mcp-flutter-apk-injector

Overview Schema Source Related Servers Discussions Admin

Build Flutter runtime payload

synthesize_flutter_payload

Destructive

Compile a Flutter source project into platform-specific native libraries and assets, enabling authorized injection into Android APKs for security testing.

Instructions

Compile a source Flutter project into platform native libraries (libflutter.so, libapp.so) and flutter_assets partitioned by target Android ABIs. Invokes the local Flutter CLI, writes compiled artifacts to outputDir (or system temp if omitted), and overwrites existing destination files; requires flutterProjectPath containing pubspec.yaml. Set targetAbis to match the target APK architectures discovered via analyze_injection_surface, choose buildMode ('release' for AOT production, 'debug' for JIT), and forward the emitted payloadDir to inject_flutter_runtime_and_smali.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`buildMode`	No	Flutter build mode target: 'release' (AOT production build), 'profile' (AOT performance build), 'debug' (JIT build)	release
`outputDir`	No	Optional custom directory path to write synthesized payload artifacts (defaults to system temp dir)
`targetAbis`	No	Target native CPU architectures to build payload binaries for (default: ['arm64-v8a', 'armeabi-v7a'])
`flutterProjectPath`	Yes	Path to source Flutter project root containing pubspec.yaml and lib/main.dart

Output Schema

TableJSON Schema

Name	Required	Description
`abis`	Yes	ABIs successfully emitted into the payload.
`files`	Yes	Payload-relative artifact paths grouped by type.
`warnings`	Yes	Build or artifact-completeness warnings.
`buildMode`	Yes	Flutter build mode used.
`payloadDir`	Yes	Absolute directory containing synthesized payload artifacts.
`appSizeBytes`	Yes	Extracted libapp.so size, when available.
`engineVersion`	Yes	Detected Flutter engine/version identifier, when available.

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedv0.1.3Aug 13, 2026

addedInput schema / properties / buildMode / description

Added value: +"Flutter build mode target: 'release' (AOT production build), 'profile' (AOT performance build), 'debug' (JIT build)"

addedInput schema / properties / flutterProjectPath / description

Added value: +"Path to source Flutter project root containing pubspec.yaml and lib/main.dart"

changedInput schema / properties / outputDir / description

Previous value: -"Override payload output directory"New value: +"Optional custom directory path to write synthesized payload artifacts (defaults to system temp dir)"

addedInput schema / properties / targetAbis / description

Added value: +"Target native CPU architectures to build payload binaries for (default: ['arm64-v8a', 'armeabi-v7a'])"

addedInput schema / properties / targetAbis / items / description

Added value: +"Target Android Native ABI architecture (e.g. 'arm64-v8a' for modern 64-bit devices)"

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "abis": {
+      "description": "ABIs successfully emitted into the payload.",
+      "items": {
+        "enum": [
+          "arm64-v8a",
+          "armeabi-v7a",
+          "x86",
+          "x86_64"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "appSizeBytes": {
+      "anyOf": [
+        {
+          "minimum": 0,
+          "type": "integer"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Extracted libapp.so size, when available."
+    },
+    "buildMode": {
+      "description": "Flutter build mode used.",
+      "enum": [
+        "release",
+        "profile",
+        "debug"
+      ],
+      "type": "string"
+    },
+    "engineVersion": {
+      "description": "Detected Flutter engine/version identifier, when available.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "files": {
+      "additionalProperties": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "description": "Payload-relative artifact paths grouped by type.",
+      "type": "object"
+    },
+    "payloadDir": {
+      "description": "Absolute directory containing synthesized payload artifacts.",
+      "type": "string"
+    },
+    "warnings": {
+      "description": "Build or artifact-completeness warnings.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "payloadDir",
+    "buildMode",
+    "abis",
+    "files",
+    "engineVersion",
+    "appSizeBytes",
+    "warnings"
+  ],
+  "type": "object"
+}

First observedv0.1.2Aug 2, 2026

TDQS

A5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and readOnlyHint=false. The description goes beyond by specifying exactly what destructive behavior occurs: 'overwrites existing destination files'. It also discloses that it invokes the local Flutter CLI and writes to outputDir or system temp if omitted, adding valuable behavioral context not in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no waste: purpose, mechanics, requirement, and usage instructions. The purpose is front-loaded, and the downstream chaining is mentioned early, making it easy for an agent to scan and understand the tool's role.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, prerequisites, parameter usage, and integration with the pipeline (analyze_injection_surface and inject_flutter_runtime_and_smali). An output schema exists, so return values need not be described. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters, but the description adds practical, cross-tool semantics: it tells the agent to select targetAbis based on analyze_injection_surface and explains buildMode choices ('release' for AOT production, 'debug' for JIT), which enhances the schema's default enum descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states exactly what the tool does: compiles a Flutter project into native libraries (libflutter.so, libapp.so) and flutter_assets partitioned by ABIs. It explicitly references the downstream tool inject_flutter_runtime_and_smali, distinguishing it from siblings like decompile_apk and analyze_injection_surface.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when and how to use: 'Set targetAbis to match the target APK architectures discovered via analyze_injection_surface', 'choose buildMode ('release' for AOT production, 'debug' for JIT)', and 'forward the emitted payloadDir to inject_flutter_runtime_and_smali'. It also states the prerequisite that flutterProjectPath must contain pubspec.yaml.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server