A comprehensive MCP server that enables AI agents to interact with Android devices through Android Debug Bridge (ADB), offering 198 tools for device control, app management, diagnostics, and more.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
process.env. You'll be asked to provide them before it can run.ADB_PATH— Auto-detect Path to ADB binary (ignored in on-device mode)ANDROID_HOMEANDROID_SDK_ROOTDA_ALLOWED_COMMANDS— (none) Comma-separated allowlist (if set, only matching commands run)DA_ASCII_ONLYDA_AUDIT_LOG— true Log all executed commands for audit trail (set to false to disable)DA_AUTH_TOKEN— (none — open) Bearer token for network transports. When set, all HTTP/SSE/WS/GraphQL requests require Authorization: Bearer <token> header. Health endpoints exempt.DA_BLOCKED_COMMANDS— (none) Comma-separated list of blocked shell command substringsDA_CACHE_TTL— 5000 Device list cache TTL in milliseconds (0 = disabled)DA_CI_PING_TARGETDA_DEVICE— (auto) Default device serial (auto-selects if single device)DA_GRAPHQL_CORS_ORIGIN— (none — deny) Allowed CORS origin for GraphQL APIDA_GRAPHQL_PORT— 4000 npm startDA_HTTP_CORS_ORIGIN— (none — deny) Allowed CORS origin for HTTP/SSEDA_HTTP_HOST— 127.0.0.1 Bind address for HTTP/SSE, WebSocket, and GraphQL serversDA_HTTP_PORT— 3000 npm start # HTTP/SSE — for remote AI access over WiFiDA_LOCAL— Auto-detection: Checks for /system/build.prop (present on all Android devices, never on hosts). Override with =true or DA_LOCAL=false.DA_LOG_LEVEL— info Log level: debug, info, warn, errorDA_MAX_LOGCAT— 500 Max logcat lines per snapshotDA_MAX_OUTPUT— 50000 Max output characters before truncationDA_PLUGIN_DIR— {tempDir}/plugins Directory to scan for plugin .js modules at startupDA_RATE_LIMIT— 0 Max commands per minute (0 = unlimited)DA_REGISTRY_URL— GitHub default URL of the community plugin registry JSON manifestDA_RESOURCE_CACHE_TTL_MS— 0 (disabled) MCP Resource cache TTL in ms. Set to a positive value to cache resource reads (device://info, device://battery, etc.) for that duration.DA_RESULT_HANDLE_DIR— {tempDir}/result-handles Storage root for tempdir-backed tool result handles. Override to relocate the store off the default temp directory.DA_RESULT_HANDLE_MAX_BYTES— 5242880 (5 MB) Per-handle size cap. Tools attempting to store a content block larger than this fail with an error.DA_RESULT_HANDLE_MAX_COUNT— 100 Maximum number of active handles. Triggers LRU eviction when exceeded.DA_RESULT_HANDLE_TOTAL_BYTES— 104857600 (100 MB) Total result-handle store size cap across all handles. Triggers LRU eviction when exceeded.DA_RESULT_HANDLE_TTL— 43200 (12h) Per-handle TTL in seconds. Handles older than this are evicted on startup sweep and during periodic eviction. Bounded to [60, 7 days].DA_RETRY_COUNT— 1 Number of retries for transient ADB failuresDA_RETRY_DELAY— 500 Base retry delay in ms (doubles each attempt)DA_SECURITY— false Enable security middleware (command filtering, rate limiting)DA_TEMP_DIR— OS temp Temp directory for screenshots, pulled files, bug reports, test sessions, snapshotsDA_TEST_PIN— (none) Numeric PIN used by tests/test-ui-control.mjs to exercise screen-lock/unlock tests. Without it, the 4 lock-state tests skip. Format: DA_TEST_PIN=0000 npm test.DA_TIMEOUT— 30000 Default command timeout in millisecondsDA_WORKFLOW_REGISTRY_URL— (derived from DA_REGISTRY_URL) URL of the workflow marketplace JSON manifestDA_WS_CORS_ORIGIN— (none — deny) Allowed CORS origin for WebSocket health endpointDA_WS_PORT— 3001 npm startProgramFilesTERMTERM_PROGRAMWT_SESSION[](https://m8ven.ai/mcp/fullread-deepadb-f97je9)