获取当前连接的 Android 设备状态：设备型号、Android/SDK 版本、实际 Root UID、 当前前台包名与 Activity、屏幕分辨率及 UIAutomator2 可提供的亮屏状态。

【核心感知工具 - 替代慢速截图】通过高速 RPC 提取当前屏幕的语义化 UI 控件树。 返回每个元素的 [#index] 编号、类名、文本 (text)、描述 (desc)、id、中心坐标与可交互标志 (flags)。 后续可直接调用 tap_element(index=N) 或 tap_element(text="...") 精准操作！

【仅用于已知能吐出 View 树的 ROM】通过 dumpsys activity top 取 Activity/Task 记录。 注意：本机 HyperOS（Android 16）实测该命令不返回任何 View 层级——mID=、mText、 android:text 均为 0 行，微信整份输出只有 776 字节。所以在该机型上它拿不到控件信息， 需要理解界面请直接用 ui_describe（OS 语义，非 OCR）。 在确实支持 AOSP 式 dumpsys activity top 的 ROM 上，本工具可能额外给出：

1. 真实的自定义 View 类名；2. 16 进制资源 ID 锚点；3. 被隐藏的 GONE/INVISIBLE 节点。

【视觉兜底与界面审查工具】获取手机屏幕截图。安全图层/DRM 等限制仍可能导致空白或拒绝。 默认开启 Set-of-Mark (annotate_elements=True)，在图上直接标出 [#0], [#1] 红框编号， 看图后无需猜像素坐标，直接调用 tap_element(index=编号) 即可！ 注意：日常操作请优先使用 get_ui_tree，仅在 Canvas/地图渲染/游戏或视觉验证时调用本工具。

智能语义点击工具。支持按 #index、text、text_contains、resource_id、description 或 (x, y) 点击。 点击即返回确认与耗时，不默认回抓整棵树——观察交给 ui_snapshot 的差异模式，节奏才跟得上手。

极速中文/Unicode 文本输入工具。 可一步完成『聚焦输入框 -> 清空旧内容 -> 注入中文字符串 -> 按回车提交 -> 返回新界面 UI 树』，并自动保护系统原输入法不被篡改。

智能滑动与滚动查找工具。 支持四向滑动、自定义坐标拖拽，或设置 scroll_to_text="目标文字" 让工具自动滚屏寻找目标！

发送系统物理/虚拟按键（返回、主页、多任务、回车、电源唤醒等），并自动返回最新界面结构。

【王牌去人机感工具】单次调用连续执行多步手机操作流水线！ 当能够预判接下来的 2~6 步操作时（例如：启动应用 -> 等待首页 -> 点击搜索框 -> 输入关键词 -> 按回车）， 必须使用本工具一次性下发，彻底告别『点一下停几秒等下一轮』的卡顿体验！ 若中途某一步失败，会自动中断并返回当前停留页面的 UI 树供纠错。

【Root 上帝模式直通车】通过 su -c 在手机上执行任意 Root 特权 Shell 命令。 可执行诸如修改系统属性 (resetprop/setprop)、查看内核/挂载信息、操作 /data/ 私有目录、管理防火墙等任意底层指令。

【Root 页面直达工具】利用 Root 权限强行穿透拉起任意内部私有 Activity (exported=false) 或 DeepLink Scheme， 直接一步跨越繁琐的开屏广告与多级菜单跳转！

应用生命周期与权限管理工具（信息、停止、重启、清空数据、逐项尝试授予运行时权限）。

【零界面数据穿透工具】直接通过 Root 读取或查询 /data/data/<package>/ 下的 SharedPreferences 配置与 SQLite 数据库！ 无需打开应用界面，直接核查开关状态、缓存数据与内部表记录。

【后台零界面取证工具】无需下拉通知栏或打开短信 App，直接通过 Root 提取通知栏消息、短信验证码或读写系统剪贴板。

【智能 Logcat 诊断工具】支持按包名自动绑定进程 PID、一键提取闪退堆栈 (crash_only=True)、按 Tag 或关键词精准过滤日志。

【LSPosed / Xposed / KernelSU 专属调试工具】 直接通过 Root 读取 /data/adb/lspd/log/modules_*.log 最新模块日志与已安装的 KernelSU/Zygisk 模块列表， 快速验证 Hook 是否生效、是否有 StackOverflowError / ClassNotFoundException 等异常！

【Android / LSPosed 开发一键联调闭环】 单次调用自动完成：

1. 安装本地 APK (adb install -r -d)

2. 记录日志起始时间，保留全局 Logcat 缓冲池

3. 强杀并冷启动目标宿主应用 (am force-stop + 启动)

4. 等待页面渲染与 Hook 注入

5. 自动汇总返回：是否有 Crash 堆栈 + 目标应用 Logcat + LSPosed 模块最新日志 + 当前屏幕 UI 控件树！

【Root 级跨端文件推拉】利用 /data/local/tmp 中转与 Root 提权，支持直接拉取或替换 /data/data/、/data/adb/ 等任意私有目录文件。

【设备极速模式调优】一键将手机调校为最适合 AI Agent 高速操控与调试的状态：

1. 关闭系统窗口与过渡动画 (animation_scale = 0)，消除页面切换等待时间

2. 开启连接电源时屏幕常亮 (stay_on_while_plugged_in)

3. 自动唤醒屏幕并滑开锁屏层 (wm dismiss-keyguard)

Discover v2 capabilities and the efficient Agent operating rules (no device connection needed).

List/select ADB devices or connect/disconnect/pair host:port. Selection clears UI indices; no arbitrary default when multiple devices are attached.

Probe actual Root UID, ROM/SDK, installed command/dependency capabilities. initialize_u2 starts the UIAutomator2 helper and resets a failed connection.

Fresh semantic UI snapshot with stable document-order indices and snapshot_id. Supply since_snapshot_id for added/removed/changed nodes; compact omits the full element array.

Query UI with AND-combined text/id/class/package/state/region predicates, regex and explicit nth. Does not click; returns all matches plus snapshot_id.

One human-shaped verb: perform an interaction AND report what changed, in a single round trip. action = tap/long_click/double_click/set_text/append_text/clear/check/uncheck/read/scroll/key. Target a control with selector (supports role, label_contains, semantic_key, text, resource_id - semantic addressing needs no coordinates) or pass x/y. Returns effect, a plain sentence describing what actually happened (navigation, dialog appeared, list scrolled, no visible change) plus the new snapshot_id, so you do NOT need a follow-up perceive call. Set observe=false for tight loops where you will observe later yourself.

Teach the agent what an app's unnamed controls DO, by probing and remembering. Many apps expose no label for their buttons (measured: 56.7% of tappable controls carry no text/description/id, and some apps report no clickable flag at all), so the only honest way to learn them is to act and observe. This taps one unknown control at a time, diffs the screen before/after, and persists the observed effect (opened a screen / dialog appeared / list scrolled / no visible change) under the current app+activity. Destructive and financial controls (delete, pay, logout, uninstall, password fields) are refused and recorded as refused, never pressed. Results appear as learned_effect on later ui_describe calls, so the agent stops guessing. budget = how many controls to probe this call (1-5).

Read the screen as CONTROLS, not pixels. Each tappable/viewable element is described from what Android itself reports - view class, resource-id name, accessibility description, supported action flags - never from OCR or vision. Returns a one-line summary, an ordered control list with role/label/actions/state, screen structure (top bar, bottom nav, dialogs, scroll containers, primary action), and a coverage line telling you how much the OS actually named. Prefer this over screenshots for understanding a screen.

Find controls by OS-derived semantics instead of coordinates or pixels. Filter by role (button/text_input/toggle/tab/nav_back/nav_close/list_item/search), by label substring, by text substring, by stable semantic_key, or by region. Returns matches with their semantic_key, which stays valid when the layout moves - use it to replay an action on the same control later without storing a tap position.

Act on exactly one matching element: tap/long_click/double_click/set_text/append_text/clear/check/uncheck/read. Ambiguous/stale/disabled targets fail explicitly. Returns a compact ack, not a tree: set return_ui=true only when the next step needs the whole page, otherwise observe with ui_snapshot(since_snapshot_id=...) and pay only for the delta.

Wait for exists/gone/foreground/shell-exit-and-output/stable UI. Missing UI transport never counts as 'gone'. Replaces blind sleep calls.

Fill several fields (including Chinese/Emoji) and optionally submit in one tool call. Stops at the first failed field. One tree dump total, not one per field.

Execute a fully prevalidated UI/Root workflow in ONE call: launch/tap/input/key/swipe/wait/assert/shell/if/repeat/sleep/read_text. Supports per-step postconditions, on_error, bounded loops/deadline and trace. No blind retries of non-idempotent actions.

Inspect or cooperatively cancel an active workflow from another request. Cancellation stops subsequent steps; in-flight device/RPC calls finish or time out first.

Persist/reuse named workflows: list/save/load/run/delete. Save validates all steps before atomic storage; works across MCP restarts.

Run an arbitrary Android shell command, optionally su uid=0. Returns real exit_code/stdout/stderr/timeout/truncation. Device-side timeout when supported; never invokes a host shell.

Run 1..200 CLI commands in ONE ADB process/Root session. Per-command exit codes and output, optional fail-fast; avoids one subprocess/tool call per command.

Raw selected-device ADB command escape hatch (e.g. bugreport, jdwp, shell am instrument). Arguments passed directly to native adb, no host shell. Prefer typed tools for timeouts and validation.

Background device processes: list/start/status/output/cancel/cleanup. Use for logcat, instrumentation, perfetto, tcpdump if installed. Persistent handles, bounded stdout/stderr, incremental byte offsets and PID-reuse checks. timeout=0 explicitly allows indefinite work.

Root file manager: list/stat/read/write/append/hash/mkdir/chmod/copy/move/delete. Text or base64, atomic replacement, preserve existing ownership/mode, backup by default, optional compare-and-swap SHA256. Use transfer for large files/trees.

List/info/paths/launch/stop/restart/clear/enable/disable/uninstall apps; install/install_multiple local APKs (base+splits), explicit downgrade/test/permission switches. clear/uninstall remove user data.

Inspect/grant/revoke permissions or set a named appop. grant_runtime_all intersects declared permissions with device dangerous-runtime list and reports failures individually; does not silently enable all special privileges.

Export an installed app's base APK and ALL split APKs to a host directory for development/testing.

Root/nonroot typed Intent: activity/broadcast/service/foreground_service/stop_service, internal components, DeepLinks, MIME/categories/flags, bool/int/long/float/string/null extras. Reports am errors even if exit code is zero.

Read/list/put/delete exact Android global/system/secure settings; returns command failure rather than claiming unsupported settings succeeded.

Apply/list/restore an Agent speed profile. Saves exact original animation/stay-awake values BEFORE changes and restores them (including absent keys) by profile_id on the same device.

Control wifi/bluetooth/mobile_data/airplane_mode, brightness, rotation, screen_size, density, volume, wake/sleep/dismiss_keyguard, notifications/quick_settings/collapse_panels, reboot/recovery/bootloader/shutdown. ROM support varies. Reboot/network changes may disconnect ADB.

Read Android properties or set them using setprop; resetprop=true explicitly requests the installed Root resetprop utility. Does not install/assume Magisk.

Direct zero-UI ContentProvider query/insert/update/delete/call/gettype with typed bindings. update/delete require explicit where ('1' intentionally means all rows). ROM/provider authorization still applies.

Read/set/delete typed private XML preferences (string/int/long/float/boolean/set). Writes stop the app, preserve ownership/mode, back up old XML and check its hash. values={key:{type:'boolean',value:true}}; leaves app stopped.

Query a private SQLite DB without a phone sqlite3 binary; copies DB+WAL+SHM, parameterized SQL, BLOB base64 and bounded rows. write=true requires package+stop_app=true; backs up sidecars and installs an atomic checkpointed DB, leaving app stopped. Live reads are best effort. SQLCipher needs its own engine/key.

Backup/restore one app's CE or DE private data as tar+SHA256 manifest. Stops app. Restore validates member paths/manifest, keeps pre-restore data backup, restores UID/SELinux; replaces data, leaves app stopped. Keystore/TEE/external storage excluded.

ADB forward/reverse list/add/remove for tcp/localabstract/localfilesystem/jdwp endpoints. tcp:0 allocates a port. No host shell; no-rebind avoids replacing another debugger's mapping.

Collect summary/memory/cpu/graphics/network/crashes/activity/services/power or bundle. Executes probes in one ADB session; optional persistent host report directory for regression evidence.

Perform a multi-point swipe path or pinch_in/pinch_out gesture through uiautomator2, avoiding repeated tap/swipe tool round trips.

Fast WebView/Chrome control using exposed DevTools sockets: discover/pages/dom/click/fill/evaluate/navigate/close. Uses DOM/CSS instead of pixel clicks; only debuggable WebViews. evaluate/click/fill require optional websocket-client.

Background MP4 recording: start/status/stop/pull. Start immediately returns job_id; stop sends SIGINT for MP4 finalization, pull after completion. ROM screenrecord limits apply.

Pixel regression check against a local baseline PNG/JPEG. Captures one frame, compares dimensions/changed-pixel ratio/bounds, optionally saves current/diff; useful for Canvas UI verification.