the definition is sufficient to invoke the tool correctly, though a note about apktool prerequisites would be a bonus.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all three parameters are already documented, including the txt/postman enum. The description only echoes the output_format choice ("list of API endpoints or a Postman collection") without adding format details, and says nothing about the apk_path vs smali_folder tradeoff beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb chain (decompile, extract) plus the exact resource (Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode), which no sibling tool covers — siblings handle manifests, permissions, secrets, and frameworks. An agent can tell this is the endpoint-extraction tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose implies when to use it (you want API endpoints from an Android app), but there is no explicit when/when-not guidance and no sibling or alternative is named. The description never mentions that callers can either supply an APK or a pre-decompiled smali folder, leaving that routing decision entirely to the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.