Deepadb MCP Server
deepadb
npm
v1.1.4
Published by an unidentified publisher — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
DeepADB — full-featured Android Debug Bridge MCP server. 204 tools across 45 modules for device inspection from UI to baseband.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Shell command embedded in tool metadata MTC-INJ-CMD-1 | injection |
2. Client adoption risk — 99 − 8 = 91. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 18
high Sensitive-source and external-sink co-existMTC-FLOW-004
Tools that read sensitive data ([adb_a11y_tree, adb_carrier_config, adb_heap_dump, adb_ls, adb_notifications, adb_list_permissions, adb_ui_dump]) and tools that can send data out ([adb_multi_shell, adb_qemu_guest_shell, adb_shell, adb_root_shell]) are exposed together. An agent can move private data to the sink.
Evidence: sources [adb_a11y_tree, adb_carrier_config, adb_heap_dump, adb_ls, adb_notifications, adb_list_permissions, adb_ui_dump] → sinks [adb_multi_shell, adb_qemu_gues
Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.
Location: flow adb_a11y_tree → adb_multi_shell
high Tool "adb_multi_shell" exposes command/code executionMTC-CAP-001
Tool "adb_multi_shell" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool adb_multi_shell
high Tool "adb_qemu_guest_shell" exposes command/code executionMTC-CAP-001
Tool "adb_qemu_guest_shell" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool adb_qemu_guest_shell
high Tool "adb_shell" exposes command/code executionMTC-CAP-001
Tool "adb_shell" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool adb_shell
high Tool "adb_root_shell" exposes command/code executionMTC-CAP-001
Tool "adb_root_shell" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool adb_root_shell
high Shell/command execution in server code (build/bridge/adb-bridge.js)MTC-SRC-002
In the server's implementation (`build/bridge/adb-bridge.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: execFile, spawn } from "child_process"; import { config } from "../config/config.js"; import { shellQuote } from "../mid
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/bridge/adb-bridge.js
high Shell/command execution in server code (build/bridge/local-bridge.js)MTC-SRC-002
In the server's implementation (`build/bridge/local-bridge.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: pawn, spawnSync } from "child_process"; import { existsSync } from "fs"; import { AdbBridge, AdbError } from "./adb-brid
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/bridge/local-bridge.js
high Shell/command execution in server code (build/tools/device-farm.js)MTC-SRC-002
In the server's implementation (`build/tools/device-farm.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: port { execFile } from "child_process"; import { OutputProcessor } from "../middleware/output-processor.js"; function ex
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/device-farm.js
high Shell/command execution in server code (build/tools/emulator.js)MTC-SRC-002
In the server's implementation (`build/tools/emulator.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: execFile, spawn } from "child_process"; import { platform } from "os"; import { existsSync } from "fs"; import { OutputP
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/emulator.js
high Shell/command execution in server code (build/tools/mirroring.js)MTC-SRC-002
In the server's implementation (`build/tools/mirroring.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: spawn, execFile } from "child_process"; import { platform } from "os"; import { existsSync } from "fs"; import { isWithi
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/mirroring.js
high Shell/command execution in server code (build/tools/qemu.js)MTC-SRC-002
In the server's implementation (`build/tools/qemu.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: pawn, spawnSync } from "child_process"; import { OutputProcessor } from "../middleware/output-processor.js"; import { is
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/qemu.js
medium Dynamic module load from a non-literal (build/tools/plugins.js)MTC-SRC-005
In the server's implementation (`build/tools/plugins.js:85`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const mod = await import(moduleUrl); if (typeof mod.register === "function") { mod.reg
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/plugins.js
low Mutating tool "adb_multi_shell" declares no destructiveHintMTC-CAP-005
Tool "adb_multi_shell" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool adb_multi_shell
low Mutating tool "adb_qemu_guest_shell" declares no destructiveHintMTC-CAP-005
Tool "adb_qemu_guest_shell" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool adb_qemu_guest_shell
low Mutating tool "adb_shell" declares no destructiveHintMTC-CAP-005
Tool "adb_shell" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool adb_shell
low Mutating tool "adb_root_shell" declares no destructiveHintMTC-CAP-005
Tool "adb_root_shell" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool adb_root_shell
low Shell command embedded in tool metadataMTC-INJ-CMD-1
Shell command embedded in tool metadata detected in the description of tool "adb_rm". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.
Evidence: rm -rf
Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.
Location: tool adb_rm · description
low Shell/command execution in packaging/dev tooling (build/tools/build.js)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`build/tools/build.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: port { execFile } from "child_process"; import { existsSync } from "fs"; import { join } from "path"; import { platform
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/build.js
Tools 200
Each tool and what it can reach — statically extracted from the published source.
adb_a11y_treereads sensitive dataadb_carrier_configreads sensitive dataadb_heap_dumpreads sensitive dataadb_list_permissionsreads sensitive dataadb_lsreads sensitive dataadb_multi_shellruns code / shelladb_notificationsreads sensitive dataadb_qemu_guest_shellruns code / shelladb_root_shellruns code / shelladb_shellruns code / shell
Show 190 more tools ↓
adb_ui_dumpreads sensitive dataadb_a11y_auditno sensitive capabilityadb_a11y_touch_targetsno sensitive capabilityadb_airplane_cycleno sensitive capabilityadb_airplane_modeno sensitive capabilityadb_apex_listno sensitive capabilityadb_app_route_contextno sensitive capabilityadb_at_batchno sensitive capabilityadb_at_cross_validateno sensitive capabilityadb_at_detectno sensitive capabilityadb_at_probeno sensitive capabilityadb_at_sendno sensitive capabilityadb_avd_listno sensitive capabilityadb_baseband_infono sensitive capabilityadb_batch_actionsno sensitive capabilityadb_batteryno sensitive capabilityadb_bluetooth_firmwareno sensitive capabilityadb_bugreportno sensitive capabilityadb_build_and_installno sensitive capabilityadb_catno sensitive capabilityadb_cell_identityno sensitive capabilityadb_ci_device_readyno sensitive capabilityadb_ci_run_testsno sensitive capabilityadb_ci_wait_bootno sensitive capabilityadb_clear_datano sensitive capabilityadb_clipboardno sensitive capabilityadb_crash_logsno sensitive capabilityadb_current_activityno sensitive capabilityadb_device_infono sensitive capabilityadb_device_stateno sensitive capabilityadb_devicesno sensitive capabilityadb_dumpsysno sensitive capabilityadb_emulator_startno sensitive capabilityadb_emulator_stopno sensitive capabilityadb_extract_apksno sensitive capabilityadb_farm_matrixno sensitive capabilityadb_farm_resultsno sensitive capabilityadb_farm_runno sensitive capabilityadb_file_checksumno sensitive capabilityadb_file_chmodno sensitive capabilityadb_file_chownno sensitive capabilityadb_file_copyno sensitive capabilityadb_file_fsinfono sensitive capabilityadb_file_moveno sensitive capabilityadb_file_replaceno sensitive capabilityadb_file_statno sensitive capabilityadb_file_touchno sensitive capabilityadb_file_writeno sensitive capabilityadb_findno sensitive capabilityadb_firmware_diffno sensitive capabilityadb_firmware_historyno sensitive capabilityadb_firmware_probeno sensitive capabilityadb_force_stopno sensitive capabilityadb_forwardno sensitive capabilityadb_forward_listno sensitive capabilityadb_forward_removeno sensitive capabilityadb_getpropno sensitive capabilityadb_gps_firmwareno sensitive capabilityadb_gradleno sensitive capabilityadb_grant_permissionno sensitive capabilityadb_grepno sensitive capabilityadb_health_checkno sensitive capabilityadb_iio_readno sensitive capabilityadb_inputno sensitive capabilityadb_input_double_tapno sensitive capabilityadb_input_dragno sensitive capabilityadb_input_flingno sensitive capabilityadb_input_long_pressno sensitive capabilityadb_input_pinchno sensitive capabilityadb_input_textno sensitive capabilityadb_installno sensitive capabilityadb_install_bundleno sensitive capabilityadb_list_packagesno sensitive capabilityadb_list_splitsno sensitive capabilityadb_locationno sensitive capabilityadb_logcatno sensitive capabilityadb_logcat_clearno sensitive capabilityadb_logcat_crashno sensitive capabilityadb_logcat_pollno sensitive capabilityadb_logcat_sessionsno sensitive capabilityadb_logcat_startno sensitive capabilityadb_logcat_stopno sensitive capabilityadb_mirror_startno sensitive capabilityadb_mirror_statusno sensitive capabilityadb_mirror_stopno sensitive capabilityadb_mkdirno sensitive capabilityadb_mobile_datano sensitive capabilityadb_modem_logsno sensitive capabilityadb_multi_compareno sensitive capabilityadb_multi_installno sensitive capabilityadb_multi_testno sensitive capabilityadb_neighboring_cellsno sensitive capabilityadb_networkno sensitive capabilityadb_network_auto_connectno sensitive capabilityadb_network_connectionsno sensitive capabilityadb_network_device_ipno sensitive capabilityadb_network_scanno sensitive capabilityadb_nfc_firmwareno sensitive capabilityadb_open_urlno sensitive capabilityadb_orientationno sensitive capabilityadb_ota_checkno sensitive capabilityadb_ota_fingerprintno sensitive capabilityadb_ota_historyno sensitive capabilityadb_package_infono sensitive capabilityadb_perf_snapshotno sensitive capabilityadb_permission_auditno sensitive capabilityadb_plugin_infono sensitive capabilityadb_plugin_listno sensitive capabilityadb_profile_detectno sensitive capabilityadb_profile_listno sensitive capabilityadb_profile_saveno sensitive capabilityadb_pullno sensitive capabilityadb_pushno sensitive capabilityadb_qemu_connectno sensitive capabilityadb_qemu_disconnectno sensitive capabilityadb_qemu_imagesno sensitive capabilityadb_qemu_setupno sensitive capabilityadb_qemu_startno sensitive capabilityadb_qemu_statusno sensitive capabilityadb_qemu_stopno sensitive capabilityadb_rebootno sensitive capabilityadb_registry_installno sensitive capabilityadb_registry_installedno sensitive capabilityadb_registry_searchno sensitive capabilityadb_regression_baselineno sensitive capabilityadb_regression_checkno sensitive capabilityadb_regression_historyno sensitive capabilityadb_resolve_intentsno sensitive capabilityadb_restart_appno sensitive capabilityadb_result_dropno sensitive capabilityadb_result_getno sensitive capabilityadb_result_listno sensitive capabilityadb_reverseno sensitive capabilityadb_reverse_removeno sensitive capabilityadb_revoke_permissionno sensitive capabilityadb_ril_pollno sensitive capabilityadb_ril_startno sensitive capabilityadb_ril_stopno sensitive capabilityadb_rmno sensitive capabilityadb_runtime_auditno sensitive capabilityadb_screenno sensitive capabilityadb_screen_sizeno sensitive capabilityadb_screen_stateno sensitive capabilityadb_screencapno sensitive capabilityadb_screencap_annotatedno sensitive capabilityadb_screenrecord_startno sensitive capabilityadb_screenrecord_stopno sensitive capabilityadb_screenshot_baselineno sensitive capabilityadb_screenshot_compressedno sensitive capabilityadb_screenshot_diffno sensitive capabilityadb_screenshot_historyno sensitive capabilityadb_scroll_untilno sensitive capabilityadb_selinux_denialsno sensitive capabilityadb_selinux_statusno sensitive capabilityadb_sensor_readno sensitive capabilityadb_settings_getno sensitive capabilityadb_settings_putno sensitive capabilityadb_shannon_sessionno sensitive capabilityadb_signal_detailno sensitive capabilityadb_snapshot_captureno sensitive capabilityadb_snapshot_compareno sensitive capabilityadb_snapshot_restore_settingsno sensitive capabilityadb_sqlite_inspectno sensitive capabilityadb_start_activityno sensitive capabilityadb_start_appno sensitive capabilityadb_tap_elementno sensitive capabilityadb_tcpdump_startno sensitive capabilityadb_tcpdump_stopno sensitive capabilityadb_telephonyno sensitive capabilityadb_test_gen_from_intentsno sensitive capabilityadb_test_gen_from_uino sensitive capabilityadb_test_gen_saveno sensitive capabilityadb_test_session_endno sensitive capabilityadb_test_session_startno sensitive capabilityadb_test_stepno sensitive capabilityadb_thermal_compareno sensitive capabilityadb_thermal_snapshotno sensitive capabilityadb_topno sensitive capabilityadb_tunnel_closeno sensitive capabilityadb_tunnel_listno sensitive capabilityadb_tunnel_openno sensitive capabilityadb_ui_findno sensitive capabilityadb_uninstallno sensitive capabilityadb_wait_elementno sensitive capabilityadb_wait_stableno sensitive capabilityadb_wear_datalayer_preflightno sensitive capabilityadb_wifino sensitive capabilityadb_wifi_firmwareno sensitive capabilitymy_custom_toolno sensitive capabilitymy_toolno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.1.4 latest |
A 91/100 | 18 | 1.13.0 | 2026-09-07 |
v1.1.3 |
A 91/100 | 18 | 1.13.0 | 2026-08-30 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan deepadb --onlineMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.