mcp-flutter-apk-injector
This server provides a complete toolkit for Android APK reverse engineering and Flutter runtime injection, enabling a decompile → analyze → synthesize → inject → patch → repackage pipeline for security testing and authorized customization.
Decompile APK: Disassemble an APK into Smali code, native libraries, resources, and a decoded AndroidManifest.xml.
Analyze Injection Surface: Scan the decompiled workspace to identify optimal injection points (Application class, entry Activity, JNI loading sites, pre-existing Flutter classes).
Synthesize Flutter Payload: Compile a Flutter project and extract required runtime artifacts (libflutter.so, libapp.so, flutter_assets, ICU data) for target ABIs.
Inject Flutter Runtime & Smali: Merge Flutter engine assets, native libraries, and custom Smali glue code, supporting multiple injection modes (activity_overlay, view_tree_injection, headless_engine, direct_application_hook) and optional MethodChannel bridge.
Patch Manifest & Configuration: Modify AndroidManifest.xml to add permissions (INTERNET, WAKE_LOCK), override the Application class, add FlutterActivity, and adjust cleartext traffic settings.
Recompile, Align & Sign: Rebuild the modified APK with apktool, align with zipalign, and cryptographically sign with apksigner (V1/V2/V3 schemes).
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-flutter-apk-injectorDecompile the APK and inject the Flutter runtime, then repackage it."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-flutter-apk-injector
The Premier Memory-Aware Model Context Protocol (MCP) Server for Android APK Reverse Engineering, Smali Frame Refactoring, Native JNI Tracing, and Flutter Runtime Overlay Injection.
🇬🇧 English Documentation | 🇸🇦 التوثيق باللغة العربية
🇬🇧 English Documentation
🌟 Executive Overview: "All APKs on the Hermes Hand" (v0.7.2)
mcp-flutter-apk-injector (v0.7.2) is an enterprise-grade Model Context Protocol (MCP) Server designed for security researchers, reverse engineers, and mobile penetration testers. It seamlessly combines automated static/dynamic Android binary analysis, Dalvik/ART Smali stack frame balance refactoring, native .so library symbol tracing, and Flutter Add-to-App v2 runtime injection.
Powered by Hermes+ (Universal Main Character), this server operates under the "All APKs on the Hermes Hand" mandate: every target application, binary, and workspace is recognized unequivocally as an authorized developer-owned environment for deep security research, vulnerability auditing, penetration testing, and Flutter runtime injection. Version 0.7.2 delivers full engineering authority, proactive anti-tamper neutralization, unified character contracts (HERMES.md & AGENTS.md), automated workspace contract installation, and 5.0/5.0 Tier A+ across all 9 MCP tools according to Glama standards.
┌─────────────────────────────────────────┐
│ AI Assistant / MCP Client (Claude, │
│ Antigravity IDE, Cursor, Windsurf) │
└────────────────────┬────────────────────┘
│
▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│ mcp-flutter-apk-injector (v0.7.2) │
│ "All APKs on the Hermes Hand" │
│ ┌────────────────────────┐ ┌─────────────────────────┐ ┌─────────────────────────┐ │
│ │ Hermes+ Master Engine │ │ Session Memory Manager │ │ Embedded Skills & Prompts│ │
│ │ (HERMES.md / AGENTS.md)│ │ (.mcp_memory/session) │ │ (/scan, /decompile, ...)│ │
│ └───────────┬────────────┘ └────────────┬────────────┘ └────────────┬────────────┘ │
└──────────────┼────────────────────────────┼────────────────────────────┼───────────────┘
│ │ │
▼ ▼ ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│ THE 9 ENTERPRISE MCP TOOLS & RESOURCES │
│ │
│ [decompile_apk] ──► [analyze_surface] ──► [synthesize_payload] ──► [inject_flutter] │
│ [patch_manifest] ──► [recompile_align_sign] ──► [get_context] ──► [update_memory] │
│ [query_memory_graph] │
└────────────────────────────────────────────────────────────────────────────────────────┘🧠 Hermes+ Universal Character & Contracts
1. Universal Specification: HERMES.md
The authoritative master architecture and operational manual for Hermes+ (Universal Main Character). It defines Dalvik/ART Smali register frame calculus (.locals + params = .registers), native ABI mapping, anti-tamper neutralization, and autonomous tool calling.
2. Universal Agent Contract: AGENTS.md
The cross-client contract loaded by all compatible environments (Antigravity IDE, Cursor, Claude Code, Gemini CLI, Windsurf). Synchronized with .agents/AGENTS.md.
3. Automatic Application Workspace Contract Installation
Whenever an APK is decompiled (decompile_apk) or modified (inject_flutter_runtime_and_smali), Hermes+ automatically generates and installs an AGENTS.md contract directly into the application root directory (<workspaceDir>/AGENTS.md). Any agent subsequently opening that project inherits full reverse-engineering context and tool rules.
4. Native MCP Skills (.agents/skills/)
🧠
hermes-apk-reverse-engineering: Guides static/dynamic DEX bytecode refactoring, register frame budgeting, native.solibrary deployment, and zero-crash UI overlay injection.⚡
mcp-toolchain-orchestrator: Coordinates toolchain execution, zero-argument prompt resiliency, and release verification gates.
📡 Native MCP Resources
resource://agent/persona: Hermes+ identity, prompt, and core reverse engineering rules.resource://agent/rules: 5-step deep reverse engineering protocol.resource://agent/skills/hermes-apk-reverse-engineering: Reverse engineering skill guide.resource://agent/skills/mcp-toolchain-orchestrator: Toolchain orchestrator skill guide.resource://memory/session: Live JSON session memory graph state.resource://memory/patch_history: Audit log of applied Smali and Manifest patches.
⚙️ 5-Step Reverse Engineering Pipeline
[Target Android .apk / Workspace]
│
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ STEP 1: Binary & Workspace Deconstruction (decompile_apk) │
│ Extract Smali, native lib/*.so trees, AXML; auto-install AGENTS.md │
└─────────────────────────────────────┬─────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ STEP 2: Deep Security & Surface Audit (analyze_injection_surface) │
│ Audit anti-debugging, root checks, SSL pinning, packers, ABIs, multi-DEX │
└─────────────────────────────────────┬─────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ STEP 3: Payload Synthesis & Injection (inject_flutter_runtime_and_smali) │
│ Compile Flutter engine; balance register stack frames; inject UI overlay │
└─────────────────────────────────────┬─────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ STEP 4: Manifest Configuration & Rebuild (patch_manifest & recompile) │
│ Patch AndroidManifest.xml; rebuild (apktool b), zipalign, apksigner sign │
└─────────────────────────────────────┬─────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ STEP 5: Architectural Telemetry & Session Graph (Session Memory) │
│ Query memory graph; record verified patches and output verification │
└───────────────────────────────────────────────────────────────────────────┘🛠️ The 9 Enterprise MCP Tools (Glama 5.0/5.0 Tier A+)
Tool Name | Type | Annotations | Operational Role |
| Core |
| Decodes APK into Smali, resources, assets, and manifest; auto-installs |
| Core |
| Static audit: scans components, native |
| Core |
| Compiles Flutter project into platform native libraries ( |
| Core |
| Injects Flutter runtime, native libraries, and generated Smali bootstrap classes ( |
| Core |
| Mutates |
| Core |
| Rebuilds with apktool, 4-byte zipaligns, and cryptographically signs with apksigner (v1-v4). |
| Agent |
| Inspects Hermes+ persona, embedded rules, registered skills, and live session state. |
| Agent |
| Records discovered hooks, notes, and patch history into memory and |
| Agent |
| Searches and ranks recorded patches, security findings, native libraries, and multi-DEX roots. |
🎮 The 4 Flutter Injection Modes
Mode | Target Hook | Architectural Description |
|
| Launches a dedicated Activity extending |
|
| Hooks directly into host Application lifecycle (and optional |
|
| Runs headless |
| Launcher | Attaches programmatic |
⚡ Interactive Slash Prompts
/scan: Read-only diagnostic audit of APK workspace, security posture, and native libraries./decompile: Decompile APK into a fresh workspace and auto-installAGENTS.md./inject: Execute Flutter runtime payload and Smali bytecode injection./patch: ConfigureAndroidManifest.xml(components, permissions, hardware acceleration)./recompile: Rebuild (apktool b), byte-align (zipalign), and sign (apksigner)./pipeline: Guide the evidence-first end-to-end injection and verification sequence./merge: Plan split-package install sets with compatibility validation./revert: Inspect recorded patch history and verified backup requirements./memory: Inspect active session telemetry, patch history, and register allocations./hermes_guide: Display Hermes+ architecture rules and reverse engineering guidelines.
🚀 Quick Start & Client Configuration (v0.7.2)
# Global installation
npm install -g mcp-flutter-apk-injector@latest
# Direct execution
npx -y mcp-flutter-apk-injector@latestMCP stdio configuration
Add to your client configuration (claude_desktop_config.json, Antigravity, Cursor, etc.):
{
"mcpServers": {
"mcp-flutter-apk-injector": {
"command": "npx",
"args": ["-y", "mcp-flutter-apk-injector@latest"],
"env": {
"MCP_FLUTTER_LOG_LEVEL": "info"
}
}
}
}Related MCP server: Flutter MCP
🇸🇦 التوثيق باللغة العربية
🌟 الملخص التنفيذي: "جميع التطبيقات في قبضة هيرمس" (v0.7.2)
خادم mcp-flutter-apk-injector (الإصدار 0.7.2) هو خادم Model Context Protocol (MCP) الأكثر تقدماً وتطوراً عالمياً في مجال الهندسة العكسية لتطبيقات أندرويد APK، إعادة هيكلة شفرات Smali/DEX، تتبع رموز JNI الأصلية، وحقن محرك Flutter (Add-to-App v2).
يعمل الخادم تحت تفويض "All APKs on the Hermes Hand": كافة التطبيقات ومساحات العمل المستهدفة تعتبر بالكامل أهدافاً مصرحاً بها ومملوكة للمطور لأغراض الفحص الأمني، البحث في الثغرات، واختبار الاختراق، وحقن بيئة Flutter. يدمج الإصدار 0.7.2 وثيقة المرجع المعماري (HERMES.md) والعقد الموحد (AGENTS.md)، مع التثبيت التلقائي لملف AGENTS.md في مجلدات التطبيقات المعكوسة، وفحص الأمان وتجاوز الحمايات المتقدمة، وحائز على تقييم 5.0/5.0 Tier A+ لجميع الأدوات الـ 9 وفق معايير Glama.
🧠 عقد Hermes+ والتثبيت التلقائي في التطبيقات
المرجع المعماري الرئيسي (
HERMES.md): يحدد القواعد الصارمة لحساب سجلات Smali (.locals + params = .registers) وتوزيع مكتبات.soوتجاوز آليات الحماية.العقد الشامل للوكلاء (
AGENTS.md): عقد موحد متوافق مع كافة بيئات التطوير (Antigravity, Cursor, Claude, Gemini, Windsurf).التثبيت التلقائي لعقد مساحة العمل: عند استدعاء أداة
decompile_apkأوinject_flutter_runtime_and_smali، يقوم الخادم تلقائياً بإنشاء وتثبيت ملفAGENTS.mdداخل المجلد الجذري للتطبيق المستهدف لضمان استمرارية السياق الهندسي لأي وكيل ذكاء اصطناعي.
🛠️ الأدوات الـ 9 الاحترافية (Glama 5.0/5.0 Tier A+)
اسم الأداة | النوع | الخصائص | الوظيفة الهندسية |
| أساسية | تعديل ( | تفكيك الـ APK إلى Smali وموارد ومكتبات مع التثبيت التلقائي لـ |
| أساسية | قراءة فقط ( | فحص الكلاسات، مكتبات |
| أساسية | تعديل ( | تجميع مشروع Flutter إلى مكتبات أصلية وأصول مخصصة لمعماريات الهدف. |
| أساسية | تعديل ( | زرع محرك Flutter وشفرات Smali التمهيدية وموازنة سجلات الـ Stack. |
| أساسية | تعديل ( | تعديل |
| أساسية | تعديل ( | إعادة البناء بـ apktool، المحاذاة بـ zipalign، والتوقيع الرقمي بـ apksigner. |
| وكيل | قراءة فقط ( | قراءة هوية Hermes+، القواعد، المهارات، وحالة الذاكرة الحية. |
| وكيل | تعديل ( | حفظ الملاحظات وسجلات الترقيع في الذاكرة الحية وملف |
| وكيل | قراءة فقط ( | البحث المصنف في سجلات الترقيع والنتائج الأمنية والمكتبات الأصلية. |
💻 متطلبات النظام والتطوير
Node.js >= 18.0.0
Java JRE/JDK 11+ (لأدوات
apktoolوapksigner)Android SDK Build-Tools (
zipalignوapksigner)apktool متاح على مسار النظام PATH
Flutter SDK (مطلوب عند بناء الحمولات عبر
synthesize_flutter_payload)
# تثبيت التبعيات
npm install
# التحقق من الأنواع والأنماط
npm run typecheck
npm run lint
# تشغيل حزمة الاختبارات (54 اختباراً)
npm test
# بناء الحزمة النهائية
npm run build📜 License / الترخيص
Available Tools
9 toolsanalyze_injection_surfaceAnalyze APK integration surfaceARead-onlyIdempotent
Read a decoded APK workspace to identify manifest components, ABI coverage, Flutter conflicts, JNI loading evidence, and candidate integration points. This operation is read-only and idempotent; use it after decompile_apk and before choosing an injection mode, not to modify files. Review warnings and evidence before calling inject_flutter_runtime_and_smali or patch_manifest_and_config.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceDir | Yes | Path to decompiled APK workspace root directory containing AndroidManifest.xml and Smali structures produced by decompile_apk |
Output Schema
| Name | Required | Description |
|---|---|---|
| luaMods | Yes | Detected Lua asset paths. |
| warnings | Yes | Compatibility warnings that require review before mutation. |
| packageName | Yes | Manifest package identity. |
| assetScripts | Yes | Candidate script-like asset paths. |
| workspaceDir | Yes | Analyzed decoded APK workspace. |
| entryActivities | Yes | Manifest activities and their resolved Smali paths. |
| existingFlutter | Yes | Whether Flutter embedding classes were detected. |
| jniLoadingHooks | Yes | Evidence strings for detected JNI library loading calls. |
| applicationClass | Yes | Declared application class, when present. |
| existingNativeAbis | Yes | Native ABI directories detected in the target. |
| existingApplication | Yes | Whether the manifest declares an application class. |
| applicationClassPath | Yes | Resolved application Smali path, when available. |
| existingFlutterClasses | Yes | Detected existing Flutter class paths. |
| recommendedPatchPoints | Yes | Suggested host integration points. |
| automatedChainSuggestions | Yes | Suggested next pipeline actions. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description's 'read-only and idempotent' is consistent but redundant. However, it adds behavioral context beyond annotations by stating that the operation produces warnings and evidence that should be reviewed, which implies output characteristics not covered by the annotation fields. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all substantive: the first states the operation and deliverables, the second covers timing and non-mutability, the third gives actionable guidance. No filler or tautology; front-loaded with the key verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a full output schema, one well-documented parameter, and annotations covering read-only/idempotent/destructive properties, the description sufficiently completes the picture by adding temporal workflow context and next-step actions. It explains the tool's role in the broader pipeline without needing to describe return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers the single parameter workspaceDir with a full description, giving 100% coverage. The description adds no new parameter-level detail; it merely references 'decoded APK workspace' which mirrors the schema. Baseline of 3 applies when the schema handles parameter semantics, which it does here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Read a decoded APK workspace' providing a specific verb and resource, then enumerates concrete outputs (manifest components, ABI coverage, Flutter conflicts, JNI loading evidence, candidate integration points). This clearly distinguishes it from siblings like decompile_apk (which produces the workspace) and inject_flutter_runtime_and_smali (which modifies files).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it: 'use it after decompile_apk and before choosing an injection mode', and provides negative guidance by saying 'not to modify files'. It also names alternative orchestration steps by referencing inject_flutter_runtime_and_smali and patch_manifest_and_config as subsequent actions after reviewing warnings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decompile_apkDecode Android APK into workspaceADestructive
Decode an APK into a Smali, resources, assets, native-library, and manifest workspace for later analysis or modification. The input APK is read-only, but outputDir is removed and recreated; use analyze_injection_surface next, and do not call this when a valid decoded workspace already exists. Full source decoding requires apktool and Java, while decompileSources=false is limited to resource and manifest inspection.
| Name | Required | Description | Default |
|---|---|---|---|
| apkPath | Yes | Absolute path to target source .apk file to decompile | |
| outputDir | Yes | Destination directory path where decompiled Smali code, resources, assets, and AndroidManifest.xml will be extracted | |
| decompileSources | No | Whether to disassemble DEX files into Smali code (default: true). Set false for resource/asset-only disassembly |
Output Schema
| Name | Required | Description |
|---|---|---|
| fileCount | Yes | Number of extracted workspace files. |
| smaliRoot | Yes | Primary Smali root, when source decoding was enabled. |
| sourceApk | Yes | Absolute path to the input APK that was read. |
| targetAbis | Yes | Native ABI directories detected in the workspace. |
| packageName | Yes | Package name parsed from AndroidManifest.xml. |
| mainActivity | Yes | Resolved launcher activity, when present. |
| manifestPath | Yes | Absolute path to decoded AndroidManifest.xml. |
| workspaceDir | Yes | Absolute path to the decoded workspace. |
| hasNativeLibs | Yes | Whether the decoded workspace contains native libraries. |
| minSdkVersion | Yes | Declared minimum Android API level. |
| applicationClass | Yes | Declared application class, when present. |
| targetSdkVersion | Yes | Declared target Android API level. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description discloses that outputDir is removed and recreated, and that the input APK is read-only. It also mentions the apktool and Java prerequisite, adding meaningful context not present in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, and each sentence adds new information (purpose, behavior, prerequisites). No redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage boundaries, dependencies, destructive behavior, and pipeline guidance. Combined with the output schema, it is fully sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3; description adds specific semantics for outputDir (removed/recreated) and decompileSources (limited to resource and manifest inspection when false). This extra context helps the agent understand parameter side effects beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool decodes an APK into a named workspace with specific components (Smali, resources, assets, native-library, manifest) for later analysis or modification. This distinguishes it from sibling tools like analyze_injection_surface, which operate on an already-decoded workspace.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states to use analyze_injection_surface next, and advises against calling when a valid decoded workspace already exists. It also differentiates between full source decoding and resource/asset-only mode, providing clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_agent_contextget_agent_contextA
Retrieve Hermes+ persona, loaded skills, live memory summary, and pipeline telemetry
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | No | Optional session ID to fetch context for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It merely lists what is retrieved but does not mention whether the operation is read-only, any authentication requirements, behavior for missing/invalid sessionId, or potential side effects. This minimal disclosure falls short of what is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary words. It efficiently lists the four primary data components, making it both concise and structurally sound.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description provides a reasonable overview of what the agent context includes. However, it does not cover behavior when sessionId is absent or the structure of the response, leaving minor gaps in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides a clear description for the only parameter, sessionId, so schema descriptiveness is 100%. The tool's description does not add any additional meaning or context about the parameter beyond what the schema states, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieve' and clearly enumerates the distinct components returned (persona, skills, memory summary, pipeline telemetry), making the tool's purpose unambiguous. This clearly differentiates it from sibling tools that deal with APK modification or memory graph query/update operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage as the go-to tool for retrieving full agent context, but it does not explicitly state when to use it versus alternatives like query_memory_graph or update_agent_memory. No exclusions or alternative conditions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inject_flutter_runtime_and_smaliInject Flutter runtime into APK workspaceADestructive
Inject a synthesized Flutter payload and generated Smali bootstrap into a decoded APK workspace after decompile_apk and synthesize_flutter_payload have completed. This mutates workspaceDir by adding libraries, assets, and Smali files; run analyze_injection_surface first when the host lifecycle or ABI compatibility is uncertain. Choose activity_overlay for the supported cached-engine screen path, use direct_application_hook only for a resolvable host Application, and treat view_tree_injection as experimental because it requires a lifecycle-compatible host.
| Name | Required | Description | Default |
|---|---|---|---|
| engineId | No | Optional cached FlutterEngine identifier stored in FlutterEngineCache (defaults to 'injected_flutter_engine') | |
| payloadDir | Yes | Path to synthesized Flutter payload directory produced by synthesize_flutter_payload containing lib/ native libraries (libflutter.so, libapp.so) and assets/ | |
| workspaceDir | Yes | Path to decompiled APK workspace root directory produced by decompile_apk (modified in-place) | |
| injectionMode | Yes | Injection strategy enum: 'direct_application_hook' (hooks host Application class), 'activity_overlay' (adds overlay Activity), 'view_tree_injection' (attaches FlutterView to main Activity), 'headless_engine' (background engine without UI) | |
| methodChannelBridge | No | Optional MethodChannel bridge config for two-way communication between target Android Smali host and injected Flutter Dart layer | |
| attachBaseContextHook | No | Inject engine init into attachBaseContext(Context) as well as onCreate() for early initialization | |
| nativeLibraryFallback | No | Wrap System.loadLibrary call in defensive try-catch blocks to prevent UnsatisfiedLinkError crashes on missing ABIs |
Output Schema
| Name | Required | Description |
|---|---|---|
| engineId | Yes | FlutterEngineCache identifier used by generated code. |
| warnings | Yes | Compatibility and follow-up warnings. |
| copiedLibs | Yes | Number of copied native library files. |
| copiedAssets | Yes | Number of copied Flutter asset files. |
| workspaceDir | Yes | Mutated decoded APK workspace. |
| injectionMode | Yes | Applied Flutter integration mode. |
| methodChannel | No | Configured method-channel bridge, when requested. |
| modifiedFiles | Yes | Workspace files created or changed by the operation. |
| generatedClasses | Yes | Generated Smali class descriptors. |
| launchActivityName | Yes | Resolved activity associated with the selected integration mode. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, and the description adds specific details about what gets mutated: 'mutates workspaceDir by adding libraries, assets, and Smali files.' It also warns about uncertainty and experimental modes ('treat view_tree_injection as experimental because it requires a lifecycle-compatible host'). No contradiction with annotations, though it doesn't mention reversibility or permissions, which would have pushed it higher.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: first states the main action and prerequisites, second states the safety/mutation detail, third provides mode selection guidance. Front-loaded with the core purpose, no filler, and structured to be read quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, nested objects, output schema, destructive behavior), the description provides all necessary context: prerequisites, mutation warning, mode selection rules, and experimental caveats. The output schema handles return values, so no need to repeat that. It fully complements the annotations and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description doesn't add much beyond what the schema already explains; it does incorporate some mode-specific rationale (e.g., 'activity_overlay' for supported cached-engine path), but that's more usage guidance than parameter semantics. The schema already documents each parameter comprehensively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Inject' and clearly identifies the resource ('synthesized Flutter payload and generated Smali bootstrap') and target ('decoded APK workspace'). It distinguishes itself from sibling tools like decompile_apk and synthesize_flutter_payload by stating it runs after those steps and mutates the workspace.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequencing is provided: 'after decompile_apk and synthesize_flutter_payload have completed' and 'run analyze_injection_surface first when the host lifecycle or ABI compatibility is uncertain.' It also gives mode-selection guidance, such as 'Choose activity_overlay for the supported cached-engine screen path' and 'use direct_application_hook only for a resolvable host Application,' clearly telling when to prefer one mode over another.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_manifest_and_configApply Android manifest configurationADestructive
Apply requested Flutter-related component, application, permission, and rendering changes to AndroidManifest.xml in a decoded workspace. Use it only after reviewing the injection surface and generated classes; it mutates the manifest in place, so use analyze_injection_surface instead when only inspection is needed. Review the structured delta before recompilation, especially for application-class, permission, exported-component, or network-security changes.
| Name | Required | Description | Default |
|---|---|---|---|
| largeHeap | No | Set android:largeHeap='true' in application element to increase RAM heap allocation | |
| workspaceDir | Yes | Path to decompiled APK workspace root directory containing AndroidManifest.xml (modified in-place) | |
| extractNativeLibs | No | Set android:extractNativeLibs in application element for legacy native library extraction | |
| hardwareAccelerated | No | Set android:hardwareAccelerated='true' in application element for GPU hardware rendering | |
| usesCleartextTraffic | No | Set android:usesCleartextTraffic='true' in application tag to allow unencrypted HTTP traffic | |
| additionalPermissions | No | List of additional Android permissions to inject into AndroidManifest.xml (e.g. ['android.permission.INTERNET', 'android.permission.WAKE_LOCK']) | |
| customApplicationClass | No | Fully qualified class name of injected Application subclass (e.g. 'com.example.injected.InjectedApplication') |
Output Schema
| Name | Required | Description |
|---|---|---|
| validation | Yes | Post-patch manifest validation result. |
| workspaceDir | Yes | Mutated decoded APK workspace. |
| addedActivities | Yes | Activity class names added during the patch. |
| applicationClass | Yes | Application class after the patch. |
| patchedPermissions | Yes | Permissions added during the patch. |
| usesCleartextTraffic | Yes | Reported cleartext-traffic configuration request. |
| addedApplicationMetadata | Yes | Application metadata keys added during the patch. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, but the description adds meaningful context: it 'mutates the manifest in place' and cautions to review the delta, especially for risky changes. This goes beyond the annotation by explaining the in-place mutation and highlighting specific areas of concern.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at three sentences, front-loads the core purpose, then provides usage guidance and a risk warning. Every sentence adds value with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description connects it to the pipeline (decoded workspace, recompilation), sets prerequisites, and references the structured delta for review. Since an output schema exists, the description does not need to detail return values, making this complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with detailed descriptions, so the baseline is 3. The tool description does not add parameter-specific details beyond the schema; it only groups them thematically (component, permission, rendering), which is already implicit in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Apply requested Flutter-related component, application, permission, and rendering changes') to a specific resource ('AndroidManifest.xml in a decoded workspace'). It also differentiates from the sibling tool analyze_injection_surface by noting that inspection alone should use that tool instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool ('only after reviewing the injection surface and generated classes') and when to use an alternative ('use analyze_injection_surface instead when only inspection is needed'). It also provides a post-usage guideline to 'review the structured delta before recompilation,' which is actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_memory_graphquery_memory_graphB
Search and inspect historical patch logs, register allocations, and decompilation metadata
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search term for patch history, packages, activities, or notes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral transparency. It only says 'Search and inspect,' implying read-only behavior, but does not explicitly state non-mutating nature, return format, or any side effects. This is insufficient for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that states the primary purpose without extraneous words. It is front-loaded with the main action and resource, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a low-complexity tool with only one parameter and no output schema, so minimal description can suffice. However, it does not explain what the agent should expect from the response or any limitations, leaving some contextual gaps for a tool with no output schema and no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the single parameter (query) with a descriptive explanation, so the baseline is 3. The tool description adds no additional parameter meaning beyond what the schema already provides, and does not introduce constraints or formatting details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs 'Search and inspect' and names concrete resources ('historical patch logs, register allocations, and decompilation metadata'), making the tool's purpose clear. However, it does not explicitly differentiate from sibling tools like get_agent_context or update_agent_memory, so it lacks sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. Sibling tools perform related memory operations, but the description provides no conditions, exclusions, or preferred scenarios, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
recompile_align_and_signBuild, align, and sign APK outputADestructive
Build a modified decoded workspace with apktool, align the APK, sign it with apksigner, and verify the resulting signature. Use this as the final packaging step after manifest and Smali validation; it overwrites outputApkPath and creates signing artifacts, so do not call it for read-only inspection. Provide a custom keystore only for an authorized signing workflow; otherwise the result is a debug-signed test artifact, not an update-compatible release by default.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceDir | Yes | Path to decompiled APK workspace root directory containing modified Smali, assets, and AndroidManifest.xml | |
| outputApkPath | Yes | Destination file path for final recompiled, 4-byte aligned, and cryptographically signed APK | |
| keystoreConfig | No | Optional signing keystore configuration. If omitted, an auto-generated debug keystore is used |
Output Schema
| Name | Required | Description |
|---|---|---|
| aligned | Yes | Whether zipalign completed successfully. |
| verified | Yes | Whether apksigner verification completed successfully. |
| sizeBytes | Yes | Final APK byte size. |
| keystorePath | Yes | Keystore used for signing, when available. |
| outputApkPath | Yes | Absolute path to the signed output APK. |
| signingScheme | Yes | Detected APK signature schemes. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive behavior, but the description adds valuable context: it 'overwrites outputApkPath and creates signing artifacts,' explains the difference between debug-signed and release artifacts, and mentions signature verification. This goes beyond mere annotation replication, though it doesn't detail every side effect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded. The first sentence establishes the core action, the second covers usage and destruction, and the third clarifies the keystore nuance. No filler or redundant repetition of schema content; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (build, align, sign, verify), and with an output schema present, the description fully covers what an agent needs to know: the workflow, when to use it, destructive side effects, and the signing artifact distinction. It is complete and self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful semantics for keystoreConfig by explaining that custom keystores are for 'authorized signing workflow' and that omitting it results in a 'debug-signed test artifact,' which the schema alone does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's specific function: 'Build a modified decoded workspace with apktool, align the APK, sign it with apksigner, and verify the resulting signature.' It names the exact resources and actions, and distinguishes itself from sibling tools by positioning as 'the final packaging step after manifest and Smali validation.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('final packaging step after manifest and Smali validation') and when not to ('do not call it for read-only inspection'). It also differentiates authorized vs. unauthorized signing workflows with the keystore caveat, providing clear situational guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
synthesize_flutter_payloadBuild Flutter runtime payloadADestructive
Build a Flutter project into native libraries and flutter_assets for the selected Android ABIs, ready for injection into a decoded workspace. Use it after target ABI analysis and before injection when source Flutter code is available; use an existing validated payload directory instead when artifacts are already built. This invokes the local Flutter SDK and replaces the payload output directory, so expect build time, disk writes, and build diagnostics.
| Name | Required | Description | Default |
|---|---|---|---|
| buildMode | No | Flutter build mode target: 'release' (AOT production build), 'profile' (AOT performance build), 'debug' (JIT build) | release |
| outputDir | No | Optional custom directory path to write synthesized payload artifacts (defaults to system temp dir) | |
| targetAbis | No | Target native CPU architectures to build payload binaries for (default: ['arm64-v8a', 'armeabi-v7a']) | |
| flutterProjectPath | Yes | Path to source Flutter project root containing pubspec.yaml and lib/main.dart |
Output Schema
| Name | Required | Description |
|---|---|---|
| abis | Yes | ABIs successfully emitted into the payload. |
| files | Yes | Payload-relative artifact paths grouped by type. |
| warnings | Yes | Build or artifact-completeness warnings. |
| buildMode | Yes | Flutter build mode used. |
| payloadDir | Yes | Absolute directory containing synthesized payload artifacts. |
| appSizeBytes | Yes | Extracted libapp.so size, when available. |
| engineVersion | Yes | Detected Flutter engine/version identifier, when available. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal destructiveHint=true, but the description adds specifics: 'replaces the payload output directory', 'expect build time, disk writes, and build diagnostics', and discloses invocation of the local Flutter SDK. These details go beyond the annotations and inform the agent of side effects and external dependencies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with a front-loaded core action, followed by usage context and side-effect warnings. Every sentence provides distinct value with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a side-effect-heavy build tool, and the description covers prerequisites ('source Flutter code is available'), pipeline sequencing relative to siblings, and behavioral expectations. An output schema exists, so return values do not need explanation in the description. The tool is well-contextualized for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema description coverage is 100%, with detailed parameter descriptions including enum meanings and defaults. The description references 'selected Android ABIs' and 'source Flutter code' at a high level but does not add new parameter-level semantics beyond what the schema already provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Build a Flutter project into native libraries and flutter_assets for the selected Android ABIs', specifying the exact action, resource, and output. It distinguishes itself from injection siblings by framing the result as 'ready for injection', making its role in the pipeline unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit placement: 'Use it after target ABI analysis and before injection when source Flutter code is available', and names an alternative when artifacts already exist. This clearly differentiates it from inject_flutter_runtime_and_smali and provides concrete when-to-use versus when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_agent_memoryupdate_agent_memoryB
Update active session memory state with notes, identified targets, or patch logs
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | Agent note to persist in session memory | |
| patchType | No | Type of patch applied (e.g., smali_insert, manifest_edit) | |
| packageName | No | Target Android package name | |
| patchDetails | No | Description of patch applied | |
| workspaceDir | No | Decompiled APK workspace path | |
| entryActivity | No | Launcher/Entry Activity name | |
| applicationClass | No | Application class name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden but only states the high-level intent. It does not disclose whether updates merge or overwrite existing memory, the session lifetime, or any side effects. It mentions 'active session' but fails to specify persistence or scoping nuances.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler, making it efficient. However, given the tool's complexity (7 optional parameters), it might be too sparse to be considered fully 'appropriately sized', though it maintains crisp structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 7 optional parameters and no output schema, yet the description only provides a high-level summary. It omits guidance on parameter combinations, whether fields are mutually exclusive, and session memory behavior, leaving gaps for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 7 parameters have individual schema descriptions, so the schema already provides comprehensive coverage. The description loosely alludes to categories (notes, targets, patch logs) but adds no extra meaning beyond what the schema already explains, resulting in a baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Update'), the resource ('active session memory state'), and the content types (notes, identified targets, patch logs). This distinguishes it from memory-read siblings like get_agent_context and query_memory_graph, which focus on retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied by the tool's name and the presence of read-oriented siblings, but no explicit when-to-use or when-not-to-use guidance is provided. The description does not mention alternatives or prerequisites, so it stops at 'implied usage' rather than giving clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
9 tool updates
v0.1.3- Changed
analyze_injection_surface2 fields changed- added
Input schema / properties / workspaceDir / descriptionAdded value: +"Path to decompiled APK workspace root directory containing AndroidManifest.xml and Smali structures produced by decompile_apk" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "applicationClass": { + "description": "Declared application class, when present.", + "type": [ + "string", + "null" + ] + }, + "applicationClassPath": { + "description": "Resolved application Smali path, when available.", + "type": [ + "string", + "null" + ] + }, + "assetScripts": { + "description": "Candidate script-like asset paths.", + "items": { + "type": "string" + }, + "type": "array" + }, + "automatedChainSuggestions": { + "description": "Suggested next pipeline actions.", + "items": { + "type": "string" + }, + "type": "array" + }, + "entryActivities": { + "description": "Manifest activities and their resolved Smali paths.", + "items": { + "additionalProperties": false, + "properties": { + "exported": { + "type": "boolean" + }, + "launcher": { + "type": "boolean" + }, + "name": { + "type": "string" + }, + "path": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "name", + "exported", + "launcher", + "path" + ], + "type": "object" + }, + "type": "array" + }, + "existingApplication": { + "description": "Whether the manifest declares an application class.", + "type": "boolean" + }, + "existingFlutter": { + "description": "Whether Flutter embedding classes were detected.", + "type": "boolean" + }, + "existingFlutterClasses": { + "description": "Detected existing Flutter class paths.", + "items": { + "type": "string" + }, + "type": "array" + }, + "existingNativeAbis": { + "description": "Native ABI directories detected in the target.", + "items": { + "type": "string" + }, + "type": "array" + }, + "jniLoadingHooks": { + "description": "Evidence strings for detected JNI library loading calls.", + "items": { + "type": "string" + }, + "type": "array" + }, + "luaMods": { + "description": "Detected Lua asset paths.", + "items": { + "type": "string" + }, + "type": "array" + }, + "packageName": { + "description": "Manifest package identity.", + "type": "string" + }, + "recommendedPatchPoints": { + "description": "Suggested host integration points.", + "items": { + "type": "string" + }, + "type": "array" + }, + "warnings": { + "description": "Compatibility warnings that require review before mutation.", + "items": { + "type": "string" + }, + "type": "array" + }, + "workspaceDir": { + "description": "Analyzed decoded APK workspace.", + "type": "string" + } + }, + "required": [ + "workspaceDir", + "packageName", + "applicationClass", + "applicationClassPath", + "existingApplication", + "entryActivities", + "existingFlutter", + "existingFlutterClasses", + "existingNativeAbis", + "jniLoadingHooks", + "assetScripts", + "luaMods", + "recommendedPatchPoints", + "automatedChainSuggestions", + "warnings" + ], + "type": "object" +}
- Changed
decompile_apk4 fields changed- added
Input schema / properties / apkPath / descriptionAdded value: +"Absolute path to target source .apk file to decompile" - added
Input schema / properties / decompileSources / descriptionAdded value: +"Whether to disassemble DEX files into Smali code (default: true). Set false for resource/asset-only disassembly" - added
Input schema / properties / outputDir / descriptionAdded value: +"Destination directory path where decompiled Smali code, resources, assets, and AndroidManifest.xml will be extracted" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "applicationClass": { + "description": "Declared application class, when present.", + "type": [ + "string", + "null" + ] + }, + "fileCount": { + "description": "Number of extracted workspace files.", + "minimum": 0, + "type": "integer" + }, + "hasNativeLibs": { + "description": "Whether the decoded workspace contains native libraries.", + "type": "boolean" + }, + "mainActivity": { + "description": "Resolved launcher activity, when present.", + "type": [ + "string", + "null" + ] + }, + "manifestPath": { + "description": "Absolute path to decoded AndroidManifest.xml.", + "type": "string" + }, + "minSdkVersion": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Declared minimum Android API level." + }, + "packageName": { + "description": "Package name parsed from AndroidManifest.xml.", + "type": "string" + }, + "smaliRoot": { + "description": "Primary Smali root, when source decoding was enabled.", + "type": [ + "string", + "null" + ] + }, + "sourceApk": { + "description": "Absolute path to the input APK that was read.", + "type": "string" + }, + "targetAbis": { + "description": "Native ABI directories detected in the workspace.", + "items": { + "type": "string" + }, + "type": "array" + }, + "targetSdkVersion": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Declared target Android API level." + }, + "workspaceDir": { + "description": "Absolute path to the decoded workspace.", + "type": "string" + } + }, + "required": [ + "workspaceDir", + "sourceApk", + "packageName", + "mainActivity", + "applicationClass", + "minSdkVersion", + "targetSdkVersion", + "targetAbis", + "fileCount", + "hasNativeLibs", + "manifestPath", + "smaliRoot" + ], + "type": "object" +}
- Added
get_agent_context - Changed
inject_flutter_runtime_and_smali12 fields changed- added
Input schema / properties / attachBaseContextHookAdded value: +{ + "description": "Inject engine init into attachBaseContext(Context) as well as onCreate() for early initialization", + "type": "boolean" +} - added
Input schema / properties / engineId / descriptionAdded value: +"Optional cached FlutterEngine identifier stored in FlutterEngineCache (defaults to 'injected_flutter_engine')" - added
Input schema / properties / injectionMode / descriptionAdded value: +"Injection strategy enum: 'direct_application_hook' (hooks host Application class), 'activity_overlay' (adds overlay Activity), 'view_tree_injection' (attaches FlutterView to main Activity), 'headless_engine' (background engine without UI)" - changed
Input schema / properties / injectionMode / enumPrevious value: -[ - "activity_overlay", - "view_tree_injection", - "headless_engine" -]New value: +[ + "activity_overlay", + "view_tree_injection", + "headless_engine", + "direct_application_hook" +] - added
Input schema / properties / methodChannelBridge / descriptionAdded value: +"Optional MethodChannel bridge config for two-way communication between target Android Smali host and injected Flutter Dart layer" - added
Input schema / properties / methodChannelBridge / properties / channelName / descriptionAdded value: +"Name of two-way Flutter MethodChannel identifier for Smali<->Dart communication" - added
Input schema / properties / methodChannelBridge / properties / handlerClass / descriptionAdded value: +"Optional custom Smali handler class name to process incoming MethodChannel calls" - added
Input schema / properties / methodChannelBridge / properties / methodWhitelist / descriptionAdded value: +"Optional whitelist of method names allowed over the MethodChannel bridge" - added
Input schema / properties / nativeLibraryFallbackAdded value: +{ + "description": "Wrap System.loadLibrary call in defensive try-catch blocks to prevent UnsatisfiedLinkError crashes on missing ABIs", + "type": "boolean" +} - added
Input schema / properties / payloadDir / descriptionAdded value: +"Path to synthesized Flutter payload directory produced by synthesize_flutter_payload containing lib/ native libraries (libflutter.so, libapp.so) and assets/" - added
Input schema / properties / workspaceDir / descriptionAdded value: +"Path to decompiled APK workspace root directory produced by decompile_apk (modified in-place)" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "copiedAssets": { + "description": "Number of copied Flutter asset files.", + "minimum": 0, + "type": "integer" + }, + "copiedLibs": { + "description": "Number of copied native library files.", + "minimum": 0, + "type": "integer" + }, + "engineId": { + "description": "FlutterEngineCache identifier used by generated code.", + "type": "string" + }, + "generatedClasses": { + "description": "Generated Smali class descriptors.", + "items": { + "type": "string" + }, + "type": "array" + }, + "injectionMode": { + "description": "Applied Flutter integration mode.", + "enum": [ + "activity_overlay", + "view_tree_injection", + "headless_engine", + "direct_application_hook" + ], + "type": "string" + }, + "launchActivityName": { + "description": "Resolved activity associated with the selected integration mode.", + "type": "string" + }, + "methodChannel": { + "additionalProperties": false, + "description": "Configured method-channel bridge, when requested.", + "properties": { + "channelName": { + "description": "Dart/host channel identifier.", + "type": "string" + }, + "handlerClass": { + "description": "Optional generated or host-side Smali handler class.", + "type": "string" + }, + "methodWhitelist": { + "description": "Optional allowed inbound method names.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "channelName" + ], + "type": "object" + }, + "modifiedFiles": { + "description": "Workspace files created or changed by the operation.", + "items": { + "additionalProperties": false, + "properties": { + "description": { + "type": "string" + }, + "filePath": { + "type": "string" + }, + "patchType": { + "enum": [ + "smali_insert", + "smali_create", + "asset_copy", + "lib_copy", + "manifest_edit" + ], + "type": "string" + }, + "verified": { + "type": "boolean" + } + }, + "required": [ + "filePath", + "patchType", + "description", + "verified" + ], + "type": "object" + }, + "type": "array" + }, + "warnings": { + "description": "Compatibility and follow-up warnings.", + "items": { + "type": "string" + }, + "type": "array" + }, + "workspaceDir": { + "description": "Mutated decoded APK workspace.", + "type": "string" + } + }, + "required": [ + "workspaceDir", + "injectionMode", + "generatedClasses", + "modifiedFiles", + "copiedAssets", + "copiedLibs", + "engineId", + "launchActivityName", + "warnings" + ], + "type": "object" +}
- Changed
patch_manifest_and_config8 fields changed- added
Input schema / properties / additionalPermissions / descriptionAdded value: +"List of additional Android permissions to inject into AndroidManifest.xml (e.g. ['android.permission.INTERNET', 'android.permission.WAKE_LOCK'])" - added
Input schema / properties / customApplicationClass / descriptionAdded value: +"Fully qualified class name of injected Application subclass (e.g. 'com.example.injected.InjectedApplication')" - added
Input schema / properties / extractNativeLibsAdded value: +{ + "description": "Set android:extractNativeLibs in application element for legacy native library extraction", + "type": "boolean" +} - added
Input schema / properties / hardwareAcceleratedAdded value: +{ + "description": "Set android:hardwareAccelerated='true' in application element for GPU hardware rendering", + "type": "boolean" +} - added
Input schema / properties / largeHeapAdded value: +{ + "description": "Set android:largeHeap='true' in application element to increase RAM heap allocation", + "type": "boolean" +} - added
Input schema / properties / usesCleartextTraffic / descriptionAdded value: +"Set android:usesCleartextTraffic='true' in application tag to allow unencrypted HTTP traffic" - added
Input schema / properties / workspaceDir / descriptionAdded value: +"Path to decompiled APK workspace root directory containing AndroidManifest.xml (modified in-place)" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "addedActivities": { + "description": "Activity class names added during the patch.", + "items": { + "type": "string" + }, + "type": "array" + }, + "addedApplicationMetadata": { + "description": "Application metadata keys added during the patch.", + "items": { + "type": "string" + }, + "type": "array" + }, + "applicationClass": { + "description": "Application class after the patch.", + "type": [ + "string", + "null" + ] + }, + "patchedPermissions": { + "description": "Permissions added during the patch.", + "items": { + "type": "string" + }, + "type": "array" + }, + "usesCleartextTraffic": { + "description": "Reported cleartext-traffic configuration request.", + "type": "boolean" + }, + "validation": { + "additionalProperties": false, + "description": "Post-patch manifest validation result.", + "properties": { + "messages": { + "items": { + "type": "string" + }, + "type": "array" + }, + "status": { + "enum": [ + "ok", + "warning", + "error" + ], + "type": "string" + } + }, + "required": [ + "status", + "messages" + ], + "type": "object" + }, + "workspaceDir": { + "description": "Mutated decoded APK workspace.", + "type": "string" + } + }, + "required": [ + "workspaceDir", + "patchedPermissions", + "addedApplicationMetadata", + "addedActivities", + "applicationClass", + "usesCleartextTraffic", + "validation" + ], + "type": "object" +}
- Added
query_memory_graph - Changed
recompile_align_and_sign9 fields changed- added
Input schema / properties / keystoreConfig / descriptionAdded value: +"Optional signing keystore configuration. If omitted, an auto-generated debug keystore is used" - added
Input schema / properties / keystoreConfig / properties / cn / descriptionAdded value: +"Common Name (CN) owner string for self-signed debug certificate" - added
Input schema / properties / keystoreConfig / properties / keyAlias / descriptionAdded value: +"Private key alias name inside signing keystore" - added
Input schema / properties / keystoreConfig / properties / keyPass / descriptionAdded value: +"Password for specific private key alias" - added
Input schema / properties / keystoreConfig / properties / keystorePass / descriptionAdded value: +"Keystore password for signing keystore access" - added
Input schema / properties / keystoreConfig / properties / keystorePath / descriptionAdded value: +"Path to custom JKS/PKCS12 signing keystore file (auto-generates debug keystore if omitted)" - added
Input schema / properties / outputApkPath / descriptionAdded value: +"Destination file path for final recompiled, 4-byte aligned, and cryptographically signed APK" - added
Input schema / properties / workspaceDir / descriptionAdded value: +"Path to decompiled APK workspace root directory containing modified Smali, assets, and AndroidManifest.xml" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "aligned": { + "description": "Whether zipalign completed successfully.", + "type": "boolean" + }, + "keystorePath": { + "description": "Keystore used for signing, when available.", + "type": [ + "string", + "null" + ] + }, + "outputApkPath": { + "description": "Absolute path to the signed output APK.", + "type": "string" + }, + "signingScheme": { + "description": "Detected APK signature schemes.", + "items": { + "type": "string" + }, + "type": "array" + }, + "sizeBytes": { + "description": "Final APK byte size.", + "minimum": 0, + "type": "integer" + }, + "verified": { + "description": "Whether apksigner verification completed successfully.", + "type": "boolean" + } + }, + "required": [ + "outputApkPath", + "signingScheme", + "keystorePath", + "aligned", + "verified", + "sizeBytes" + ], + "type": "object" +}
- Changed
synthesize_flutter_payload6 fields changed- added
Input schema / properties / buildMode / descriptionAdded value: +"Flutter build mode target: 'release' (AOT production build), 'profile' (AOT performance build), 'debug' (JIT build)" - added
Input schema / properties / flutterProjectPath / descriptionAdded value: +"Path to source Flutter project root containing pubspec.yaml and lib/main.dart" - changed
Input schema / properties / outputDir / descriptionPrevious value: -"Override payload output directory"New value: +"Optional custom directory path to write synthesized payload artifacts (defaults to system temp dir)" - added
Input schema / properties / targetAbis / descriptionAdded value: +"Target native CPU architectures to build payload binaries for (default: ['arm64-v8a', 'armeabi-v7a'])" - added
Input schema / properties / targetAbis / items / descriptionAdded value: +"Target Android Native ABI architecture (e.g. 'arm64-v8a' for modern 64-bit devices)" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "abis": { + "description": "ABIs successfully emitted into the payload.", + "items": { + "enum": [ + "arm64-v8a", + "armeabi-v7a", + "x86", + "x86_64" + ], + "type": "string" + }, + "type": "array" + }, + "appSizeBytes": { + "anyOf": [ + { + "minimum": 0, + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Extracted libapp.so size, when available." + }, + "buildMode": { + "description": "Flutter build mode used.", + "enum": [ + "release", + "profile", + "debug" + ], + "type": "string" + }, + "engineVersion": { + "description": "Detected Flutter engine/version identifier, when available.", + "type": [ + "string", + "null" + ] + }, + "files": { + "additionalProperties": { + "items": { + "type": "string" + }, + "type": "array" + }, + "description": "Payload-relative artifact paths grouped by type.", + "type": "object" + }, + "payloadDir": { + "description": "Absolute directory containing synthesized payload artifacts.", + "type": "string" + }, + "warnings": { + "description": "Build or artifact-completeness warnings.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "payloadDir", + "buildMode", + "abis", + "files", + "engineVersion", + "appSizeBytes", + "warnings" + ], + "type": "object" +}
- Added
update_agent_memory
6 tool updates
v0.1.2- First observed
analyze_injection_surface - First observed
decompile_apk - First observed
inject_flutter_runtime_and_smali - First observed
patch_manifest_and_config - First observed
recompile_align_and_sign - First observed
synthesize_flutter_payload
TDQS
Each tool has a clearly distinct purpose: the first six form a sequential APK injection pipeline, and the last three are agent memory operations. There is no overlap or ambiguity between any tools.
All tool names use a consistent verb_noun snake_case pattern (e.g., decompile_apk, synthesize_flutter_payload, update_agent_memory). The naming convention is uniform throughout.
The 9 tools are within a reasonable count, but the three memory-related tools are unrelated to the core APK injection purpose and make the set slightly over-scoped. A focused injector would have 6 tools.
The APK injection workflow is fully covered: decompile, analyze, synthesize payload, inject, patch manifest, and recompile/sign. There are no missing operations in the stated domain; the memory tools are extra but do not create gaps.
Maintenance
Related MCP Connectors
MCP server for static security analysis of Android source code
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides a one-stop automated solution for Android APK security analysis by integrating tools like JEB, JADX, APKTOOL, FlowDroid, and MobSF into unified MCP standard API interfaces.11-
- AlicenseAqualityFmaintenanceA real-time server that provides Flutter/Dart documentation and pub.dev package information to AI assistants, ensuring they generate accurate and up-to-date Flutter code.873MIT
- FlicenseNot gradedqualityDmaintenanceEnables analysis of native Android libraries (SO files) and Flutter applications, including decompilation, function identification, SSL certificate bypass patching, and binary modification through 30+ specialized tools.11-
- FlicenseNot gradedqualityDmaintenanceIntegrates multiple Android APK security analysis tools into MCP standard APIs for automated static and dynamic analysis and vulnerability detection.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/MarwanDevSpace/mcp-flutter-apk-injector'
If you have feedback or need assistance with the MCP directory API, please join our Discord server