Android Remote Control

Android Remote Control MCP

An Android application that runs as an MCP (Model Context Protocol) server, enabling AI models to fully control an Android device remotely using accessibility services and screenshot capture.

The app runs directly on your Android device (or emulator) and exposes an HTTP server (with optional HTTPS) implementing the MCP protocol. AI models like Claude can connect to it and interact with any app on the device — reading UI elements, tapping buttons, typing text, swiping, capturing screenshots, managing files, launching apps, and more.

Warning: This software is provided "as-is" without warranty of any kind, for research and educational purposes only. The authors do not condone the use of this tool for any illegal, unauthorized, or unethical activities. Users are solely responsible for ensuring their use complies with all applicable laws and regulations. By using this software, you agree to use it responsibly and at your own risk.

Contents

• Demo
• Features
• Install
• Setup
• Privacy Mode
• Integrations
• Configuration
• Permissions Reference
• Security
• Contributing
• License

Demo

MCP Server

• HTTP server running directly on Android (Ktor + Netty), with optional HTTPS
• Streamable HTTP transport at /mcp (MCP specification compliant, JSON-only, no SSE)
• Combined authentication: static bearer token and/or a self-contained OAuth 2.1 server (Claude.ai / Claude Desktop custom connectors, with on-device approval)
• Auto-generated self-signed TLS certificates (or custom certificate upload)
• Configurable binding: localhost (127.0.0.1) or network (0.0.0.0)
• Auto-start on boot
• Remote access tunnels via the free end-to-end encrypted tunnel (no account), Cloudflare Quick Tunnels or ngrok (public HTTPS URL)

57 MCP Tools across 14 Categories

Screen introspection, system actions, touch actions, gestures, node actions, text input, utilities, file operations, app management, camera, intents, notifications, location, and sharing.

All tool names use the android_ prefix by default (e.g., android_tap). When a device slug is configured (e.g., pixel7), the prefix becomes android_pixel7_ (e.g., android_pixel7_tap).

See docs/MCP_TOOLS.md for the full tool reference with input/output schemas and examples.

Android App

• Material Design 3 UI with tabbed layout (Server / Settings / About) and dark mode
• Server status monitoring (running/stopped) with permission warning banner
• Connection info display (IP, port, token, tunnel URL)
• Per-tool and per-parameter permissions (enable/disable individual MCP tools)
• Permission management (Accessibility, Notifications, Camera, Microphone)
• Remote access tunnel configuration (free E2E tunnel / Cloudflare / ngrok)
• Storage location management (automatic locations + SAF authorization for file tools)
• Server log viewer (MCP tool calls, tunnel events)
• Headless setup via ADB (configure, grant permissions, start/stop server without UI)

Comparison with Alternatives

Most alternatives rely on ADB running on a host machine, which means a USB cable or local network connection and a computer sitting next to the phone. This project runs entirely on the device itself, so you can expose the MCP endpoint through a tunnel and control your phone from anywhere.

On the token efficiency side, ADB-based tools typically return raw uiautomator XML dumps which can easily be 10-50x more verbose than the compact representation used here. Combined with numbered screenshot annotations, configurable image quality, and the ability to disable tools you don't need (every tool definition costs tokens on every turn), this significantly reduces the per-interaction cost in agentic loops.

Install

Which build to download: GMS or FOSS

Each release provides two flavors of the APK — pick the one that matches your device:

• GMS (…-gms-release.apk) — the full build. Requires Google Mobile Services (Google Play Services) installed on the phone. Choose this on standard devices/emulators that ship with Google services.
• FOSS (…-foss-release.apk) — a Google-free build with no dependency on Google Mobile Services. Works on any Android phone, including de-Googled ROMs and devices where Google services are unavailable.

If unsure, the GMS build is the right choice for a typical phone with the Play Store.

Option A: Download on your phone (easiest)

1. Open the Releases page on your phone's browser
2. Download the APK from the latest release
3. Open the downloaded APK and follow the prompts to install it (you may need to allow installation from unknown sources)

Option B: Download on your PC and install via ADB

1. Download the APK from the Releases page
2. Connect your phone via USB (with USB Debugging enabled)
3. Install the APK (use the GMS or FOSS file you downloaded):

adb install android-remote-control-mcp-<version>-gms-release.apk

Option C: Build from sources

git clone https://github.com/danielealbano/android-remote-control-mcp.git
cd android-remote-control-mcp
make build
make install  # installs on connected device/emulator

See CONTRIBUTING.md for full build requirements and instructions.

Setup

1. Open the app. The Server tab shows a permission warning banner; grant permissions from there or via Settings > Permissions.

2. Grant permissions:

   • Accessibility Service — required. Powers UI introspection, action execution, and screenshots; nothing works without it.
     • If the toggle is greyed out (Android 13+, common on Samsung/One UI for apps installed from an APK): this is Android's "Restricted settings" protection. A dialog reads "Restricted setting — For your security, this setting is currently unavailable." To unblock it, go to Settings → Apps → Android Remote Control MCP → App info, tap the ⋮ menu (top-right), choose Allow restricted settings, confirm with your PIN/pattern/biometric, then enable the Accessibility Service. (Play Store / F-Droid installs are not affected.)
   • Notifications — optional (recommended for OAuth). OAuth sign-in approvals (Claude.ai / Claude Desktop, ChatGPT, or any third-party OAuth client) arrive as heads-up notifications you tap to confirm the 2-digit code and approve. It is no longer required for OAuth login, though: if you don't grant this permission, pending requests still appear as a card on the app's Server screen that you tap to review and approve/deny. The Event Channel push feature — e.g. pushing device events to Claude Code — runs as a foreground service that posts its status notification through this permission on Android 13+.
   • Other permissions (optional) — Camera, Microphone, and Location enable their corresponding MCP tools. The app works without them; only the dependent features are disabled until granted. See the Permissions Reference below for the complete list.
   • Storage locations — configure in Settings > Storage if you plan to use the file tools (automatic locations like Downloads, plus custom locations via SAF).

3. Start the server. Go back to the Server tab and tap Start.

The server starts on http://127.0.0.1:8080 by default. The connection info (IP, port, token, URL) is displayed on the Server tab.

Note: 127.0.0.1 refers to the phone's localhost, not your computer. To connect from your computer, use adb port forwarding, bind to 0.0.0.0 (network mode), or enable a remote access tunnel.

Privacy Mode

Privacy Mode detects and hides personal data — emails, credit cards and IBANs, credentials, phone numbers, national IDs, addresses, and names — in everything the MCP tools return (screen content, notifications, clipboard, files, …) before it leaves the device for the AI provider. Detection runs fully on-device: fast rule-based checks (checksums, formats, field context) combined with a local NER model — no cloud calls. Detected values are either pseudonymized with consistent placeholders (EMAIL#a1b2c, so AI tools keep working across screens) or fully redacted. Detection is best-effort mitigation, not a guarantee.

The model is the Ai4Privacy multilingual anonymiser (MIT license, Built with Llama), downloaded once on first enable (~150 MB) directly from the pinned Hugging Face revision and checksum-verified on device.

Measured detection rates

Share of personal data items detected per category by the full pipeline, measured with the in-repo effectiveness benchmark (make privacy-benchmark) on realistic UI-style content across 8 languages:

Names are the on-device model's known weak spot (it recognizes common Western names far better than the globally diverse names in the benchmark); improving name detection with a fine-tuned model is on the roadmap. Actual results vary with content and language.

Enabling Privacy Mode

• From the main Server screen: tap Set up Privacy Mode on the Privacy Mode card (shown while the mode is off).
• Or via Settings → Privacy: turn on Enable Privacy Mode and confirm the one-time model download. After the download and warm-up, a short on-device benchmark measures the expected per-screen overhead and shows it on the same screen.
• Protected categories, pseudonymize-vs-redact, and the placeholder format are configurable in Settings → Privacy.

Integrations

Claude Desktop / Claude Code

Add the server to your .mcp.json configuration file:

{
  "mcpServers": {
    "android-phone": {
      "type": "http",
      "url": "http://DEVICE_IP:PORT/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Replace DEVICE_IP, PORT, and YOUR_TOKEN with the values shown in the app's Server tab. If the server is bound to localhost (default), you'll need adb port forwarding or a remote access tunnel to connect.

Note for clients without custom-header support: if your MCP client cannot send an Authorization header and does not support OAuth, you can turn off both auth methods in the app (Settings → Access — disable Bearer token and OAuth). The app warns and asks you to confirm, because the server is then open: anyone who can reach it has full control. Only do this on a network you trust.

Connect from Claude.ai & Claude Desktop (Custom Connector, OAuth)

Claude.ai (web) and Claude Desktop connect as a custom connector (remote MCP) using OAuth 2.1 — the app is its own OAuth Authorization Server, so no external account or pre-registration is needed. This requires the server to be reachable over a public HTTPS URL, so you must first enable a remote access tunnel — a localhost/LAN address or adb port-forward will not work.

1. OAuth is enabled by default — no action needed (if you previously disabled it, re-enable it under Settings → Access). The bearer token stays enabled too; both are accepted.
2. Open Settings → Tunnel, enable Remote Access (the default free E2E tunnel needs no account; the first setup takes about 10–30 seconds), and start the server. Copy the public https://… URL from the Server tab and append /mcp (e.g. https://<name>.d.arc-tunnel.io/mcp).
3. In Claude, open Customize → Connectors → Add custom connector, paste the https://…/mcp URL, and leave the OAuth Client ID and Client Secret blank (the app uses Dynamic Client Registration). Click Add.
4. Claude opens a browser approval page showing a 2-digit code. On the device, tap the heads-up notification — or, if the Notifications permission is off, open the app's Server screen and tap the pending approvals card — to open the approval screen, confirm the code matches, and Approve.
5. Manage or revoke connected clients any time under Settings → Access → Connected clients. Revoking immediately invalidates that client's tokens.

Public URL override (optional): if your tunnel/host topology needs a fixed public host (or you bind to 0.0.0.0 without a trusted proxy), set a Public URL override in Settings → Access so OAuth metadata and links use a stable host.

Custom connectors are available on the Free (1 connector), Pro, Max, Team, and Enterprise plans (currently in beta).

⚠️ Security: treat the public tunnel URL as sensitive, approve only connections you initiated (verify the 2-digit code), revoke clients you no longer use, and stop the tunnel and server when you are done. Never point it at a device holding sensitive data.

Connect from ChatGPT (Custom Connector, OAuth)

ChatGPT connects to the server as a custom MCP connector using the same self-contained OAuth 2.1 flow. As with Claude, the server must be reachable over a public HTTPS URL, so enable a remote access tunnel first — a localhost/LAN address or adb port-forward will not work. Custom connectors require a paid plan (Plus, Pro, Business, Enterprise, or Edu — not Free) and are set up from the ChatGPT web app.

1. Enable Developer mode — in ChatGPT on the web, open Settings → Connectors → Advanced settings (labelled Apps & Connectors on some builds) and turn on Developer mode.
2. Start the tunnel — same as the Claude flow above: OAuth stays enabled by default, turn on Remote Access under Settings → Tunnel, start the server, and copy the public https://…/mcp URL from the Server tab.
3. Add the connector — open Settings → Connectors → Create, give it a name and description, paste the https://…/mcp URL, select OAuth as the authentication method, and leave any Client ID / Client Secret blank (the app self-registers clients via Dynamic Client Registration).
4. Approve on the device — ChatGPT starts the OAuth flow. Tap the heads-up notification — or, if the Notifications permission is off, open the app's Server screen and tap the pending approvals card — confirm the 2-digit code matches, and Approve (identical to the Claude approval step).
5. Manage or revoke the connected client any time under Settings → Access → Connected clients in the app.

⚠️ Security: the same cautions apply — treat the tunnel URL as sensitive, approve only connections you initiated (verify the code), revoke unused clients, and stop the tunnel and server when you are done.

Other MCP Clients

The MCP server exposes a standard Streamable HTTP endpoint at /mcp with combined authentication (static bearer token and/or OAuth 2.1). Any MCP-compatible client can connect to it — refer to your client's documentation for the specific configuration format.

Testing with MCP Inspector

MCP Inspector is the official visual testing tool for MCP servers. It provides a browser-based UI to connect, list tools, fill parameters, and see responses:

npx @modelcontextprotocol/inspector

This opens a UI at http://localhost:6274 where you can connect to your server and test tools interactively.

Testing with curl

All requests are sent as JSON-RPC 2.0 via POST /mcp (Streamable HTTP transport). The server requires a session initialization handshake before tool calls:

# Initialize a session (required before any tool call)
# Capture the mcp-session-id from the response headers
curl -s -D- -X POST http://localhost:8080/mcp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl-client","version":"1.0.0"}}}'

# Use the mcp-session-id from the response headers in all subsequent requests

# List available tools
curl -X POST http://localhost:8080/mcp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

# Get the current screen state (UI nodes + optional screenshot)
curl -X POST http://localhost:8080/mcp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"android_get_screen_state","arguments":{}}}'

# Tap at coordinates
curl -X POST http://localhost:8080/mcp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"android_tap","arguments":{"x":540,"y":1200}}}'

Replace SESSION_ID with the mcp-session-id value from the initialize response headers.

The bearer token is shown in the app's connection info and can be copied directly. Bearer authentication is controlled by the Bearer token toggle in Settings → Access (not by clearing the value): with it enabled, every /mcp request must present the token (or a valid OAuth access token). The server accepts unauthenticated requests only when both the Bearer token and OAuth are disabled.

Configuration

Server Settings (via App UI)

Using with adb Port Forwarding

When the server is bound to 127.0.0.1 (default, most secure):

# Forward device port to host
adb forward tcp:8080 tcp:8080

# Test connection from host
curl -X POST http://localhost:8080/mcp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"ping"}'

Using over Network

When the server is bound to 0.0.0.0:

1. Find the device's IP address (shown in the app's connection info)
2. Connect directly via POST http://DEVICE_IP:8080/mcp with bearer token

Warning: Binding to 0.0.0.0 exposes the server to all devices on the same network. Only use on trusted private networks.

Using Remote Access Tunnels

For connecting from outside the local network without port forwarding:

1. Free E2E tunnel (default, no account required): end-to-end encrypted. The phone enrolls with hardware key attestation, gets a name under d.arc-tunnel.io and a public certificate (Let's Encrypt, Google Trust Services or ZeroSSL) issued to its own key, and terminates TLS itself — the tunnel service only relays ciphertext (unlike Cloudflare or ngrok, which read the traffic). The refresh icon next to the URL re-enrolls under a new name. A Certificate Transparency check (on by default) warns if a certificate for your name is ever issued to another key. Self-hosters change the base address.
2. Cloudflare Quick Tunnels (no account required): Creates a temporary tunnel with a random *.trycloudflare.com HTTPS URL.
3. ngrok (account required): Supports optional custom domains. Requires an ngrok authtoken (free tier available). Available on arm64-v8a and x86_64 devices.

Enable the tunnel in the app's "Remote Access" section. The public URL is displayed in the connection info and server logs.

Headless Setup via ADB

The app can be fully configured and controlled from the command line without opening the UI. This is useful for automated setups, CI pipelines, or headless devices.

Replace <app-id> with the application ID for your build:

• Debug: com.danielealbano.androidremotecontrolmcp.debug
• Release: com.danielealbano.androidremotecontrolmcp

Grant Permissions

# Enable Accessibility Service (required for UI introspection, actions, and screenshots)
adb shell settings put secure enabled_accessibility_services \
  <app-id>/com.danielealbano.androidremotecontrolmcp.services.accessibility.McpAccessibilityService

# Enable Notification Listener Service (required for notification tools)
adb shell cmd notification allow_listener \
  <app-id>/com.danielealbano.androidremotecontrolmcp.services.notifications.McpNotificationListenerService

# Grant notification permission (Android 13+)
adb shell pm grant <app-id> android.permission.POST_NOTIFICATIONS

# Grant camera permission
adb shell pm grant <app-id> android.permission.CAMERA

# Grant microphone permission
adb shell pm grant <app-id> android.permission.RECORD_AUDIO

# Grant location permissions
adb shell pm grant <app-id> android.permission.ACCESS_FINE_LOCATION
adb shell pm grant <app-id> android.permission.ACCESS_COARSE_LOCATION
adb shell pm grant <app-id> android.permission.ACCESS_BACKGROUND_LOCATION

# Grant nearby WiFi devices permission (Android 13+)
adb shell pm grant <app-id> android.permission.NEARBY_WIFI_DEVICES

# Grant media read permissions (Android 13+)
adb shell pm grant <app-id> android.permission.READ_MEDIA_IMAGES
adb shell pm grant <app-id> android.permission.READ_MEDIA_VIDEO
adb shell pm grant <app-id> android.permission.READ_MEDIA_AUDIO

See docs/PERMISSIONS.md for the full reference and a copy-paste script that grants everything in one go.

Configure the App

All extras are optional — only the ones provided are updated. The app does not need to be open.

Requires adb. The configuration receiver and the service trampoline are gated on android.permission.DUMP, which the adb shell UID holds but ordinary apps cannot obtain. The commands below work unchanged from adb shell; an app on the device cannot use them to reconfigure the server. See the Security section.

adb shell am broadcast \
  -a com.danielealbano.androidremotecontrolmcp.ADB_CONFIGURE \
  -n <app-id>/com.danielealbano.androidremotecontrolmcp.services.mcp.AdbConfigReceiver \
  --es bearer_token "my-secret-token" \
  --es binding_address "0.0.0.0" \
  --ei port 8080 \
  --ez auto_start_on_boot true \
  --ez hide_from_recents false \
  --ez https_enabled false \
  --es certificate_source "AUTO_GENERATED" \
  --es certificate_hostname "mcp.local" \
  --ez tunnel_enabled true \
  --es tunnel_provider "android-remote-control-mcp-tunneld" \
  --es arc_tunnel_base_address "arc-tunnel.io" \
  --ez arc_tunnel_ct_check_enabled true \
  --es cloudflare_tunnel_mode "TOKEN" \
  --es cloudflare_tunnel_token "your-cloudflare-tunnel-token" \
  --es cloudflare_tunnel_extra_args "--edge region1.v2.argotunnel.com:7844" \
  --es ngrok_authtoken "your-ngrok-token" \
  --es ngrok_domain "your-domain.ngrok-free.app" \
  --ei file_size_limit_mb 50 \
  --ez allow_http_downloads false \
  --ez allow_unverified_https_certs false \
  --ei download_timeout_seconds 60 \
  --es device_slug "pixel8" \
  --es tool_permissions '{"disabled_tools":["tap"],"disabled_params":{"swipe":["duration_ms"]}}'

# Disable bearer authentication (use only on trusted networks; the server is open
# only if OAuth is also disabled — see the Security section)
adb shell am broadcast \
  -a com.danielealbano.androidremotecontrolmcp.ADB_CONFIGURE \
  -n <app-id>/com.danielealbano.androidremotecontrolmcp.services.mcp.AdbConfigReceiver \
  --ez bearer_token_enabled false

Bearer enforcement is controlled by --ez bearer_token_enabled <bool>, NOT by clearing the value. Clearing the value (--es bearer_token "") while bearer_token_enabled=true makes /mcp fail CLOSED (401) — it does NOT open the server. The server accepts unauthenticated requests only when BOTH bearer_token_enabled and oauth_enabled are false.

Start the MCP Server

The server must be started via a trampoline Activity (required on Android 12+ to gain foreground service exemption). This works even when the app is force-stopped.

adb shell am start \
  -n <app-id>/com.danielealbano.androidremotecontrolmcp.services.mcp.AdbServiceTrampolineActivity \
  --es action start

Stop the MCP Server

adb shell am start \
  -n <app-id>/com.danielealbano.androidremotecontrolmcp.services.mcp.AdbServiceTrampolineActivity \
  --es action stop

Enroll the Free E2E Tunnel

Enrollment (getting the device's name and certificate) runs in a short foreground service. Headless, use the same trampoline Activity as for starting the server; it also resumes a failed certificate issuance. Run it while the server is stopped.

adb shell am start \
  -n <app-id>/com.danielealbano.androidremotecontrolmcp.services.mcp.AdbServiceTrampolineActivity \
  --es action enroll-tunnel

--ez arc_tunnel_enroll true on the configuration broadcast does the same when the app is visible; from the background Android 12+ refuses the foreground service start and the app reports "background start refused".

Permissions Reference

The app declares the permissions below. Normal permissions are granted automatically at install. Runtime permissions and Special access require explicit user action (via the app's Settings > Permissions tab, or programmatically — see Granting Permissions Programmatically). All runtime permissions are optional: the app works without them, but the features that depend on them are disabled until granted.

Security

No Root Required

The application runs entirely within Android's standard permission model. No root access, no unlocked bootloader, no custom ROM required.

Authentication

Authentication is combined (dual-accept): a /mcp request is authorized by a valid static bearer token OR a valid issued OAuth access token. Enforcement is controlled by two independent toggles in Settings → Access — bearer_token_enabled (default on) and oauth_enabled (default on) — not by the token value. The bearer token is auto-generated once on first launch (UUID, preserved across app upgrades) and can be viewed, copied, or regenerated in the app. Clearing the value while bearer is enabled makes the server fail CLOSED (401). The server accepts unauthenticated requests only when BOTH toggles are off (the app shows a warning and a confirmation before that happens) — see the security note in the Connect section.

Network Security

• Default binding 127.0.0.1: Only accessible via adb port forwarding or tunnels (most secure)
• Optional binding 0.0.0.0: Accessible over network (use only on trusted networks; security warning displayed when enabling)
• HTTPS: Optional, disabled by default. When enabled, uses auto-generated self-signed certificates or upload your own CA-signed certificate. Certificate is stored in app-private storage.

Permissions

All permissions are managed from the app's Settings > Permissions tab. Every sensitive permission requires explicit user action — nothing is granted silently.

Storage locations are configured in Settings > Storage, which includes automatic locations (e.g., Downloads) and custom locations authorized via the system file picker.

Contributing

See CONTRIBUTING.md for build requirements, testing, architecture, and development conventions.

License

This project is licensed under the GNU General Public License, version 3 or (at your option) any later version, with an additional permission under GPLv3 section 7 for combining it with the Google Play services client libraries. See LICENSE.md for the full text.

Third-party components bundled with the app and their licenses are listed in THIRD_PARTY_LICENSES.md.