# adb_qemu_guest_shell Execute a shell command on a QEMU guest VM via ADB. The VM must be connected first (use adb_qemu_connect). The guest serial is derived internally — no user-supplied host/IP reaches the ADB binary. Subject to the same security middleware checks as adb_shell. Agent View of the PolicyLayer registry record for `adb_qemu_guest_shell`. HTML page: https://policylayer.com/tools/io-github-fullread-deepadb/adb-qemu-guest-shell ## Facts - Tool: `adb_qemu_guest_shell` - Server: Deepadb (`deepadb`) — https://policylayer.com/tools/io-github-fullread-deepadb.md - Install: `npx -y deepadb` - Homepage: https://github.com/fullread/DeepADB - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "adb_qemu_guest_shell", "arguments": {} } } ``` ## Why adb_qemu_guest_shell is rated High This tool executes arbitrary shell commands on a QEMU guest VM, making it Execute rather than Read/Write. While it includes mitigations (internal serial derivation, security middleware checks), the capability to run arbitrary commands means misuse could pivot to data exfiltration, persistence, lateral movement, or destructive actions. From the tool's own definition: "Execute a shell command on a QEMU guest VM via ADB — the tool explicitly runs shell commands, which is the quintessential Execute action. The description confirms it accepts commands as arguments to run on a guest system." ## Use case AI agents invoke adb_qemu_guest_shell to trigger actions in Deepadb. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Deepadb: ```json { "version": "1", "default": "deny", "tools": { "adb_qemu_guest_shell": { "limits": [ { "counter": "adb_qemu_guest_shell_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Deepadb (204) - `adb_clear_data` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-clear-data.md - `adb_file_move` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-file-move.md - `adb_forward_remove` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-forward-remove.md - `adb_logcat_clear` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-logcat-clear.md - `adb_qemu_images` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-qemu-images.md - `adb_result_drop` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-result-drop.md - `adb_reverse_remove` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-reverse-remove.md - `adb_rm` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-rm.md - `adb_tunnel_close` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-tunnel-close.md - `adb_uninstall` — Destructive — https://policylayer.com/tools/io-github-fullread-deepadb/adb-uninstall.md - `adb_a11y_audit` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-a11y-audit.md - `adb_airplane_cycle` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-airplane-cycle.md - `adb_airplane_mode` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-airplane-mode.md - `adb_at_batch` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-at-batch.md - `adb_at_probe` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-at-probe.md - `adb_at_send` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-at-send.md - `adb_batch_actions` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-batch-actions.md - `adb_build_and_install` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-build-and-install.md - `adb_ci_run_tests` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-ci-run-tests.md - `adb_ci_wait_boot` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-ci-wait-boot.md - `adb_connect` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-connect.md - `adb_disconnect` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-disconnect.md - `adb_dumpsys` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-dumpsys.md - `adb_emulator_start` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-emulator-start.md - `adb_emulator_stop` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-emulator-stop.md - `adb_farm_run` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-farm-run.md - `adb_file_chmod` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-file-chmod.md - `adb_file_chown` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-file-chown.md - `adb_force_stop` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-force-stop.md - `adb_forward` — Execute — https://policylayer.com/tools/io-github-fullread-deepadb/adb-forward.md - …and 174 more: https://policylayer.com/tools/io-github-fullread-deepadb.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-fullread-deepadb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-fullread-deepadb