drozer-mcp
Provides tools for enumerating and attacking Android IPC components (activities, services, broadcast receivers, content providers) to surface vulnerabilities, leveraging the Drozer framework.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@drozer-mcpScan all installed apps for SQL injection vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
drozer-mcp
MCP server wrapping Drozer for LLM-driven Android IPC security testing.
Lets any Model Context Protocol client — Claude Code, Claude Desktop, Cursor, LM Studio, custom agents — drive Drozer autonomously. The LLM enumerates exported activities, services, broadcast receivers, and content providers across installed apps, then exercises them with intents, broadcasts, and provider queries to surface IPC vulnerabilities.
Designed for the gap in the mobile-security-AI landscape: while there are solid MCP wrappers for Frida, JADX, and MobSF, the canonical Android IPC tool — Drozer — has had no agentic interface until now.
Status
Alpha. Working core: connection lifecycle, package/component enumeration, content provider querying, intent launching, and the most commonly-used scanner modules. Tested against the Drozer 3.1.x console.
Related MCP server: mobile-security-mcp
Install
pip install drozer-mcpOr from source:
git clone https://github.com/YOUR-USERNAME/drozer-mcp
cd drozer-mcp
pip install -e .You also need:
A working Drozer install (
pip install drozerplus a Java runtime). The MCP server shells out to thedrozerbinary.The Drozer agent APK running on a rooted physical device or emulator. Download from the Drozer releases page.
ADB port forwarding:
adb forward tcp:31415 tcp:31415
Configure your MCP client
Claude Desktop / Claude Code
Add to ~/.config/claude/claude_desktop_config.json (Linux) or the equivalent
on macOS / Windows:
{
"mcpServers": {
"drozer": {
"command": "drozer-mcp"
}
}
}Restart the client. The Drozer tools will appear with the drozer__ prefix.
Environment variables
Variable | Purpose | Default |
| Path to the |
|
| Override the agent host:port | drozer's own default |
| Log level: |
|
Tools
Connection
Tool | Purpose |
| Open a console session against the agent |
| Close the session |
The first non-connection tool call connects implicitly. If the underlying console dies (agent crash, ADB hiccup), the next call transparently reconnects.
Enumeration
Tool | Drozer command | Returns |
|
| List of package names |
|
| Per-kind counts + |
|
| Components with required permissions |
|
| Same shape as activities |
|
| Same shape |
|
| Same shape |
|
| Deduped list of |
Attacks
Tool | Drozer command | Purpose |
|
| Read a provider with full WHERE/projection/sort args |
|
| Read file-backed providers (FileProvider path-traversal) |
|
| Launch with component / action / data / extras |
|
| Start or bind a service with intent params |
|
| Send a broadcast intent |
Scanners
Tool | Drozer module | Finds |
|
| SQLi in content providers |
|
| Directory traversal in file providers |
|
| Deep-link / URL scheme entry points |
Shell + escape hatch
Tool | Purpose |
| Run a shell command on the device via |
| Run any Drozer command verbatim — for modules not yet wrapped |
Example session (Claude Code)
You: Find SQL injection in any installed app.
Claude: [calls list_packages with filter="com.example"]
[calls package_attack_surface for each result]
[calls scan_provider_injection for those with providers exported]
[calls query_provider with payloads on each finding]
Found 1 injection in com.example.app's UserProvider:
URI: content://com.example.app.provider/users
Injectable parameter: selection
PoC: query with selection="1=1 UNION SELECT password FROM ..."
returned 47 rows including hashed credentials.Why a long-lived console?
Drozer's console connect starts a JVM-backed REPL that talks to the agent over
a TCP port. Cold-start is ~1-2 seconds; once warm, command roundtrips are
sub-second. Re-spawning per tool call would make an LLM-driven workflow painfully
slow, so this MCP server runs a single pexpect-managed session and dispatches
each tool call to it as a REPL command.
That comes with one caveat: the session is not thread-safe. The MCP runtime
serializes tool calls per server process, which makes this safe in practice. If
you want parallel scans of multiple devices, run multiple MCP server instances
with different DROZER_SERVER settings.
Roadmap
More scanners:
scanner.misc.checkparcel,scanner.misc.native, the fullscanner.misc.*family.Structured JSON output mode for
query_provider(currently raw text).Drozer Module API integration so custom modules show up automatically.
iOS / Objective-C equivalents (probably a separate
frida-ios-mcprather than shoehorning here).
License
Apache-2.0.
Available Tools
19 toolsdrozer_connectA
Open a Drozer console session against the connected Android device.
Requires the Drozer agent APK to be running on the device and ADB port
forwarding in place: adb forward tcp:31415 tcp:31415.
Subsequent tool calls will reuse this session. Call drozer_disconnect
to close it explicitly; otherwise the session lives as long as this MCP
server process. If the underlying console dies, the next tool call will
transparently reconnect.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully handles behavioral transparency: session reuse, explicit disconnection, lifetime tied to MCP server process, and transparent reconnection if console dies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences, each earning its place. It is front-loaded with the purpose and includes essential details without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and an output schema (provided externally), the description covers all necessary context: prerequisites, session lifecycle, and behavior on console death.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema coverage is 100%. Baseline is 4 for no parameters; the description adds no parameter info because none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource 'Open a Drozer console session' and clearly distinguishes the tool from siblings like drozer_disconnect and other Drozer tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states prerequisites (Drozer agent running, ADB port forwarding) and when to use the alternative drozer_disconnect to close the session. It also explains session reuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drozer_disconnectA
Close the Drozer console session if open.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description discloses that it closes the session, but lacks details on side effects or prerequisites. Adequate for a simple tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: one sentence, eight words. Front-loaded with action and resource. No unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with a simple action, the description is complete. It addresses state ('if open') and requires no additional detail given the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist. Schema coverage is 100%. Description adds no param info, which is acceptable as the schema fully covers the empty set.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Close') and the resource ('Drozer console session'). It distinguishes from sibling tools like drozer_connect which opens a session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use ('if open'), providing clear context. No exclusions or alternative guidance needed due to simplicity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drozer_run_rawA
Run any Drozer command verbatim. Escape hatch for modules not yet wrapped.
Example: drozer_run_raw("run information.deviceinfo").
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| timeout_s | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose potential behavioral impacts such as destructive actions, authentication requirements, or rate limits. The statement 'run any Drozer command' implies versatility but lacks specifics on safety or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences and an example. Every part is purposeful and front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
As an escape hatch tool, the description is adequate but could be more complete. It does not explain return values or error behavior, but an output schema exists (not shown). Given the complexity and coverage, a score of 3 is appropriate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to the 'command' parameter via an example, but the 'timeout_s' parameter is not mentioned. With 0% schema description coverage, the description partially compensates but leaves the second parameter undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool runs any Drozer command verbatim, serving as an escape hatch for unwrapped modules. This distinguishes it from sibling tools which wrap specific Drozer functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions the tool is an 'escape hatch for modules not yet wrapped,' indicating when to use it. It does not specify when not to use or provide alternatives, but the context of sibling tools implies the specific modules are preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_provider_urisA
Find content:// URIs exposed by installed apps (Drozer app.provider.finduri).
Args: package: Optional package to limit the search; omit to scan all.
| Name | Required | Description | Default |
|---|---|---|---|
| package | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It implies a read-only operation ('Find') but does not explicitly confirm safety, side effects, or authentication needs. The Drozer reference adds some context but lacks thorough behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two focused sentences: one for the core purpose and one for the parameter. No unnecessary words or tautologies.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, return values don't need explanation. The description is sufficient for a simple parameter but could briefly mention typical usage flow (e.g., first step before querying providers). Overall, it's nearly complete for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description fully explains the only parameter 'package'—its role, optional nature, and default behavior (scan all). This adds substantial meaning beyond the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: finding content:// URIs exposed by installed apps, using a specific verb 'find' and resource 'content:// URIs'. It distinguishes from siblings by focusing on URI discovery rather than querying or scanning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on optional package filtering but does not explicitly state when to use this tool over alternatives like list_providers or scan_provider_injection. No exclusion criteria or when-not-to-use guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_activitiesA
List activities of a package and their required permissions.
Args:
package: Target package name.
exported_only: If True (default), pass Drozer's -u flag so only
exported activities show. Set False to see all (debug only).
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | ||
| exported_only | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that exported_only controls an internal flag and notes the debug-only nature of listing all activities. However, it does not mention any potential side effects, authentication requirements, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with an Args block, no redundancy, and the purpose is stated first. It is efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's action and parameter details. An output schema exists, so missing return format is acceptable. The context of sibling tools helps differentiate. A minor gap is the lack of examples or edge cases, but overall it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description provides meaningful context for both parameters: 'package' is defined as the target package name, and 'exported_only' is explained with its default and effect. This adds value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists activities of a package and their required permissions. It distinguishes from siblings like list_providers, list_receivers, and list_services, which target other components.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the package parameter and the exported_only flag with its default behavior and impact. It implicitly guides when to use the tool (for listing activities) and how to filter results, though it doesn't explicitly contrast with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_packagesA
List installed packages on the device.
Args:
filter: Optional substring filter — Drozer's -f flag. Useful to
narrow down a huge package list. Example: "com.example".
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It indicates a read operation (listing) with no side effects. While it does not explicitly state permissions or safety, the nature of listing makes it low-risk. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: two sentences with clear structure. First sentence states purpose, second explains the only parameter. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 1 optional parameter and presence of output schema, the description is complete. It explains the parameter sufficiently for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage, but description adds extensive meaning: explains filter as substring match, cites Drozer's '-f' flag, provides use case, and gives an example. This fully compensates for the schema's lack of parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'List installed packages on the device.' It uses a specific verb ('List') and resource ('packages'), distinguishing it from sibling tools like list_activities and list_providers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes when to use the filter parameter ('Useful to narrow down a huge package list'), providing clear context. Does not explicitly mention when not to use, but for a simple list tool, this is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_providersA
List content providers of a package with their permissions and authorities.
Each entry includes authority, read_permission, write_permission,
content_provider (class), multiprocess, and grant_uri flags.
Use these to spot misconfigured providers — e.g. read_permission: null
and exported_only=True together means world-readable.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | ||
| exported_only | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It clearly describes the output fields and provides an interpretation example ('world-readable'). It implies read-only behavior, but doesn't explicitly state no side effects. Overall, sufficient given the tool's simplicity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences, well-structured with bullet-like inline code formatting. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, so output details are covered. However, input parameters are not addressed, and the description could benefit from a brief note on prerequisites (e.g., package must be installed). It is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%. The description fails to explain the two input parameters ('package' and 'exported_only'). The example mentions 'exported_only=True' but does not define its meaning or effect. Output fields are described, but input semantics are missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifically states 'list content providers of a package' with a clear verb-resource pair. It differentiates from sibling tools like find_provider_uris by detailing the included fields (authority, permissions, etc.).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a use case ('spot misconfigured providers') and an example, but does not explicitly state when to use this tool vs alternatives like find_provider_uris or scan_provider_injection. There's no guidance on when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_receiversC
List exported broadcast receivers of a package.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | ||
| exported_only | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries full behavioral burden. It only states a read operation but omits details such as error handling, performance implications, or what happens when the package is not found. The description does not disclose any side effects or constraints beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence without extraneous words. However, it is too brief, leaving out critical parameter details. While front-loaded with purpose, it sacrifices completeness for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists and the tool has two parameters, the description is insufficient. It does not describe the return format, parameter behavior, or any edge cases. The context signals indicate no param documentation, so the description should compensate but does not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema provides no parameter descriptions. The tool description does not explain the two parameters (package and exported_only) or their purpose beyond the implicit 'exported' in the description. A user cannot infer that exported_only is a boolean that controls filtering.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'List exported broadcast receivers of a package', which clearly identifies the verb (List) and the resource (broadcast receivers). It distinguishes from sibling tools like list_activities, list_providers, and list_services, which target different Android components.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention prerequisites, typical use cases, or situations where another listing tool might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_servicesC
List exported services of a package and their required permissions.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | ||
| exported_only | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'list' implying a read operation, but does not mention whether it requires specific permissions, the format of the output, or any side effects. The description is too brief to adequately inform an agent about the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it lacks structure and fails to include important details. It is not overly verbose, but it is too sparse to be considered well-structured for an MCP tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 parameters and an output schema, the description is minimal. It does not cover the output format or the effect of the default parameter. Given the availability of sibling tools, more context is needed to avoid confusion.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description does not explain the parameters. It mentions 'package' and 'exported' in passing but does not describe the type, purpose, or default of the parameters. The required 'package' parameter is not defined, and the 'exported_only' boolean with default true is not mentioned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'exported services of a package', distinguishing it from sibling tools like 'list_activities' or 'list_providers'. However, it implies only exported services are listed, while the parameter 'exported_only' defaults to true but can be set to false to list all services, causing minor ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'list_activities' or 'list_providers'. The description does not specify prerequisites, context, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_attack_surfaceA
Show the high-level attack surface of one package.
Returns counts of exported activities/receivers/providers/services plus
a debuggable flag. This is the single most useful first call for
scoping IPC testing — pick packages with non-zero exported components.
Args:
package: Fully qualified package name, e.g. com.example.app.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description accurately describes the tool's read-only behavior and return values. Since no annotations are provided, the description carries full burden; it is transparent about what it does, though it could mention prerequisites or performance implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with two sentences plus a concise args section. Every sentence provides value, and the main purpose is front-loaded. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the return values and usage strategy. Given the existence of an output schema, it does not need to detail return format. It could be more complete by mentioning any limitations or dependencies (e.g., internet access), but overall it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema's single 'package' parameter is clarified with the description 'Fully qualified package name, e.g. com.example.app', adding meaning beyond the schema's type and title. Schema coverage is 0%, so the description fully explains the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it shows the high-level attack surface of one package, returning counts of exported components and a debuggable flag. It distinguishes from sibling tools that list individual components by summarizing them as a first step for IPC testing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly recommends this as the first call for scoping IPC testing and advises picking packages with non-zero exported components, providing both when and how to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_providerA
Query a content provider URI.
Args:
uri: The content://... URI to query.
projection: Optional list of column names to project.
selection: Optional WHERE clause; can include ? placeholders.
selection_args: Values for the ? placeholders in selection.
sort_order: Optional ORDER BY clause.
Returns the raw provider response. Useful in concert with the injection scanner — once you find an injectable URI, this tool exercises it.
| Name | Required | Description | Default |
|---|---|---|---|
| uri | Yes | ||
| selection | No | ||
| projection | No | ||
| sort_order | No | ||
| selection_args | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It returns 'raw provider response' and explains parameters but lacks explicit statements about side effects, permissions, or safety. Adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise: one sentence stating purpose, then a list of parameters with brief definitions. No redundancy. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Has output schema (not shown but present), so return values described implicitly. Description mentions 'raw provider response'. For a query tool, this is fairly complete, though it could mention potential errors or prerequisites.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds detailed explanations for all 5 parameters, e.g., 'selection: Optional WHERE clause; can include ? placeholders.' This adds significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query a content provider URI' and explains it returns raw provider response, using specific verb and resource. It distinguishes from siblings like read_provider by mentioning its use with the injection scanner.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Useful in concert with the injection scanner — once you find an injectable URI, this tool exercises it,' providing a clear scenario for when to use. It doesn't explicitly exclude other uses, but gives good context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_providerA
Read a file-backed content provider URI (app.provider.read).
Used to test for unauthorized file disclosure or path-traversal in FileProvider implementations. Returns the file body as text.
| Name | Required | Description | Default |
|---|---|---|---|
| uri | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose behaviors. It describes reading a URI and returning the file body as text, which is adequate. However, it omits details about required permissions, error handling, or side effects, which are relevant for a tool that accesses files.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loads the core action, and uses a code snippet for precision. Every word adds value; no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool appears to require a connected drozer session (sibling tools include drozer_connect), but the description does not mention this prerequisite. The output schema exists but is not shown, so the description ideally would clarify the return type beyond 'text'. Error scenarios or access requirements are absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'uri' has no schema description (0% coverage). The description adds minimal context by mentioning it is a 'file-backed content provider URI' and gives a code example, but does not specify the expected format, allowed schemes, or constraints. More guidance is needed for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'file-backed content provider URI' (with a code example). It distinguishes from siblings like query_provider and scan_provider_traversal by specifying the use case of testing for unauthorized file disclosure or path traversal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage context ('Used to test for unauthorized file disclosure or path-traversal in FileProvider implementations'). It does not explicitly state when not to use this tool or name alternatives, but the context is sufficient for a security testing tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_activity_browsableC
Run scanner.activity.browsable to find activities reachable via
BROWSABLE category (deep-link / URL scheme entry points).
| Name | Required | Description | Default |
|---|---|---|---|
| package | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose behavioral traits. It only states the tool runs a scanner, but does not mention read-only nature, permissions required, or any side effects. The behavioral transparency is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) but omits necessary information about the parameter and output. It is not effectively front-loaded with critical details; it lacks completeness for a tool with an optional parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one optional parameter, no annotations, and an output schema (unseen), the description fails to provide enough context. It does not mention the parameter's purpose or the return format, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the optional 'package' parameter has no description. The tool description does not explain what the parameter does, leaving the agent without guidance on how to use it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds activities reachable via the BROWSABLE category (deep-link/URL scheme entry points). It uses a specific verb 'scan' and resource 'activities browsable', distinguishing it from sibling tools like list_activities that list all activities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for browsing deep-link entry points but does not explicitly state when to use this tool vs alternatives like start_activity or list_activities. No guidance on when not to use or prerequisites is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_provider_injectionA
Run scanner.provider.injection to find SQLi in content providers.
Args: package: Optional package to scope the scan; omit to scan all.
Returns a parsed findings map: section label → list of injectable URIs.
| Name | Required | Description | Default |
|---|---|---|---|
| package | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the scanner command and return format but does not mention whether the tool is read-only, permissions needed, or any side effects. As a scan tool, it is likely safe, but this is not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences plus a brief args note. Every word adds value, and the main purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, output schema exists), the description covers the key aspects: what it does, how to scope, and the return format. It is slightly lacking in behavioral transparency but otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no description for its sole parameter, but the description adds semantic meaning: 'Optional package to scope the scan; omit to scan all.' This effectively compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs a specific scanner to find SQL injection in content providers. It uses a specific verb and resource, and distinguishes from sibling tools like scan_provider_traversal which targets path traversal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the optional package scoping and default behavior, providing clear context for when to use this tool. It does not explicitly state when not to use it or mention alternatives, but the purpose is specific enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_provider_traversalC
Run scanner.provider.traversal to find directory-traversal in providers.
| Name | Required | Description | Default |
|---|---|---|---|
| package | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must convey behavior. It only states the tool 'finds directory-traversal' but does not disclose permissions, side effects, or whether it is read-only. With no annotations, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. However, it is too brief for a complex scanning tool; it sacrifices completeness for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, return values need not be detailed, but the description lacks context about the scanning process, expected results, and how it fits with sibling tools. More detail is warranted for a security scanner.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter (package) with 0% schema description coverage, and the description does not elaborate on its purpose or usage. The description adds no value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description indicates that the tool runs a specific module to find directory-traversal vulnerabilities in providers. It distinguishes from siblings like scan_provider_injection by focusing on a specific vulnerability type. However, the use of the module name is somewhat technical.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as scan_provider_injection, query_provider, or read_provider. The description does not mention prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_broadcastC
Send a broadcast intent via app.broadcast.send.
At least one of action or component must be supplied.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | ||
| extras | No | ||
| data_uri | No | ||
| component | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the internal method but does not disclose behavioral traits such as permissions required, whether it is blocking, or the return value. The output schema exists but is not described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (two sentences) with no redundant information. It is front-loaded with the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, 0% schema coverage, and no annotations, the description is incomplete. It does not explain return values (output schema exists but unmentioned) or provide enough context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only clarifies the constraint between action and component but does not explain extras or data_uri. Most parameters lack semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool sends a broadcast intent, distinguishing it from sibling tools like start_activity and start_service. The verb 'send' and resource 'broadcast intent' are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions that at least one of action or component must be supplied, providing a usage constraint. However, it does not give guidance on when to use this tool over alternatives like start_activity or start_service.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execA
Execute a shell command on the device via shell.exec.
Useful for follow-up verification (read a file the provider exposed, check that a broadcast actually fired, dump logcat, etc.). Beware large outputs — the shell command runs under the agent's UID, which on most devices is the same as the system_user.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavior. It warns about large outputs and mentions the command runs under the agent's UID (system_user). However, it does not explicitly state that shell commands can be destructive or that the tool may block, leaving gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences and a warning. The first sentence states the purpose, and the second provides usage and cautions. No wasted words, though it could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description includes key behavioral warnings (large outputs, UID) and usage context. However, it lacks information about error handling, timeouts, or potential destructive impact. Adequate but not complete for a shell execution tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter ('command') with 0% schema description coverage. The description does not explain the format, allowed commands, or constraints of the 'command' parameter beyond naming it. Examples are given but no direct parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a shell command on the device', which is a specific verb and resource. It distinguishes from siblings like list_activities or query_provider by targeting shell execution, a unique capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear usage context: 'Useful for follow-up verification' and gives examples (read a file, check broadcast, dump logcat). It does not explicitly state when not to use or provide alternatives, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_activityA
Launch an activity via app.activity.start.
Either component or action is required.
Args:
component: pkg/.ActivityName — pins the target component.
action: Intent action, e.g. android.intent.action.VIEW.
data_uri: Optional URI for the intent's data.
category: Optional category, e.g. android.intent.category.BROWSABLE.
mimetype: Optional MIME type to set on the intent.
extras: Map of extra-name -> string-value. Drozer's CLI supports
typed extras (--extra string foo bar); this tool uses the
string type for simplicity. For typed extras, use
drozer_run_raw directly.
flags: List of intent flag constants, e.g. ["NEW_TASK"].
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | ||
| action | No | ||
| extras | No | ||
| category | No | ||
| data_uri | No | ||
| mimetype | No | ||
| component | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It fails to mention side effects (e.g., what permissions are needed), error handling, or what happens upon successful launch. The output schema exists but the description does not explain return values or success/failure indications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose line, requirement note, and argument list. It is not overly long, though it could be slightly more concise by removing the docstring format quirks.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, no schema descriptions, and no annotations, the description covers parameter semantics well but omits output behavior and error scenarios. The presence of an output schema does not fully compensate for missing return value explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description adds significant value by explaining each parameter (e.g., 'component: pkg/.ActivityName — pins the target component'). This enhances understanding beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Launch' and resource 'activity', making the tool's purpose unambiguous. However, it does not explicitly differentiate from sibling tools like 'start_service' or 'send_broadcast', which launch other Android components.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that either 'component' or 'action' is required, providing clear usage guidance. It also advises when not to use this tool (for typed extras) and recommends an alternative ('use drozer_run_raw directly'), which is excellent for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_serviceB
Start a service via app.service.start.
Args:
component: pkg/.ServiceName.
action: Optional intent action.
extras: String extras to attach.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | ||
| extras | No | ||
| component | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits, but it only says 'via app.service.start'. No information about permissions, side effects, blocking behavior, or return value is provided, which is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise with only two sentences and a bulleted argument list. It front-loads the purpose, but the structure could be slightly more organized for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and moderate complexity, the description lacks completeness. It does not cover error cases, state changes, or dependencies, leaving the agent with insufficient context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds meaning by explaining 'component: pkg/.ServiceName', 'action: Optional intent action', and 'extras: String extras to attach'. This helps the agent understand parameter usage beyond type-only schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Start a service' with a specific verb and resource. This differentiates it from siblings like 'start_activity' and 'list_services' by indicating it launches a service component.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, context, or exclusions, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct action (connect, disconnect, list packages, list activities, query provider, scan for injection, etc.) with clear boundaries. Even similar tools like query_provider and read_provider are differentiated by their use case.
All tool names use consistent snake_case with a verb_noun pattern. The drozer_ prefix for connection and raw commands is a consistent sub-pattern, and there is no mixing of styles.
19 tools is appropriate for the Android security assessment domain, covering connection management, enumeration, scanning, and exploitation without being excessive. Each tool serves a clear purpose.
The tool set covers the core Drozer workflow: connect, enumerate packages and components, query providers, scan for injection/traversal, and send intents. Some advanced modules are missing but can be accessed via drozer_run_raw, and the set is well-scoped for practical use.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for static security analysis of Android source code
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA MCP server that enables LLMs to control Android devices via ADB, supporting input, UI hierarchy, device management, and shell commands.14MIT
- AlicenseAqualityCmaintenanceAn MCP server that enables AI assistants to analyze Android APK and iOS IPA files for security issues through natural language conversation, including permission auditing, secret detection, and SDK enumeration.12424MIT
- AlicenseNot gradedqualityCmaintenanceMCP server that enables LLMs to control Android devices via ADB, providing tools for screen interaction and UI inspection.1MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server for mobile automation that enables LLMs to interact with Android and iOS devices through screenshot, tap, swipe, log analysis, and app lifecycle management.173MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/prathx0/drozer-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server