// SCAN REPORT

Android

23 tools. 22 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 5 Jul 2026

22 can modify or destroy data

1 read-only

23 tools total

Community server · catalogue entry checked 05/07/2026 · full schemas captured for 22 of 23 tools

How to control Android ↓

TOOL MAP

What Android exposes to your agents

Read (1) Write / Execute (21) Destructive / Financial (1)

Running more than one server? Check your whole stack →

CONTEXT-WINDOW COST

What Android costs in tokens

9,491 tokens of tool definitions, loaded on every request

4.7% of a 200k context window

924 heaviest tool: Scroll

Full per-tool breakdown → Model it in the token calculator →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Android tools

Destructive · Medium ClearInput ClearInput irreversibly erases the content of an input field on an Android device. Execute · Critical RunAdbShell This tool executes arbitrary shell commands on an Android device via ADB, which is the Execute category. Execute · High act This tool triggers execution of multi-step automated operations on an Android device based on natural language prompts. Execute · High AndroidBackButton This tool executes a system command on an Android device (simulating a back button press), which triggers real device behavior.

22 of Android's 23 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Android

PolicyLayer is an MCP gateway — it sits between your AI agents and Android, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "ClearInput": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "android_disconnect": {
    "limits": [
      {
        "counter": "android_disconnect_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "take_screenshot": {
    "limits": [
      {
        "counter": "take_screenshot_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Android — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ANDROID →

Instant setup, no code required.

FULL CATALOGUE

All 23 Android tools

DESTRUCTIVE 1 tools

Destructive ClearInput ClearInput action, the position of the placeholder or text content in the target input field. If there is no c

EXECUTE 18 tools

Execute act Execute a natural language action. The AI will plan and perform multi-step operations in a single invocation, Execute android_connect Connect to Android device via ADB. If deviceId not provided, uses the first available device. Execute AndroidBackButton AndroidBackButton action, Trigger the system "back" operation on Android devices Execute AndroidHomeButton AndroidHomeButton action, Trigger the system "home" operation on Android devices Execute AndroidRecentAppsButton AndroidRecentAppsButton action, Trigger the system "recent apps" operation on Android devices Execute CursorMove CursorMove action, Move the text cursor (caret) left or right within an input field or text area. Use this to Execute DoubleClick DoubleClick action, Double click the element. Parameters: locate (object) - The element to be double clicked Execute DragAndDrop DragAndDrop action, Pick up a specific UI element and move it to a new position (e.g., reorder a card, move a Execute KeyboardPress KeyboardPress action, Press a key or key combination, like "Enter", "Tab", "Escape", or "Control+A", "Shift+En Execute Launch Launch action, Launch an Android app or URL. Parameters: uri (string) - App name, package name, or URL to laun Execute LongPress LongPress action, Long press the element. Parameters: locate (object) - The element to be long pressed; durati Execute Pinch Pinch action, Perform a two-finger pinch gesture. Use direction "in" to pinch fingers together (zoom out), or Execute PullGesture PullGesture action, Trigger pull down to refresh or pull up actions. Parameters: direction (enum('up', 'down') Execute RunAdbShell RunAdbShell action, Execute an ADB shell command on the Android device and return the command stdout. Read the Execute Scroll Scroll action, Scroll the page or a scrollable element to browse content. This is the preferred way to scroll Execute Swipe Swipe action, Perform a touch gesture for interactions beyond regular scrolling (e.g., adjust a continuous con Execute Tap Tap action, Tap the element. Parameters: locate (object) - The element to be tapped Execute Terminate Terminate action, Terminate (force-stop) an Android app by package name. Parameters: uri (string) - Package na

WRITE 3 tools

Write android_disconnect Disconnect from current Android device and release ADB resources Write assert Assert a natural language statement against the current page/screen. Write Input Input action, Input the value into the element. Parameters: value (string | number) - The text to input. Provi

READ 1 tools

Read take_screenshot Capture screenshot of current page/screen

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Android

Can an AI agent delete data through the Android MCP server? +

Yes. The Android server exposes 1 destructive tools including ClearInput. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Android? +

The Android server has 3 write tools including android_disconnect, assert, Input. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Android.

How many tools does the Android MCP server expose? +

23 tools across 4 categories: Destructive, Execute, Read, Write. 1 are read-only. 22 can modify, create, or delete data.

How do I enforce a policy on Android? +

Register the Android MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Android tool call.

Deterministic rules across all 23 Android tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ANDROID →

Instant setup, no code required.

23 Android tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Android's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →