/ 100

11 days ago

glama

ghost-in-the-droid

Item: ghost-in-the-droid
Rating: 67
Author: M8ven

Give any LLM agent a real Android or iPhone. 62 MCP tools: tap, swipe, type, screenshot, screen-tree reading, app launch, camera, TTS, crash reports, batched execution. Android via ADB, iPhone via WebDriverAgent, on-device inference, Docker+KVM emulators. Works with Claude Code, Cursor, LangChain, LlamaIndex, and any MCP client. MIT.

→ ghost-in-the-droid/android-agent · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 5 credentials: ANTHROPIC_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY, GITD_VLLM_API_KEY, GITHUB_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configBASE_URL

configGITD_CORS_ORIGINS

configDEVICE— serial> python3 -m pytest tests/ -v --tb=short

configGITD_ENABLE_IOS— iOS is opt-in: enable it with =1 (or ios_platform_enabled=true

configIOS_DEVICES_JSON— Per-device iOS config for multiple phones/simulators, WDA ports, bundle IDs, and MJPEG ports

configIOS_CONFIG_FILE

configIOS_REMOTE_XPC_REGISTRY_PORTS

configIOS_REMOTE_XPC_REGISTRY_PORT

configIOS_REMOTE_XPC_TUNNEL_START_TIMEOUT

configIOS_APPIUM_COMMAND

configIOS_DEVICE_UDID— export ="<udid>"

configIOS_DEVICE_UDIDS

configIOS_WDA_DIRECT

configIOS_REMOTEXPC_REGISTRY

configIOS_WAIT_FOR_QUIESCENCE

configIOS_LAUNCH_BUNDLE_ON_SESSION

configIOS_APPLY_WDA_SETTINGS

configIOS_APPIUM_LOG

configIOS_REMOTE_XPC_TUNNEL_LOG

configGHOST_CONFIG_DIR

configOLLAMA_BASE_URL

configGHOST_HOME_OVERRIDE

configGHOST_BACKEND

configGHOST_MODEL

🔐 secretANTHROPIC_API_KEY— Alternative LLM provider

🔐 secretOPENROUTER_API_KEY— OpenRouter LLM provider

🔐 secretOPENAI_API_KEY— LLM features (Skill Creator, Agent Chat)

configGHOST_MODE

configIOS_STREAM_FORCE_LOCALHOST

🔐 secretGITD_VLLM_API_KEY

configGITD_VLLM_BASE_URL

configGHOST_REMOTE_HOST

configSUB_AGENT_MODEL

configIOS_BUNDLE_ID— export ="com.google.chrome.ios" # or com.apple.mobilesafari

🔐 secretGITHUB_TOKEN

configIOS_BROWSER_NAME

configANDROID_SERIAL

configGHOST_DEVICE

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/ghost-in-the-droid-android-agent-fkkjzl)](https://m8ven.ai/mcp/ghost-in-the-droid-android-agent-fkkjzl)

commit: f6ed7aaf935e59504e3074b385a630e05a17d421

code hash: f222fc5765b8923f7dcd9adf58720d1731d74b77a1ae756de44220c4f7e87ded

verified: 7/20/2026, 9:22:11 AM

view raw JSON →