droidasc-mcp

Overview Schema Source Related Servers Discussions Admin

asc_secret_candidates

Scans DEX string pools in Android APKs to identify redacted candidate secrets, returning exact pool indices and fingerprints for validation while values stay hidden by default.

Instructions

Find redacted candidate secrets in DEX strings with exact pool indices and fingerprints.

Uses native DEX string pools without Java/JADX. Values are redacted unless include_values=true. Candidate validity and instruction use sites remain untested. Strings over 64K UTF-16 units are skipped explicitly; per-pattern/string matches cap at 20, total strings at 2M. Assets, native code, runtime values and arbitrary encodings are outside this scan.

Input Schema

Name	Required	Description	Default
`limit`	No	Redacted candidate page size, server-capped
`offset`	No	Zero-based candidate offset in DEX/string/pattern order
`pattern`	No	Fixed candidate pattern family, not arbitrary regex	all
`session_id`	Yes	Open immutable DEX or artifact session ID
`include_values`	No	Explicit opt-in to return sensitive matched candidate values
`max_scan_bytes`	No	Cumulative decoded UTF-8 string-pool byte budget

Output Schema

Name	Required	Description	Default
`code`	No
`items`	No
`limit`	No
`total`	No
`module`	No
`offset`	No
`status`	Yes
`backend`	No
`message`	No
`sources`	No
`apk_path`	No
`coverage`	No
`has_more`	No
`input_id`	No
`truncated`	No
`apk_sha256`	No
`session_id`	No
`limitations`	No
`next_offset`	No
`artifact_path`	No
`artifact_sha256`	No
`backend_version`	No
`pattern_version`	No
`scanned_strings`	No
`values_included`	No
`selected_modules`	No
`coverage_complete`	No
`scanned_utf8_bytes`	No
`credential_validity`	No
`instruction_use_sites`	No
`skipped_oversize_strings`	No
`capped_pattern_string_pairs`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed11 schema fields changedv0.2.5Oct 29, 2026

addedOutput schema / $defs / Source / properties / container_sha256

Added value: +{
+  "title": "Container Sha256",
+  "type": "string"
+}

addedOutput schema / $defs / Source / properties / container_size_bytes

Added value: +{
+  "title": "Container Size Bytes",
+  "type": "integer"
+}

addedOutput schema / $defs / Source / properties / logical_header_offset

Added value: +{
+  "title": "Logical Header Offset",
+  "type": "integer"
+}

addedOutput schema / $defs / Source / properties / logical_size_bytes

Added value: +{
+  "title": "Logical Size Bytes",
+  "type": "integer"
+}

addedOutput schema / $defs / Source / properties / module

Added value: +{
+  "title": "Module",
+  "type": "string"
+}

addedOutput schema / $defs / Source / properties / normalization

Added value: +{
+  "title": "Normalization",
+  "type": "string"
+}

addedOutput schema / $defs / Source / properties / original_dex_version

Added value: +{
+  "title": "Original Dex Version",
+  "type": "string"
+}

addedOutput schema / $defs / Source / properties / snapshot_entry

Added value: +{
+  "title": "Snapshot Entry",
+  "type": "string"
+}

addedOutput schema / $defs / Source / properties / stored_size_bytes

Added value: +{
+  "title": "Stored Size Bytes",
+  "type": "integer"
+}

addedOutput schema / properties / module

Added value: +{
+  "title": "Module",
+  "type": "string"
+}

addedOutput schema / properties / selected_modules

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "title": "Selected Modules",
+  "type": "array"
+}

Changed2 schema fields changedv0.2.4Oct 27, 2026
- removedOutput schema / properties / next_offset / anyOf
```
Removed value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "null"
-  }
-]
```
- addedOutput schema / properties / next_offset / type
```
Added value: +[
+  "integer",
+  "null"
+]
```
Addedv0.2.3Oct 23, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the thin annotations by disclosing the default redaction posture, the include_values opt-in, hard caps (20 matches per pattern/string, 2M strings), the explicit 64K UTF-16 skip, and the byte budget. It also flags the key caveat that findings are unvalidated candidates, which an agent needs to avoid over-reporting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose in the first sentence, then layers caveats and caps. Dense but every sentence carries information; the mid-sentence line breaks are cosmetic noise rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 parameters, an output schema present, and full schema coverage, the description supplies the behavioral context the schema cannot (redaction, caps, exclusions). It omits only that an immutable DEX/artifact session must already be open, which the session_id field description covers instead.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning on top: it explains the redaction default tied to include_values, the capped match volume that governs limit/offset semantics, and the skip threshold relevant to max_scan_bytes. It doesn't elaborate on pattern-family ordering used by offset.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ("Find redacted candidate secrets in DEX strings") plus the distinguishing output ("exact pool indices and fingerprints"). No sibling tool scans for secrets, so an agent can route here unambiguously, and the mention of native DEX string pools separates it from the source/ref-oriented siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly delimits scope by exclusion: assets, native code, runtime values and arbitrary encodings are "outside this scan," and it warns that candidate validity and instruction use sites "remain untested," implying a follow-up tool is needed. It does not name the sibling to use for those follow-ups (e.g. asc_get_class_source / asc_find_refs), so routing beyond this tool is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server