Read Android REA configuration and provider capabilities without starting Java, Python, Ghidra, ADB or an app. Installation checks are not device acceptance.

Create a persistent Android investigation with a question and an explicit evidence ledger. Does not choose or execute a target.

Copy one explicit APK, DEX or ELF SO into a project under its SHA-256 identity. Does not install or execute it. Maximum 512 MiB; source changes are rejected.

Read one persistent investigation, its artifact identities, evidence references and analyst findings. Returned artifact paths resolve in the current workspace.

List bounded retained tool-result metadata. Optionally filter by investigation and exact operation; no analysis or device contact.

Read a retained result by evidence ID and RFC 6901 JSON pointer. Arrays and strings are paged. Large objects return keys for deeper queries; the complete original remains on disk.

Record an analyst-entered observation, inference or unknown with exact evidence references. This records the assertion and does not independently verify it.

Copy the quiescent workspace to a new directory with SHA-256 manifest for migration. Rejects active traces, symlinks and concurrent operations. Excludes the session lock; includes retained app data.

Verify every file of an exported workspace and restore it into a new directory. Never overwrites an existing workspace. Use that directory as output_dir in a new connection.

Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.

Search complete decompiler class-name rows in an explicit local APK by case-sensitive substring. Empty query inventories all rows. Repeated names remain repeated and appear in duplicate_names; the provider accepts only class names for lookup, so these rows do not identify which same-name class node a later lookup selects. Retains artifact and engine identity; no APK execution.

Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and explicit unknown DEX descriptors without generating source. Overload indices remain consistent within the artifact and engine session.

Decompile one Android method with smali fallback. Requires explicit overload_index when multiple methods share a name. Reports representation, fallback markers and source truncation; never treats display signatures as exact DEX identities.

Trace incoming static references to an exact Android class or unique method. Overloaded method reference queries are explicitly unsupported by the current engine. Source lines and DEX offsets remain unknown; no runtime calls are inferred.

Inspect the caller-selected apktool launcher: resolved command, selection source, and version. Decodes nothing. REA never installs Apktool or Java; select a launcher with REA_APKTOOL_COMMAND (absolute) or apktool on PATH.

Decode one local APK's resources with apktool d --no-src in a provider-owned workspace that is removed after projection: the readable AndroidManifest.xml, apktool.yml version and SDK facts, the app's string resources (default or one locale, bounded to 2000 entries), available string locales, and the decoded file count. The target APK is digest with SHA-256 before decoding; smali is skipped because Java-source recovery belongs to the JADX family.

Inspect the caller-selected adb client: resolved binary, version, and install path. Never contacts devices and never starts the adb server. REA never installs platform tools; select a binary with REA_ADB_PATH (absolute) or adb on PATH.

List attached devices exactly as adb devices -l reports them: serial, state, transport, model metadata, and an inferred emulator/physical kind with its evidence basis. Emulators and USB or network devices appear alike; REA neither starts nor manages them. May start the local adb server on first use.

Inspect one device's build identity through a fixed getprop whitelist: Android and SDK versions, security patch, fingerprint, product identity, CPU ABIs, and debuggable flag, plus the observed emulator indicator ro.kernel.qemu. Read-only with respect to the device.

List installed packages on one device with each base APK's device path, optionally scoped to third-party or system packages. Paths are device filesystem paths, not host-local. Read-only.

Pull one installed package's complete APK set (base plus every split, as pm path reports) from the device into a caller-selected output directory, creating a package-named subdirectory that must not already exist. Every pulled file is digested with SHA-256; partial pulls keep successful artifacts and per-file failure reasons. The device keeps the originals.

Read a bounded dump of the device log (logcat -d -t) for one buffer, optionally restricted to a process id. No streaming, no clearing; the newest lines are kept when the count cap trims. Read-only.

Inspect one installed package through dumpsys package: version name/code, install and update times, installer, user id, flags, and the requested-permission count. A fixed projection of version-dependent output; unknown sections are ignored rather than guessed. Read-only.

Pull one absolute device path (a database, shared-preferences XML, or any readable file) into a caller-selected output directory, digesting it with SHA-256. The local copy must not already exist. Read-only with respect to the device.

Push one local file to an absolute device path. The only device-mutating ADB tool: existing device files are refused unless overwrite is explicitly requested, and the transfer is verified by comparing the local digest with the device's own sha256sum when the device provides one.

Capture one frame of the device screen as a PNG (screencap -p through exec-out, no device-side file) into a caller-selected output directory, digesting it and reporting its dimensions. No recording or interaction.

List running processes exactly as ps -A reports them: user, pid, ppid, rss, state, and name. Useful for pairing with instrumentation lanes. Read-only.

List one absolute device directory (ls -la): names, kinds, permissions, owner, group, sizes, dates, and symlink targets. Recognizes the standard errors for absent paths and denied reads. Read-only.

List the device's declared hardware and software features (pm list features) for device fingerprinting. Read-only.

List the device's binder services with their interfaces (service list). Read-only.

Report the display's physical and any overridden size (wm size) and density (wm density) as the device declares them. Read-only; setting values is not exposed.

Report the window manager's current focus declarations (dumpsys window windows: mCurrentFocus and mFocusedApp) — what is on screen at read time without any interaction. Read-only.

Read one settings value (settings get) from the system, secure, or global namespace. Absent keys report the device's own null observation. Read-only; writing settings is not exposed.

Collect one device-generated bugreport archive (adb bugreport) into a caller-selected output directory, digesting the zip. The archive contains the device's own dumpstate, dumpsys, and logcat report; collection can take minutes. Read-only with respect to configuration.

Find installed packages by case-insensitive substring of the package name (e.g. whatsapp → com.whatsapp), returning each match's base APK device path. The first step of an easy get: resolve, then pull_adb_package the exact name. Read-only.

Install one local APK on the device (adb install [-r]), recording the APK's host digest and byte size. A device-mutating tool: replace re-installs over an existing package while keeping its data; the device's own Success/Failure verdict is preserved with its reason.

Uninstall one package from the device (adb uninstall), removing its data for user 0. A device-mutating tool; absent packages report the device's own refusal reason.

Start one installed app by launching its declared launcher activity: the component is resolved through cmd package resolve-activity --brief, then started with am start -n. A device-mutating tool for dynamic-analysis workflows; pair with read_adb_logcat (pid filter) and list_adb_processes to observe the started app, and stop_adb_app to end the run.

Start an intent with am start: one action, optional data URI, optional explicit component, and up to 16 typed extras (string, boolean, int, long, float). A device-mutating tool; the activity manager's Starting/Error verdict is preserved verbatim.

Force-stop every process of one package (am force-stop), ending a dynamic-analysis run. A device-mutating tool; it succeeds whether or not the package had running processes.

Open one local ELF executable or shared library (.so) in an isolated Ghidra session. The input is copied, never executed or modified. Replaces the active ELF session after closing it.

Close the active ELF session and remove its provider-owned temporary project.

Read the active ELF session state without starting a provider.

Inspect the active ELF load image, mapped segments and sections.

Read bytes at an address in the active ELF analysis image.

Resolve an ELF virtual address to its input file offset.

Read the symbol name at an address in the active ELF analysis.

List documents in the current Ghidra ELF session.

List symbol names in the active ELF analysis.

List functions in the active ELF analysis. Open the .so with open_binary first.

List memory segments in the active ELF analysis.

List recognized strings in the active ELF analysis.

Resolve an ELF function name or address to its entry address.

Find the ELF function containing an address.

Search ELF function names using a literal substring or regular expression.

Search recognized ELF strings using a literal substring or regular expression.

Inspect a Ghidra data type by exact name or ELF address.

Inspect the native instruction at an ELF address.

Resolve static call targets of an instruction in the active ELF.

Read a function dossier from the active ELF analysis.

Disassemble one function in the active ELF analysis.

List static callees of an ELF function.

List static callers of an ELF function.

Inspect an ELF function signature, body and metadata.

Decompile one ELF function to Ghidra C-like pseudo-code. Use an entry address from list_procedures when a name identifies both a function body and a thunk.

Read the instruction sequence of an ELF function.

Trace incoming or outgoing static references for an ELF function.

Read static references to and from an ELF address.

Inspect this local Android runtime integration and installed ADB/Frida versions. Does not install software or attach to an application.

Capture an explicit Android device screen, current focus and UIAutomator hierarchy into a new snapshot. Returns node IDs, bounds and artifact hashes. Uses and deletes one owned temporary device XML file. Compose/WebView/custom rendering may expose only partial semantics.

Read a retained local UI snapshot, paging its node list without touching the device. A snapshot node is a visual/semantic observation, not a Java handler identity.

Perform one explicit tap, validated snapshot-node tap, swipe, keyevent, ASCII text input or bounded wait. Captures before/after UI. Use trace_id or up to four trace_ids to mark the actual input across explicit processes, plus optional run_id to retain its result. Markers establish a time window, not causality. Every device/run binding is checked before input.

List Frida process/application targets on one explicit device to choose an exact PID or app. This does not attach to or execute a target.

Start bounded Frida observation of an explicit Android PID or spawn package. Supports exact Java selectors with trace-local loaders, deferred hooks, explicit native decoding, View/JNI and scoped network/storage/Handler/Executor/IPC observers. Scoped observer features need their nonempty scopes. Optional java_deoptimize explicitly changes ART execution throughout this process; inspect java:deoptimization coverage. inspect_trace reports coverage. Up to four distinct explicit targets; no automatic child attachment. run_id must be a retained analysis run. Native decoding relies on caller-supplied ABI meaning; historical registrations and unobserved paths remain unknown.

Page retained events from this connection’s Frida trace. Distinguishes Java/native calls, JNI bindings, UI markers and diagnostics. Preserve truncation and coverage limits; module RVA is not file offset.

Record a caller-labelled marker in an active trace. This provides a timing anchor, not proof of app-side cause and effect.

Stop and detach one trace created by this connection, remove its hooks, and retain its JSONL evidence and summary. Does not force-stop an attached application or restore explicitly deoptimized ART execution.

Map an observed module-relative address into an explicit local ELF’s PT_LOAD segments for REA/Ghidra follow-up. Requires the target page size. Reports separate runtime address, module RVA, ELF virtual address and possible file offset. File identity remains unverified unless the caller supplies a matching runtime artifact digest.

Inspect one trace summary and paged hook coverage: installed, pending, failed and concrete overload/loader identities. Absence of events does not establish absence of execution.

Search loaded Java classes and optionally declared methods in an active trace; reports trace-local classloader identities and explicit truncation. An empty query inventories loaded classes. Discovery does not itself install hooks.

Add exact Java selectors to the same active trace after search_java. Explicit loader IDs are trace-local and must not be copied between traces. Shared observer dispatch preserves original return/exception semantics.

Create a run bound to an explicit ADB serial, Frida device ID and installed package. Collect build/ABI/page-size and up to 16 APK file hashes without launching the app; signature validity is separate. Does not attach or deploy frida-server.

Read a retained run manifest, target identity, registered trace files and storage acquisitions without contacting a device.

Start 1..4 explicit per-process configurations in one retained run, using a shared run_id. Validates all configurations first and detaches newly started traces if a later target fails. Spawned applications may have run; rollback is hook cleanup, not application-state undo. No implicit discovery or attachment to children.

Merge retained run events and its explicitly registered Frida trace files by host receipt time, with pagination. Cross-process Binder entries are observations/candidates; timing and a shared run_id alone are not causal proof.

Read 1..16 exact files inside the selected run package data directories via ADB. With use_root, reuse an existing UID-0 ADB shell or verified su -c / su 0 sh -c; report the selected root_access method. Never restart adbd or change permissions. Can include existing SQLite WAL/SHM sidecars. Checks device hashes before/after; no force-stop. Sequential capture is not an atomic SQLite/device snapshot. Pass the returned logical_root directory to snapshot_storage; never infer consistency solely from a successful pull.

Create a bounded local snapshot of explicit acquired files/directories, including hashes, preference XML and SQLite data. Works on owned copies with WAL handling; never modifies source files. For before/after acquisitions use paths=[each acquisition logical_root] so relative keys match. Reports consistency and truncation limits; device atomicity is not inferred.

Page retained local storage snapshot file records without contacting a device.

Compare two retained storage snapshots by stable relative keys, showing file, XML preference and SQLite changes with explicit truncation/consistency limitations.