High-risk tools in Android MCP Server
24 of the 80 tools in Android MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
adb_connectExecuteConnect ADB wirelessly (Android 12+). Get pairing code from Wireless Debugging settings.
-
cancel_jobExecute⏹️ 取消正在运行的后台任务。
-
click_by_classExecuteFind element by class name and tap it.
-
click_by_idExecuteFind element by resource ID and tap it.
-
click_by_textExecuteFind element by text and tap it. More robust than manual tap_screen.
-
execute_commandExecuteexecute_command
-
force_stop_appExecuteForce stop an Android app (kills background processes).
-
get_fingerprintExecutePrompt for fingerprint authentication.
-
open_appExecuteLaunch an Android app by package name.
-
open_urlExecuteOpen URL in default browser.
-
restart_androidExecuteRestart termux-mcp service (~2-3s downtime). Memory state is lost, file changes persist.
-
send_notificationExecuteSend a notification.
-
set_volumeExecuteSet volume. stream: music/ring/alarm/notification/system/call. volume: 0-15.
-
shizuku_hideExecute隐藏 Shizuku 小窗（缩到右上角极小尺寸 + force-stop App UI）。
-
shizuku_resizeExecuteshizuku_resize
-
shizuku_restartExecute重启 Shizuku App（先 force-stop 再重新打开）。
-
shizuku_showExecute显示/启动 Shizuku App 窗口。
-
show_toastExecuteShow a toast message.
-
text_to_speechExecuteSpeak text aloud via TTS.
-
toggle_torchExecuteToggle flashlight on/off.
-
vibrateExecuteVibrate phone. force=True to vibrate in silent mode.
-
wait_for_elementExecuteWait for element to appear (polling). Returns element info or timeout error.
-
watchdog_startExecute🛡️ 启动 Shizuku Watchdog 守护（Termux 被杀后自动拉起 MCP）。
-
watchdog_stopExecute⏹️ 停止 Shizuku Watchdog 守护。
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.