Skip to main content
Glama

sign_apk

Idempotent

Align and sign a rebuilt APK with a debug key for local installation and testing; uninstall the original app first, and do not use the signed result for distribution.

Instructions

Align and sign an APK so it can be installed - typically the rebuilt APK from build_apk. It signs with a debug key generated on first use and kept in the Gateway's data directory, so the signature differs from the original app's: to install over the original you must uninstall it first, and the result is not suitable for distribution. It uses the Android SDK's apksigner and zipalign when present (and verifies the signature afterwards), or Termux's lightweight apksigner. Writes to the workspace's apksigner/signed/ folder and returns { outputPath, apkPath, signed, flavor, aligned?, schemes?, warnings? }; pass apkPath to adb_install. Only use it on apps you own or are authorized to modify.

Input Schema

NameRequiredDescriptionDefault
flavorNoWhich apksigner this is: sdk for the Android SDK's, lite for Termux's lightweight one. Normally omit it - it is detected.
apkPathYesAbsolute path to the .apk to sign, e.g. the outputPath returned by build_apk.
workspaceNoWorkspace name (not id). Created if it doesn't exist, and this call is recorded as a job in its history. Defaults to "default".
outputNameNoOutput file name only, not a path (no "/" or ".."). Defaults to the input name with "-signed" added.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.3.25

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the annotations: names the signing key (debug key generated on first use, stored in the Gateway's data directory), warns the signature differs from the original, explains the uninstall requirement, discloses the toolchain fallback (SDK apksigner/zipalign vs Termux lite) and post-sign verification, and states the write location. The annotations' idempotent/non-destructive profile is consistent with the described behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the critical caveat (debug key, signature mismatch) are front-loaded, and the pipeline and toolchain details follow in logical order. The single dense paragraph is efficient but packs several distinct facts (key, signature, distribution, fallback signer, return schema) that could be slightly easier to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating build-pipeline tool with no output schema, the description anticipates everything the agent needs: input source, key/signing behavior, side effects and caveats, output location, the returned fields, and the next tool to call. Nothing material is left for the agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are already fully documented, and the description mostly reinforces rather than extends them (flavor auto-detection matches the schema's "normally omit it"). It adds useful context about where output lands and the returned object shape, but no new per-parameter semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Align and sign an APK so it can be installed" names a concrete verb pair and resource, and immediately positions it relative to siblings ("typically the rebuilt APK from build_apk"). An agent can distinguish this from build_apk, patch_apk_project, and adb_install without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly places the tool in a pipeline: input from build_apk, output path forwarded to adb_install. It also states a when-not ("not suitable for distribution") and a hard prerequisite/constraint ("Only use it on apps you own or are authorized to modify"), plus the uninstall-before-reinstall condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.