XBrowser Controller - XBrowser Deep Control Skill

Complete reverse-engineering understanding of XBrowser (com.mmbox.xbrowser), APK modification capabilities, and the ability to control the browser directly through a built-in MCP server.

Master 404 native bridge methods, APK modification capabilities, and 439 MCP tools to directly control XBrowser over HTTP.

Features

• Control XBrowser directly through the MCP HTTP server

• 8 basic tools: status query, tab info, execute JS, get HTML, get text, enumerate bridge methods, navigate, reload

• 27 advanced wrapper tools: system info, UI theme, dialogs, clipboard, search, UA management, proxy, reading mode, media/TTS, download management, file management, bookmarks, accounts, VIP, autofill, site policies, privacy, tab management, gestures, events, QR scanning, sharing, zoom, security, user scripts, developer tools, ad blocking

• 404 native bridge methods for direct invocation

• Supports both LAN direct connection and ADB tunnel connection methods

• Skill definition file that can be directly integrated into AI Agent systems

Related MCP server: MCP Browser Server

Prerequisites

1. XBrowser Enhanced APK (with built-in MCP HTTP server, port 8765)

2. Python 3.8+

3. Network connection (LAN or ADB)

Quick Start

1. Install Dependencies

pip install -r requirements.txt

2. Start the XBrowser MCP Server

In XBrowser Enhanced, the browser automatically listens on port 8765 after startup.

Confirm the MCP server is running:

curl -X POST http://127.0.0.1:8765/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"xbrowser_status","arguments":{}}}'

3. Use the Python Client

from xbrowser_mcp_server import XBrowserClient

# 连接 X浏览器 MCP 服务器
client = XBrowserClient("http://127.0.0.1:8765/mcp")

# 查询状态
status = client.call_tool("xbrowser_status")
print(status)

# 导航到网页
client.call_tool("xbrowser_navigate", {"url": "https://www.baidu.com"})

# 获取页面内容
html = client.call_tool("xbrowser_get_html")
print(html)

# 执行 JavaScript
result = client.call_tool("xbrowser_eval_js", {"expression": "document.title"})
print(result)

# 获取 Cookie
cookies = client.call_tool("xbridge_GM_cookie_list", {"p1": "", "p2": "", "p3": "", "p4": ""})
print(cookies)

# TTS 语音朗读
client.call_tool("xbridge_TTS", {"p1": "你好，这是语音朗读测试"})

4. Command Line Usage

# 查询状态
python xbrowser_mcp_server.py status

# 导航
python xbrowser_mcp_server.py navigate https://www.baidu.com

# 获取页面文本
python xbrowser_mcp_server.py text

# 执行JS
python xbrowser_mcp_server.py eval "document.title"

Connection Methods

LAN Direct Connection

POST http://192.168.1.5:8765/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"xbrowser_status","arguments":{}}}

ADB Tunnel (if LAN is unavailable)

adb forward tcp:8765 tcp:8765
# 然后访问 http://127.0.0.1:8765/mcp

Tool List

I. Basic Tools (8)

II. Advanced Wrapper Tools (27)

Each tool uses the action parameter to distinguish sub-operations, including: system info, UI theme, dialogs, clipboard, search, UA management, proxy, reading mode, media/TTS, download management, file management, bookmarks, accounts, VIP, autofill, site policies, privacy, tab management, gestures, events, QR scanning, sharing, zoom, security, user scripts, developer tools, ad blocking.

III. Bridge Method Tools (404)

Naming convention: xbridge_, parameters passed in order as p1, p2, p3...

Commonly available bridge methods:

• xbridge_getVersionCode -> version number

• xbridge_getBrowserInfoObj -> browser info

• xbridge_inChina -> whether in China

• xbridge_GM_cookie_list(p1,p2,p3,p4) -> list cookies (including httpOnly)

• xbridge_getFaviconURI(p1) -> get site favicon

• xbridge_getElementRules(p1) -> get ad filtering rules

• xbridge_getSniffMediaResource -> sniff media resources

• xbridge_TTS(p1) -> text-to-speech reading

Security Validation Notes

Approximately 1/4 of bridge methods are protected by X8.p() security validation and can only be called on the following pages:

• x:// internal protocol pages (e.g., x://settings)

• file:///android_asset/ settings pages

• xbext.com domain

Solution: call xbrowser_navigate("x://settings") first, then invoke restricted methods.

APK Modification Knowledge

Toolchain

# 编译 Java
javac -cp /opt/android-sdk/platforms/android-34/android.jar -d out com/mmbox/xbrowser/XBrowserMcpServer.java

# 转换为 DEX
java -cp /opt/android-sdk/build-tools/35.0.0/lib/d8.jar com.android.tools.r8.D8 \
  --output dex_out --lib /opt/android-sdk/platforms/android-34/android.jar \
  out/com/mmbox/xbrowser/*.class

# 反编译 DEX
java -cp /usr/share/java/baksmali.jar:... org.jf.baksmali.Main \
  disassemble -o smali_out dex_out/classes.dex

# 打包 APK
apktool b $DECODED_DIR -o output.apk

# 签名
java -jar /opt/android-sdk/build-tools/35.0.0/lib/apksigner.jar sign \
  --ks /tmp/debug.keystore --ks-pass pass:android \
  --out signed.apk unsigned.apk

# 安装
adb install -r signed.apk

Modification Points

1. Browser.smali -> inject getInstance() -> setContext() -> start() in onCreate()

2. Of.smali -> inject getInstance() -> registerWebView(webView) in constructor

3. X8.smali -> append enableMcpServer(boolean) and isMcpServerEnabled() bridge methods

4. assets/settings/general-setting.html -> inject MCP toggle UI + JS

Known Issues

Project Structure

xbrowser_controller/
├── README.md                  # 项目说明
├── LICENSE                    # MIT 许可证
├── xbrowser_mcp_server.py     # MCP 服务器客户端核心代码
├── skills.json                # 技能定义（8个预置工具）
├── requirements.txt           # Python 依赖
└── .gitignore

Skill Definitions

skills.json contains complete definitions for 8 preset tools that can be directly integrated into AI Agent systems:

• Query XBrowser status

• XBrowser navigation

• XBrowser search

• Read XBrowser page content

• Get XBrowser cookies

• Get XBrowser info

• XBrowser execute JS

• XBrowser text-to-speech

Notes

• This tool is for legitimate security research and learning only

• Reverse engineering and APK modification must comply with applicable laws and regulations

• Any consequences arising from the use of this tool are the sole responsibility of the user

License

MIT License