Skip to main content
Glama

decode_android_resources

Idempotent

Decode an APK’s resources to extract readable AndroidManifest.xml, version and SDK facts, string resources for a locale, available locales, and decoded file count.

Instructions

Decode one local APK's resources with apktool d --no-src in a provider-owned workspace that is removed after projection: the readable AndroidManifest.xml, apktool.yml version and SDK facts, the app's string resources (default or one locale, bounded to 2000 entries), available string locales, and the decoded file count. The target APK is digest with SHA-256 before decoding; smali is skipped because Java-source recovery belongs to the JADX family.

Input Schema

NameRequiredDescriptionDefault
pathYesLocal APK file to decode
localeNoProject strings from res/values-<locale>/strings.xml instead of the default table
include_stringsNoProject res/values/strings.xml entries (bounded to 2000 entries)
analysis_project_idNoOptional investigation to retain this tool result in. Does not prove target identity or causal relationships.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.4.0

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond the annotations: a provider-owned workspace is created and removed after projection (explaining why readOnlyHint=false while destructiveHint=false), the APK is SHA-256 hashed, and string projection is bounded to 2000 entries. That is exactly the context the hints alone cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each front-loaded with the action then the output list. Dense but nearly every clause carries information; the trailing JADX remark is short and useful. Slightly heavy for an agent skimming many tools.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return-value burden and does so: manifest, apktool.yml version/SDK facts, strings, locale list, and decoded file count. Combined with the hashing and workspace-cleanup notes, nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reiterates 'default or one locale' and the 2000-entry bound, which the schema already documents, and it says nothing about analysis_project_id or the mutually-exclusive feel of locale vs include_strings. Marginal value added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (decode), a specific resource (one local APK's resources), and the exact mechanism (apktool d --no-src). It then enumerates the projected outputs and explicitly scopes out smali, which belongs to the JADX family, so the agent can separate it from the android inspection siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the input must be a local APK and routes Java-source recovery to the JADX family, which is a real exclusion. However, with siblings like pull_adb_package and inspect_android_package present, it never says that a device package must first be pulled to disk before this tool applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools