Skip to main content
Glama

termux-mcp

在同一台 Android 上,让任何 MCP 客户端通过 localhost 直接操作 Termux。

License Node MCP

命令执行、tmux 交互终端、后台任务、文件管理、Android 能力(剪贴板 / 通知 / 电池 / TTS),全部以 Termux 用户身份执行。

⚠️ 默认没有鉴权,只监听 127.0.0.1。 任何能访问该端口的本机进程都拥有 Termux 的完整权限。不要把 server.host 改成 0.0.0.0,也不要暴露到局域网或公网。

特性

  • 三种传输:Streamable HTTP(推荐)、Legacy SSE、stdio

  • 交互式终端:tmux 持久会话,支持 REPL、SSH、密码提示、ncurses/TUI、Ctrl-C

  • 后台任务:detached 进程、日志文件、退出码持久化、增量读取

  • 文件操作:读写、按行编辑、递归搜索、原子写入、base64

  • Android 集成:剪贴板、通知、Toast、振动、打开链接、电池状态、TTS

  • 审计:JSONL 日志,敏感字段自动脱敏

Related MCP server: termux-mcp

环境要求

  • Termux(F-Droid / GitHub 版),Node.js ≥ 18

  • tmux:pkg install tmux

  • 可选:Termux:API(Android 能力)、Termux:Boot(开机自启)

快速开始

cd ~/termux-mcp
npm install
./scripts/doctor.sh     # 环境自检
./scripts/start.sh      # 后台启动 + 唤醒锁 + 恢复自启动
./scripts/status.sh     # 状态与地址
MCP:    http://127.0.0.1:8770/mcp
SSE:    http://127.0.0.1:8770/sse
Health: http://127.0.0.1:8770/health

验证:

curl -s http://127.0.0.1:8770/health

客户端接入

OpenCode

opencode mcp add --global termux --url http://127.0.0.1:8770/mcp

等价的 opencode.json:

{
  "mcp": {
    "servers": {
      "termux": { "type": "remote", "url": "http://127.0.0.1:8770/mcp" }
    }
  }
}

其他 Streamable HTTP 客户端

URL:    http://127.0.0.1:8770/mcp
Accept: application/json, text/event-stream

服务端无状态:每个 POST 独立处理,不要求 Mcp-Session-Id,不需要任何认证头。

stdio(客户端本身运行在 Termux 内)

node ~/termux-mcp/src/server.js --stdio

./scripts/client-config.sh 会打印当前环境适用的完整客户端配置。

工具

类别

工具

Shell

run_command

交互终端

terminal_create terminal_write terminal_read terminal_list terminal_resize terminal_kill terminal_attach_info

后台任务

task_start task_list task_output task_stop task_remove

文件

read_file write_file edit_file list_dir stat_path mkdir copy_path move_path delete_path search_files

Android

clipboard_get clipboard_set notify toast vibrate open battery_status tts_speak termux_api

系统

system_info

资源 / 提示

termux://system/info termux://config termux://audit/recent termux://tasks termux://terminals termux://help、prompt termux_operator

两个容易踩的默认值:terminal_write 的 submit 默认 false,要执行命令必须显式传 true;delete_path 必须显式传 confirm: "DELETE",且拒绝删除 /。

示例

一次性命令:

{ "name": "run_command", "arguments": { "command": "pkg list-installed | head -20" } }

交互式 Python REPL:

{ "name": "terminal_create", "arguments": { "name": "py", "cwd": "~/project", "cols": 120, "rows": 40 } }
{ "name": "terminal_write",  "arguments": { "session": "py", "input": "python3", "submit": true } }
{ "name": "terminal_read",   "arguments": { "session": "py", "expect": "^>>> ", "timeout_ms": 5000 } }

后台构建:

{ "name": "task_start",  "arguments": { "name": "build", "command": "npm run build > build.log 2>&1", "wait_ms": 500 } }
{ "name": "task_output", "arguments": { "id": "t-xxxx", "wait_for": "exit", "wait_ms": 60000, "tail_lines": 200 } }

Android 通知:

{ "name": "notify", "arguments": { "title": "构建完成", "content": "npm run build 已完成", "sound": true } }

安全模型

  • 无 token、无密码、无 OAuth,只监听 127.0.0.1

  • 任何能访问 8770 的本机进程都能执行任意命令、读写任意可访问文件

  • 权限边界是 Termux 用户本身(u0_aXXX),不是这个服务

  • 浏览器来源检查保留:网页无法直接驱动本机命令,原生 App 不受影响

  • 审计日志默认 ~/.local/state/termux-mcp/audit.jsonl,命令全文会记录,不要在里面写密码;security.auditEnabled=false 可关闭

  • 需要远程访问时走 SSH 隧道

配置

~/.config/termux-mcp/config.json,首次启动自动生成;可用 TERMUX_MCP_CONFIG 或 --config 覆盖。常改项:

字段

默认

说明

server.port

8770

监听端口

security.defaultTimeoutSec

120

run_command 默认超时

security.maxOutputBytes

262144

输出截断阈值

security.auditEnabled

true

审计开关

terminal.shell

$SHELL

交互终端 shell;run_command 与后台任务固定用 bash

terminal.useShellRc

false

bash 会话默认 --noprofile --norc,避免 rc 改写行编辑导致 Enter 不执行

tasks.maxTasks

32

后台任务上限

服务管理

脚本

作用

scripts/start.sh

后台启动 + termux-wake-lock + 恢复自启动

scripts/stop.sh

停止服务并暂停自启动(不杀 tmux 会话和后台任务)

scripts/status.sh

状态、自启动状态、地址

scripts/doctor.sh

环境自检

scripts/client-config.sh

打印客户端配置

scripts/install-motd.sh

安装中文登录欢迎语

scripts/install-boot.sh / uninstall-boot.sh

Termux:Boot 开机自启

scripts/autostart-enable.sh / autostart-disable.sh

恢复 / 暂停自启动

scripts/install-termux-api.sh

安装 Termux:API 包装器

后台存活建议:关掉 Termux 的电池优化;start.sh 已自动获取唤醒锁。Android 12+ 的 phantom process killer 可能杀掉后台子进程,需要 adb/root 调整。

许可证

MIT © leemwood

Available Tools

33 tools
battery_statusRead Android battery statusA
Read-onlyIdempotent

Return battery percentage, charging state, temperature and related fields via Termux:API.

Inputs: no named parameters.

clipboard_getRead the Android clipboardA
Read-onlyIdempotent

Return the current Android clipboard text via Termux:API. Requires the termux-api package and Termux:API app.

Inputs: no named parameters.

clipboard_setWrite the Android clipboardA
Idempotent

Set the Android clipboard text via Termux:API. Requires the termux-api package and Termux:API app.

Inputs: text (required).

copy_pathCopy a file or directoryA

Copy a file or directory to another path. Directories are copied recursively; existing destinations require overwrite=true.

Inputs: source (required), destination (required), overwrite.

delete_pathDelete a pathA
Destructive

Delete a file, symlink or directory. Destructive: first call with dry_run=true to inspect the target, then call again with confirm="DELETE". The filesystem root / is always refused; all other paths are allowed subject to the Termux user's Android permissions.

Inputs: path (required), confirm, dry_run, recursive.

edit_fileReplace text in a fileA
Destructive

Replace an exact string in a UTF-8 text file. By default old_string must occur exactly once; use replace_all to replace every occurrence. The file is written atomically.

Inputs: path (required), new_string (required), old_string (required), replace_all.

list_dirList a directoryA
Read-onlyIdempotent

List files and subdirectories with type, size, modification time and permissions. Symlinks are reported but not followed. Hidden entries are skipped unless show_hidden=true.

Inputs: path, max_entries, show_hidden.

mkdirCreate a directoryB
Idempotent

Create a directory. Parent directories are created by default.

Inputs: path (required), recursive.

move_pathMove or rename a pathA
Destructive

Move or rename a file or directory. Existing destinations require overwrite=true. Cross-filesystem moves fall back to copy + delete.

Inputs: source (required), destination (required), overwrite.

notifyPost an Android notificationA
Idempotent

Create an Android notification via Termux:API. Requires the Termux:API app and notification permission. Use a stable id to update an existing notification.

Inputs: id, group, sound, title, +4 more.

openOpen a URL or file on AndroidA

Open an http(s) URL in the default browser, or open a local file with Android via Termux:API. Local paths are resolved on the device; Android permissions still apply.

Inputs: target (required), content_type.

read_fileRead a text fileA
Read-onlyIdempotent

Read a file from an allowed directory (home, shared storage or Termux tmp) as text. Supports line offsets and line numbering. Binary files must be read with encoding="base64". Large reads are limited by security.maxReadBytes.

Inputs: path (required), limit, offset, encoding, +1 more.

run_commandRun a shell command in TermuxA
Destructive

Run a command with bash -c as the Termux user and return exit code, stdout, stderr, duration and truncation flags. Use cwd for the working directory and timeout_sec for long jobs. There is no command allow list: the command runs with the full permissions of the Termux user. A non-zero exit code is returned as data, not as a tool failure. For long-running or interactive work use the task_* or terminal_* tools.

Inputs: command (required), cwd, env, stdin, +1 more.

search_filesSearch files by name or contentA
Read-onlyIdempotent

Recursively search below a root for files matching a glob and optionally a regular expression in their contents. Symlinks are skipped. Returns up to max_results matches.

Inputs: glob, root, query, max_depth, +4 more.

stat_pathInspect a pathA
Read-onlyIdempotent

Return stat information for a file, directory or symlink, including size, permissions, timestamps and the resolved real path.

Inputs: path (required).

system_infoInspect the Termux/Android environmentA
Read-onlyIdempotent

Return device model, Android version, Termux paths, CPU/memory/load, storage usage, network interfaces and availability of common tools (node, python, git, tmux, Termux:API).

Inputs: no named parameters.

task_listList background tasksA
Read-onlyIdempotent

List background tasks with state, PID, exit code, log size and paths. Reads persisted metadata, so tasks started before a termux-mcp restart are included.

Inputs: limit, include_finished.

task_outputRead background task outputA
Read-onlyIdempotent

Read a task log, either the last N lines (default) or an incremental byte range via offset. Use wait_ms to wait for new output. The result includes next_offset for cheap incremental polling.

Inputs: id (required), offset, wait_ms, wait_for, +1 more.

task_removeRemove a finished taskA
DestructiveIdempotent

Delete the metadata, log, status and script files of a task that is no longer running.

Inputs: id (required).

task_startStart a background taskA
Destructive

Start a detached background shell command and return immediately with a task id, PID and log path. The task keeps running if termux-mcp restarts, and its exit code is persisted in a status file. Use task_output to read incremental output and task_stop to terminate it. Background tasks are non-interactive; use terminal_create for prompts and TUI programs.

Inputs: command (required), cwd, env, name, +1 more.

task_stopStop a background taskA
Destructive

Send a signal to the task process group, wait for the grace period, then force SIGKILL if it is still alive. Defaults to SIGTERM.

Inputs: id (required), signal, grace_ms.

terminal_attach_infoShow how to attach to a sessionA
Read-onlyIdempotent

Return the tmux attach command for a session. Run it from a Termux terminal for direct human interaction; external Android apps should keep using terminal_read/terminal_write.

Inputs: session (required).

terminal_createCreate an interactive terminal sessionA

Create a persistent interactive shell in tmux. Sessions survive termux-mcp restarts and can run REPLs, SSH, TUI programs and prompts. The shell defaults to $SHELL (Termux bash if unset); when bash is selected, startup files are skipped by default because a custom .bashrc can break Enter handling. Set use_rc=true or terminal.useShellRc in the config to load them. Use terminal_write to type and terminal_read to capture output.

Inputs: cwd, env, cols, name, +4 more.

terminal_killKill a terminal sessionA
Destructive

Kill one terminal session by name, or every session with all=true. Killing a session terminates its shell and any programs running in that pane.

Inputs: all, session.

terminal_listList terminal sessionsA
Read-onlyIdempotent

List tmux-backed terminal sessions with size, current command, PID, alive/dead state and a command for attaching from a Termux terminal.

Inputs: no named parameters.

terminal_readRead terminal outputA
Read-onlyIdempotent

Capture the visible screen and recent scrollback of a terminal session. Use expect with a regex to wait until a prompt or marker appears; if it does not match within timeout_ms, the result has expect_matched=false and timed_out=true. ANSI escapes are stripped by default. full_history=true captures the whole tmux history.

Inputs: session (required), ansi, lines, expect, +4 more.

terminal_resizeResize a terminal sessionA
Idempotent

Resize the tmux window/PTY used by a terminal session. Useful before launching TUI programs.

Inputs: cols (required), rows (required), session (required).

terminal_writeType into a terminal sessionA

Send literal text, special key names, and/or Enter to a terminal session. Multi-line or large text is pasted through a tmux buffer by default; set paste=false to force literal send-keys. Key names use tmux notation: Enter, Tab, Escape, Up, Down, Left, Right, C-c, C-d, M-x, F1, etc. Set wait_ms to return a capture in the same call.

Inputs: session (required), keys, input, paste, +3 more.

termux_apiRun a raw Termux:API commandA
Destructive

Advanced escape hatch: run any termux-* command directly (for example command="wifi-connectioninfo", args=["-i"]). No shell is involved, but the command still has the full permissions granted to Termux:API. Privacy-sensitive commands such as SMS, calls, contacts, location, camera and microphone are available if the Termux:API app has been granted those Android permissions; every call is written to the audit log.

Inputs: command (required), args, stdin, timeout_sec.

toastShow an Android toastB

Show a short toast message on the device via Termux:API.

Inputs: text (required), short.

tts_speakSpeak text with Android TTSC

Speak text aloud using the Android text-to-speech engine via Termux:API.

Inputs: text (required), rate, pitch, language.

vibrateVibrate the deviceB

Vibrate the device for the given duration via Termux:API.

Inputs: force, duration_ms.

write_fileWrite or append to a fileA
Destructive

Create, overwrite or append to a text file inside an allowed directory. Writes are atomic for overwrite mode. Parent directories can be created automatically. Content is returned as a small JSON summary.

Inputs: path (required), content (required), append, encoding, +1 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.6/5.0

    Scored across 33 tools

    Disambiguation4/5

    Descriptions do a strong job of routing between overlapping entry points: run_command vs terminal_* vs task_* is explicitly explained, and termux_api is framed as an escape hatch for the specific termux-api wrappers. Minor overlaps remain (terminal_attach_info duplicates the attach command already returned by terminal_list, and termux_api can do everything the specific Android tools do), but they are deliberate conveniences rather than confusion.

    Naming Consistency4/5

    Strong grouping via prefixes (terminal_*, task_*, clipboard_*) and mostly verb_noun naming (read_file, list_dir, task_start, move_path). Deviations: clipboard_get/set use noun_verb ordering while the majority use verb_noun, and a handful are bare verbs (open, toast, notify, vibrate, mkdir) with no consistent noun.

    Tool Count3/5

    33 tools is at the high end; however the surface is genuinely broad, spanning filesystem CRUD, tmux terminals, background tasks, Android Termux:API, and system info, and the tools are cleanly clustered by subsystem. Each group earns its tools, but an agent must scan a large menu and the count exceeds the comfortable 3-15 range.

    Completeness5/5

    Lifecycle coverage is thorough in every subsystem: filesystem has read/write/edit/delete/mkdir/copy/move/list/stat/search; terminals have create/write/read/list/resize/kill/attach; tasks have start/list/output/stop/remove; Android has clipboard, notifications, toast, vibrate, open, battery, TTS plus an escape hatch. No obvious dead ends, with run_command and termux_api filling residual gaps.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • F
      license
      Not graded
      quality
      C
      maintenance
      A secure MCP gateway for Termux that exposes filesystem, shell, and Termux:API tools over a local HTTP endpoint with admin controls, job management, and upstream support.
      1
      -
    • A
      license
      Not graded
      quality
      C
      maintenance
      Enables LLM agents to remotely perform Termux/Android operations through a hosted MCP endpoint, including device status checks, shell command execution, and package management.
      14 npm
      1
      MIT
    • A
      license
      Not graded
      quality
      B
      maintenance
      MCP server for Termix that enables listing hosts, running commands, reading/writing files, controlling Docker and systemd, managing tunnels, and reading logs.
      Apache 2.0
    • A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI assistants to securely interact with an Android device running Termux, executing shell commands with configurable timeouts, smart output truncation, and MCP Streamable HTTP transport for multi-session clients.
      MIT