Open a Drozer console session against the connected Android device.

Requires the Drozer agent APK to be running on the device and ADB port forwarding in place: adb forward tcp:31415 tcp:31415.

Subsequent tool calls will reuse this session. Call drozer_disconnect to close it explicitly; otherwise the session lives as long as this MCP server process. If the underlying console dies, the next tool call will transparently reconnect.

Close the Drozer console session if open.

List installed packages on the device.

Args: filter: Optional substring filter — Drozer's -f flag. Useful to narrow down a huge package list. Example: "com.example".

Show the high-level attack surface of one package.

Returns counts of exported activities/receivers/providers/services plus a debuggable flag. This is the single most useful first call for scoping IPC testing — pick packages with non-zero exported components.

Args: package: Fully qualified package name, e.g. com.example.app.

List activities of a package and their required permissions.

Args: package: Target package name. exported_only: If True (default), pass Drozer's -u flag so only exported activities show. Set False to see all (debug only).

List exported services of a package and their required permissions.

List exported broadcast receivers of a package.

List content providers of a package with their permissions and authorities.

Each entry includes authority, read_permission, write_permission, content_provider (class), multiprocess, and grant_uri flags. Use these to spot misconfigured providers — e.g. read_permission: null and exported_only=True together means world-readable.

Find content:// URIs exposed by installed apps (Drozer app.provider.finduri).

Args: package: Optional package to limit the search; omit to scan all.

Query a content provider URI.

Args: uri: The content://... URI to query. projection: Optional list of column names to project. selection: Optional WHERE clause; can include ? placeholders. selection_args: Values for the ? placeholders in selection. sort_order: Optional ORDER BY clause.

Returns the raw provider response. Useful in concert with the injection scanner — once you find an injectable URI, this tool exercises it.

Read a file-backed content provider URI (app.provider.read).

Used to test for unauthorized file disclosure or path-traversal in FileProvider implementations. Returns the file body as text.

Launch an activity via app.activity.start.

Either component or action is required.

Args: component: pkg/.ActivityName — pins the target component. action: Intent action, e.g. android.intent.action.VIEW. data_uri: Optional URI for the intent's data. category: Optional category, e.g. android.intent.category.BROWSABLE. mimetype: Optional MIME type to set on the intent. extras: Map of extra-name -> string-value. Drozer's CLI supports typed extras (--extra string foo bar); this tool uses the string type for simplicity. For typed extras, use drozer_run_raw directly. flags: List of intent flag constants, e.g. ["NEW_TASK"].

Send a broadcast intent via app.broadcast.send.

At least one of action or component must be supplied.

Start a service via app.service.start.

Args: component: pkg/.ServiceName. action: Optional intent action. extras: String extras to attach.

Run scanner.provider.injection to find SQLi in content providers.

Args: package: Optional package to scope the scan; omit to scan all.

Returns a parsed findings map: section label → list of injectable URIs.

Run scanner.provider.traversal to find directory-traversal in providers.

Run scanner.activity.browsable to find activities reachable via BROWSABLE category (deep-link / URL scheme entry points).

Execute a shell command on the device via shell.exec.

Useful for follow-up verification (read a file the provider exposed, check that a broadcast actually fired, dump logcat, etc.). Beware large outputs — the shell command runs under the agent's UID, which on most devices is the same as the system_user.

Run any Drozer command verbatim. Escape hatch for modules not yet wrapped.

Example: drozer_run_raw("run information.deviceinfo").