# APKCube (remote · apkcube.com) Search Android apps, check APK signing and scans, and get verified APK download links. - Trust score: 79/100 (medium) - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - remote · `apkcube.com`: 79/100 (this document), [markdown](https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp.md), [page](https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp) ## Channel facts - Endpoint: `https://apkcube.com/api/mcp` - Transports: `streamable-http` - Auth: `required` - Version: `1.0.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Endpoint Security**: 89/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. - HTTPS is enforced; there's no plaintext access path. - HSTS check failed: the Strict-Transport-Security header is absent. - DNSSEC check failed: this domain isn't protected by DNSSEC. - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 79/100 - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name). - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 7205 tokens (~200/item across 36 items; 36 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 7/100 - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - Structured output schemas are declared (100% of tools); any adoption earns full credit. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 36 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 37 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a current MCP spec version (2026-07-28). ## Install ### How do I install the APKCube MCP server? APKCube is a hosted endpoint at https://apkcube.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http com-apkcube-apkcube 'https://apkcube.com/api/mcp' ``` ### Cursor ```json { "mcpServers": { "com-apkcube-apkcube": { "url": "https://apkcube.com/api/mcp" } } } ``` ### VS Code ```json { "servers": { "com-apkcube-apkcube": { "type": "http", "url": "https://apkcube.com/api/mcp" } } } ``` ### Codex ```toml [mcp_servers.com-apkcube-apkcube] url = "https://apkcube.com/api/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "com-apkcube-apkcube": { "type": "remote", "url": "https://apkcube.com/api/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add com-apkcube-apkcube --url 'https://apkcube.com/api/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: com-apkcube-apkcube: url: "https://apkcube.com/api/mcp" ``` ### Netclaw ```json { "McpServers": { "com-apkcube-apkcube": { "Transport": "http", "Url": "https://apkcube.com/api/mcp" } } } ``` ### Vellum ```bash assistant mcp add com-apkcube-apkcube -t streamable-http -u 'https://apkcube.com/api/mcp' ``` ### Other ```json { "mcpServers": { "com-apkcube-apkcube": { "type": "http", "url": "https://apkcube.com/api/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-05 (score 79, +1) No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-11-04 (score 78, 0) - [functional improvement] Stability: unverified → 0.03 ### 2026-11-03 (score 78) First indexed and scored. ## MCP tools (36) ### `search_apps` (~229 tokens) Search apps Search the APK catalogue by name, publisher or package id. Start here when you have a phrase and need a package name. Returns 24 results a page out of at most 60 matches, so paging stops at page 3 — narrow the phrase rather than paging for more. `facets` counts the matches by type and category before filtering, so it tells you which filter would narrow a broad phrase. Searching an exact package id works as a lookup. A phrase nobody has searched before asks Google Play live and can take up to 20 seconds; UPSTREAM_UNAVAILABLE / UPSTREAM_BUSY there is refunded and means Play did not answer in time, not that nothing matches — retry the same phrase after a few seconds. Input parameters: - `category` (string): Category id from list_categories. - `page` (integer): 1-based page number, 1–3. Defaults to 1. - `q` (string, required): Search phrase, publisher, or exact package id. - `sort` (string): Result ordering. Defaults to relevance. - `type` (string): Restrict to games or apps. Output parameters: - `facets` (object): How the match pool divides before `type`/`category` were applied — which filter would narrow the phrase, and by how much. - `items` (array) - `matched` (integer): Matches before type/category filtering were applied. - `page` (integer): 1-based page number of this result. - `perPage` (integer): Rows per page. - `total` (integer): Total matching rows across all pages. - `totalPages` (integer): Number of pages available. ### `get_app` (~116 tokens) Get app details Full record for one package: description, screenshots, rating, tags, and whether a download would be refused. Does NOT list downloadable files — use list_versions for those. An app not in the catalogue yet is looked up on Google Play live, for up to 20 seconds; UPSTREAM_UNAVAILABLE / UPSTREAM_BUSY then is refunded and means Play did not answer in time, not that the app does not exist — retry after a few seconds. Input parameters: - `packageName` (string, required): Android package id, e.g. com.whatsapp. Output parameters: - `availability` (string): 'unavailable' means a download call will be refused — a takedown, a paid app we cannot obtain, or a listing under the operator's rating bar. - `categoryId` (string): Category id, as listed by the categories call. - `categoryName` (string): Human-readable category. - `description` (array): Plain-text paragraphs. - `descriptionHtml` (string|null): Sanitised store markup. - `developer` (string): Publisher name as scraped. - `developerSlug` (string|null): Key for the developer lookup. Null when the row has no publisher. - `developerVerified` (boolean): The publisher is verified on this site through the Developers Console (it proved it owns the Play listing, or an operator approved a publisher that is not on Google Play); the text fields may then be… - `editorsChoice` (boolean): Carries Play's Editors' Choice badge. - `hasFiles` (boolean): We hold at least one downloadable file. Check before spending a download. - `headerImage` (string|null): Wide feature graphic. - `iconUrl` (string|null): Store artwork URL. - `installs` (string|null): Google Play's install BUCKET, verbatim ('10,000,000+'). A string, not a number — Play publishes no exact count. Null when the app is not on Google Play. - `name` (string): App title. - `onGooglePlay` (boolean): False for an app its developer published on this site directly, with no Google Play listing: the Play fields are then null and the Play listing call answers 404. - `packageName` (string): Android package id — the identifier every app call takes. - `paid` (boolean): Paid on Google Play. - `price` (object|null): Play's asking price. Null for a free listing. - `rating` (number|null): Play star rating, 0–5. Null when the app is not on Google Play, or when Play gave it no rating. - `ratings` (integer|null): Vote count behind `rating`. Null on rows seeded from a list scrape. - `recentChanges` (string|null): Play's 'What's new'. - `requiresAndroid` (string): Minimum Android, as Play states it ('5.0 and up'). - `screenshots` (array) - `summary` (string): One-line store summary. - `tags` (array) - `type` (string): Game or app. - `updatedAt` (string|null): When Play last published an update, ISO 8601. - `version` (string): Latest version NAME known ('2.24.9'). May be 'Varies with device'. - `videoUrl` (string|null): Promo video, when Play lists one. ### `check_availability` (~157 tokens) Check app availability Free. Whether we hold a downloadable build of each of up to 100 packages, the newest one's versionName and versionCode, and `versions`: every build we hold by versionCode and versionName, highest code first — the cheap way to check for updates before calling list_versions or get_download_url. Send every package you are checking in one call rather than looping. Each lands in one of three lists: `items` for packages we know (`available` false when we hold no build), `notFound` for ones we have never seen, and `refused` for ones we will not serve at all, with the reason a download would give. Input parameters: - `packageNames` (array, required): Android package ids, 1–100. Output parameters: - `items` (array): Packages we know, in the order sent — `available` false when we hold no build. - `notFound` (array): Ids with no row in the catalogue. - `refused` (array): Packages we will not serve at all, with the reason a download would give. ### `list_versions` (~122 tokens) List downloadable versions Every APK/XAPK build held for a package, newest first, each with its SHA-256. Call this before get_download_url when you want a specific build — the apkId it returns is what that tool takes; without one it serves the newest. Free when we hold no builds for the package (an empty list); request_fetch is how to get the app. A package we will not serve at all is refused here with the same reason a download would give, so you learn it without spending a download. Input parameters: - `packageName` (string, required): Android package id. Output parameters: - `appName` (string|null): The app's display name. Null only when we have no row for the package. - `packageName` (string): The package these builds belong to. - `versions` (array) ### `get_download_url` (~185 tokens) Get a download URL Mint a short-lived signed URL for one build — the newest held unless you pass an apkId from list_versions. Costs 10 credits — the most expensive call here, and the only one that hands over a file. Check get_version_security before handing anything to a person. The URL expires in about 5 minutes; fetch it promptly and do not store it. The response carries the file's `sha256` — verify what you downloaded against it, because the signature is on the URL and not on the bytes. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. - `variantId` (string): Optional: an on-demand variant build of that release, from get_variant_status. It is served under the ordinary build's checks; omit it for the ordinary build. Output parameters: - `apkId` (string): The artifact that was minted. - `appName` (string): The app's display name. - `expiresAt` (string): When `url` stops working. - `fileSize` (integer): Bytes. - `format` (string): 'apk', 'xapk' or 'apks' — the container `url` serves. - `packageName` (string): Package this file belongs to. - `sha256` (string): SHA-256 of the file this URL serves, lowercase hex. Verify the download against it. - `url` (string): Signed URL, valid about 5 minutes. Fetch it before it expires. - `variantId` (string): Present when an on-demand variant build was minted; `fileSize` and `sha256` are then the variant's. - `versionCode` (integer): Build number of the minted build. - `versionName` (string): Version string of the minted build. ### `request_fetch` (~183 tokens) Fetch a missing app Ask us to download an app from Google Play when list_versions came back empty. Costs 10 credits, even when we already have builds (`READY`) or Google Play doesn't list the app — so call list_versions first. Free only when a fetch for the app is already running (`FETCHING`). A fetch usually takes a few minutes. Poll get_fetch_status every 10–30 seconds — not this tool — and call list_versions once it says READY. Paid apps and apps Google Play will not deliver to us are refused with the reason. An app not in the catalogue yet is looked up on Google Play live, for up to 20 seconds; UPSTREAM_UNAVAILABLE / UPSTREAM_BUSY then is refunded and means Play did not answer in time, not that the app does not exist — retry after a few seconds. Input parameters: - `packageName` (string, required): Android package id. Output parameters: - `error` (string): FAILED only: why, in words safe to show a person. - `packageName` (string): The package this fetch is for. - `status` (string): READY: we hold builds — list the versions. FETCHING: a job is queued or running; poll again in a few seconds. FAILED: the last job failed; see `error`. - `terminal` (boolean): FAILED only, and present only when retrying cannot help: Google Play will not deliver this app to us. Absent means another fetch request may succeed. - `updatedAt` (string): Status read only: when the job last moved. ### `get_fetch_status` (~114 tokens) Check a fetch Where the fetch request_fetch started stands now: FETCHING (keep waiting), READY (call list_versions), or FAILED with a reason. Free when the fetch is still running (`FETCHING`); the final answer costs 1 credit, and so does a check when no fetch was requested (`FETCH_NOT_FOUND`). When FAILED carries `terminal: true`, Google Play will not deliver this app to us and asking again will not help; otherwise request_fetch may be retried. Input parameters: - `packageName` (string, required): Android package id. Output parameters: - `error` (string): FAILED only: why, in words safe to show a person. - `packageName` (string): The package this fetch is for. - `status` (string): READY: we hold builds — list the versions. FETCHING: a job is queued or running; poll again in a few seconds. FAILED: the last job failed; see `error`. - `terminal` (boolean): FAILED only, and present only when retrying cannot help: Google Play will not deliver this app to us. Absent means another fetch request may succeed. - `updatedAt` (string): Status read only: when the job last moved. ### `request_variant` (~624 tokens) Request a variant build Ask for an on-demand build of an app's newest release that the ordinary download does not carry: every language (`+all-langs`), the 32-bit ARM build (`armeabi-v7a`), both ARM ABIs in one bundle (`universal`), the newest build for an older Android version (`@sdkNN`), or exactly what one real device gets (`device:`). We must already hold the ordinary build — call list_versions first, and request_fetch if it is empty. Costs 10 credits, even when the variant is already built (`READY`); free only when a build of that variant is already running (`FETCHING`). A build usually takes a few minutes: poll get_variant_status, not this tool, then pass its `variantId` to get_download_url. Builds are temporary — see `expiresAt`. Input parameters: - `packageName` (string, required): Android package id. - `variant` (string, required): Which build: `[+all-langs][@sdkNN|@vcN]` with arch one of arm64-v8a, armeabi-v7a, universal, or `device:[+all-langs]`. Plain `arm64-v8a` is the ordinary build and not a variant. `+all-lan… Output parameters: - `build` (object) - `error` (string): FAILED only: why, in words safe to show a person. - `packageName` (string): The package. - `status` (string): READY: `build` is live — mint it. FETCHING: being built; poll again in 10–30 seconds. FAILED: the last build failed, see `error`; requesting again retries. NEEDS_FETCH (status only): nobody has asked… - `variant` (string): The variant asked about. ### `get_variant_status` (~553 tokens) Check a variant build Where one variant of an app stands: READY with the build (its `variantId` goes to get_download_url), FETCHING (keep waiting, 10–30 seconds between checks), FAILED with a reason (request_variant retries), or NEEDS_FETCH (nobody has asked for it, or it expired — call request_variant). Free when the build is still running (`FETCHING`); any other answer costs 1 credit, including when nobody has requested that variant (`NEEDS_FETCH`). Input parameters: - `packageName` (string, required): Android package id. - `variant` (string, required): Which build: `[+all-langs][@sdkNN|@vcN]` with arch one of arm64-v8a, armeabi-v7a, universal, or `device:[+all-langs]`. Plain `arm64-v8a` is the ordinary build and not a variant. `+all-lan… Output parameters: - `build` (object) - `error` (string): FAILED only: why, in words safe to show a person. - `packageName` (string): The package. - `status` (string): READY: `build` is live — mint it. FETCHING: being built; poll again in 10–30 seconds. FAILED: the last build failed, see `error`; requesting again retries. NEEDS_FETCH (status only): nobody has asked… - `variant` (string): The variant asked about. ### `list_developer_apps` (~88 tokens) List a publisher's apps Every app we hold from one publisher, most-installed first. The slug comes from `developerSlug` on any app row. Input parameters: - `page` (integer): 1-based page. Defaults to 1. - `per` (integer): Rows per page, 1–96. Defaults to 24. - `slug` (string, required): Publisher slug, from an app's developerSlug field. Output parameters: - `developer` (object) - `items` (array) - `page` (integer): 1-based page number of this result. - `perPage` (integer): Rows per page. - `total` (integer): Total matching rows across all pages. - `totalPages` (integer): Number of pages available. ### `list_categories` (~25 tokens) List categories The category taxonomy, for filtering a search. Free — this call costs no credits. Output parameters: - `categories` (array) ### `list_chart` (~182 tokens) List a chart A ranked section of the catalogue. Google Play's charts (hot, grossing, latest, editors-choice), the catalogue's newest releases (new), what people downloaded here in about the last day (popular), or the newest builds we stored (updated). An unrecognised section falls back to 'hot' rather than failing. Input parameters: - `limit` (integer): Rows to return, 1–50. Defaults to 24. - `section` (string): Which chart. hot, grossing, latest and editors-choice are Google Play's charts; new is the catalogue's newest releases; popular is what people downloaded here in about the last day; updated is the ne… - `type` (string): Restrict to games or apps. Ignored by `popular`, which is one mixed list. Output parameters: - `items` (array) - `section` (string): The chart that was returned. ### `list_similar_apps` (~92 tokens) List similar apps Apps related to one package — alternatives and neighbours, as the app's page on the site shows them. Free when there is nothing to list (an empty `items`). A package that is not in the catalogue is a 404 rather than a guess. Input parameters: - `limit` (integer): Rows to return, 1–24. Defaults to 8. - `packageName` (string, required): Android package id. Output parameters: - `items` (array) - `packageName` (string): The package these are related to. ### `get_play_details` (~207 tokens) Get the Google Play listing Google Play's full store listing for one package, in any storefront: the star histogram, install estimate, IAP price range, release date, declared permissions, content-rating descriptors, legal publisher and contact details — the store data get_app leaves out. Usually null: the written-review count, sale pricing and the Play Pass and pre-registration flags. Pass `lang`/`country` for another storefront (prices, text and availability differ); the default en/us listing is served from our own scrape while it is fresh and scraped and stored otherwise. Works for packages outside the catalogue. Charged even when Google Play doesn't list the app (`APP_NOT_FOUND`); a busy or failed Google Play is refunded. Input parameters: - `country` (string): Two-letter storefront country, e.g. us, jp. Defaults to us. - `lang` (string): Language code, e.g. en, ja, pt-BR. Defaults to en. - `packageName` (string, required): Android package id. Output parameters: - `contentRating` (string|null): E.g. 'Teen'. - `contentRatingDescription` (string|null): E.g. 'Mild Violence'. - `country` (string): Storefront country the listing was read from. - `developer` (object) - `fetchedAt` (string): When Google Play produced this listing, ISO 8601. - `genre` (string|null): Store genre label, e.g. 'Strategy'. - `genreId` (string|null): Store genre id, e.g. 'GAME_STRATEGY'. - `installs` (object) - `lang` (string): Language the listing was read in. - `minAndroidVersion` (string|null): Machine form, e.g. '5.0' or 'VARY'. - `minAndroidVersionText` (string|null): Store sentence, e.g. '5.0 and up'. - `packageName` (string): The package. - `permissions` (array|null): Permissions as the store lists them. Null when this listing's source does not publish them — the per-build manifest has the authoritative list. - `pricing` (object) - `privacyPolicyUrl` (string|null): Privacy policy link. - `rating` (object) - `recentChanges` (string|null): What's new. - `released` (string|null): First publication, as the store prints it. - `source` (string): `catalog`: the stored en/us listing, at most a day old. `live`: asked of Google Play for this call or a recent one. - `summary` (string|null): Short promo text. - `title` (string): Store title. - `updatedAt` (string|null): Last update, ISO 8601. - `url` (string|null): The store page. - `version` (string|null): Current version name. ### `list_reviews` (~245 tokens) List Google Play reviews One page of Google Play user reviews for a package, live: stars, text, helpful votes, the app version the reviewer ran, and the developer's reply. Sort by newest (default), rating or helpfulness; up to 100 a page. Walk further pages by passing `nextCursor` back as `cursor` with the same sort, num and storefront — each page is a separate charge, so ask for what you need. Free when the page is empty (an empty `items`); a busy or failed Google Play is refunded. Input parameters: - `country` (string): Two-letter storefront country, e.g. us, jp. Defaults to us. - `cursor` (string): `nextCursor` from the previous page. Omit for the first page; keep sort, num and the storefront the same while walking. - `lang` (string): Language code, e.g. en, ja, pt-BR. Defaults to en. - `num` (integer): Reviews per page, 1–100. Defaults to 40. - `packageName` (string, required): Android package id. - `sort` (string): newest (default), rating, or helpfulness. Output parameters: - `country` (string): Storefront country. - `fetchedAt` (string): When Google Play produced this page, ISO 8601. - `items` (array) - `lang` (string): Language the reviews were read in. - `nextCursor` (string|null): Pass back as `cursor` for the next page, with the same sort, num and storefront. Null at the end. - `packageName` (string): The package. - `sort` (string): Order of `items`. ### `get_version_security` (~260 tokens) Check a build's integrity What one build actually IS: its SHA-256, the anti-malware verdict, the certificates that signed it, and every Android permission it declares with a plain-English gloss. Defaults to the newest build, so you do not need list_versions first. `findings` is the part to read first: it applies our rules to the manifest and native facts on the same response and names what they imply — a debuggable build, a version that disagrees with the listing, cleartext traffic, components any app on the device can start, a packer. Two severities, `warning` and `notice`, and NEITHER is a verdict; an empty `findings` is not an all-clear, because a manifest nobody read produces no findings either. Read this BEFORE recommending an install, and read the nulls carefully — `scanned: false` and `virusTotal: null` mean nobody has looked, which is not the same as clean, and `permissions: null` means the manifest was never read, which is not the same as an app that asks for nothing. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `apkId` (string): The build this describes — the one asked for, or the newest held. - `findings` (array): What manifest and natives already imply, read for a caller who should not have to know Android to notice it. EMPTY IS NOT AN ALL-CLEAR: absence is never a finding, so an empty array also covers the c… - `manifest` (object|null): What the artifact's own AndroidManifest.xml declares beyond the permissions it requests: targetSdk, compileSdk, debuggable, usesCleartextTraffic, allowBackup, sharedUserId, installLocation, the permi… - `md5` (string|null): MD5 of the artifact, computed at ingest. Null on builds ingested before it was computed — never a claim the file has no MD5. - `natives` (object|null): Native libraries the artifact ships: abis, libs (name, largest uncompressed size, the ABIs carrying it) and protectors. NULL means the archive's directory could not be read; empty lists are the factu… - `packageName` (string): The package asked for. - `pairip` (boolean): Google PairIP licence protection, which breaks a plain sideload. The same signal reaches natives.protectors as the id 'pairip' when the native walk ran; this field is the scan's own boolean and answe… - `permissionSummary` (string|null): '24 declared · 5 sensitive'. Null whenever `permissions` is. - `permissions` (array|null): NULL means the manifest was never read — not that the app declares none. An empty array is the genuine 'declares none'. - `scanned` (boolean): Something has analysed this artifact. When false, every field below is null or zero and NONE of it means 'clean'. - `scannedAt` (string|null): When the analysis ran, ISO 8601. - `sha1` (string|null): SHA-1 of the artifact, when one was reported. Computed at ingest where available, else taken from the VirusTotal report. An identifier for matching a published IOC — sha256 is the integrity check. - `sha256` (string): SHA-256 of the artifact. The same value the version list and the download call publish. - `signature` (object|null): Signature validation. Null when that stage did not run. - `verdict` (string): Our overall reading of the artifact. - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. - `virusTotal` (object|null): Anti-malware analysis for this hash. NULL means nobody has looked — only a non-null object with flagged: 0 is an all-clear. ### `list_sdks` (~244 tokens) List a build's third-party SDKs What OTHER companies' code is inside an app: the ad, analytics, attribution, crash-reporting, push and sign-in libraries matched in the build, each with its vendor and where it was recognised. Defaults to the newest build. This is the privacy question, not the safety one — these libraries are ordinary parts of shipping an app, so report them as what the app carries and never as evidence of harm. READ THE BOUNDS BEFORE THE LIST: `analyzed: false` means nobody looked; `codeCoverage` says whether the app's own code was read at all, and in full; a non-empty `protectors` means the build is packed and its real code was never open to inspection. An empty `sdks` is only close to 'none' when `analyzed` is true and `codeCoverage` is `full`. Relay `summary` whole — it states the finding and its bound in one sentence, and dropping the second half is the standard way to get this wrong. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `analyzed` (boolean): Was this build's evidence ever collected? FALSE means nobody looked, and the empty list beside it says nothing about the app. TRUE with an empty list is the factual 'we looked and recognised none' —… - `apkId` (string): The build this describes — the one asked for, or the newest held. - `byCategory` (array): Counts per category, same order. Empty when sdks is. - `capped` (array): Evidence tiers that hit their size cap while the artifact was being read, so the analysis worked from a subset of what the file carries. The one bound no later corpus can repair — fixing it needs the… - `codeCoverage` (string): How far the analysis reached into the app's OWN code: none — only the manifest and bundled libraries were read; partial — the code was read but not through; full — read through. Only 'full' makes an… - `complete` (boolean): The answer is bounded by none of the above: code read through, nothing capped, no protector. FALSE is the normal case and is not an error — it means this list is a floor, not a census. - `dex` (object|null): How much code was read, when any was: read of total dex files, bytes, and truncated (one file ran out of budget part-way). NULL when none was read. - `packageName` (string): The package asked for. - `protectors` (array): Commercial protectors on the build, by product name. NOT a malware signal — anti-piracy and anti-tamper are what they are sold for, Google's PairIP included — but a packed app's real code is not in c… - `rules` (string|null): The corpus version that answered THIS request. Matching runs at read time against stored evidence, so two calls either side of a deploy may legitimately name a library the earlier one could not: the… - `sdks` (array): Ordered by category (advertising first, unclassified last), then name. - `sources` (array): Evidence classes actually SEARCHED — manifest, natives, dex — not what was found. Empty when analyzed is false. This is the field that separates 'we looked and found nothing' from 'we never looked'. - `summary` (string): One sentence stating the finding AND its bound. Relay both halves: 'none found' without 'and the code was not read' is the misreading this whole shape exists to prevent. - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. ### `get_protection` (~248 tokens) Check whether a build is packed Whether this build is wrapped in a commercial protector — DexProtector, Jiagu, Bangcle, Legu, AppSealing, Google's own PairIP — and what that means for everything else you can find out about it. Defaults to the newest build. A PROTECTOR IS NOT A MALWARE SIGNAL: anti-piracy, anti-tamper and anti-cheat are what these are sold for, and saying an app is 'suspicious' because it is packed is wrong about a large part of the catalogue. What it does mean is that the app's real code is not in classes.dex for anyone to read, so an empty SDK list, a short permission list or any other analysis of the same artifact is a floor and not a census — call this BEFORE you report that a build carries no trackers. `analyzed: false` means the archive was never opened, which is not the same as an unpacked build. Relay `summary` whole: it carries the finding and the bound in one sentence. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `analyzed` (boolean): Was the artifact ever opened? FALSE means every field below is a default and none of them is a finding. - `apkId` (string): The build this describes — the one asked for, or the newest held. - `capped` (array): Evidence tiers that hit their size cap while the artifact was being read, so the analysis worked from a subset of what the file carries. The one bound no later corpus can repair — fixing it needs the… - `codeCoverage` (string): How far the analysis reached into the app's OWN code: none — only the manifest and bundled libraries were read; partial — the code was read but not through; full — read through. Only 'full' makes an… - `dex` (object|null): How much code was read, when any was: read of total dex files, bytes, and truncated (one file ran out of budget part-way). NULL when none was read. - `packageName` (string): The package asked for. - `pairip` (boolean): Google PairIP licence protection specifically. Beyond packing, it checks the app's licence at run time, so a plain sideload of the file may refuse to run. - `protected` (boolean): At least one commercial protector was identified. FALSE with analyzed:false above it means nobody looked — not that the build is unpacked. - `protectors` (array): What was identified. NOT a malware signal — anti-piracy and anti-tamper are what these are sold for, Google's own PairIP included. What it does mean is that the app's real code is not in classes.dex… - `summary` (string): One sentence carrying both halves — what was found, and what it bounds. Relay it whole: 'packed with Jiagu' on its own turns a build-tool choice into an accusation, and the second clause is the part… - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. ### `list_trackers` (~257 tokens) List a build's tracking and advertising SDKs The privacy question on its own: which advertising, analytics, install-attribution, crash-reporting, push and social sign-in SDKs are in this build, and nothing else. `list_sdks` is the same evidence unfiltered — every recognised library including HTTP clients and UI toolkits — so use that one when you want the full inventory and this one when somebody asked what an app sends about them. A CATEGORY IS NOT AN ACCUSATION: all six are ordinary parts of shipping an app, and `unclassified` counts recognised libraries that are neither (unclassified means we take no position, never that a library is harmless). READ THE BOUNDS BEFORE THE LIST: `analyzed: false` means nobody looked; `codeCoverage` says whether the app's own code was read at all and in full; a non-empty `protectors` means the real code was never readable, and an empty list under one says nothing about the app. Relay `summary` whole — 'no trackers found' without its second clause is the standard way to get this wrong. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `analyzed` (boolean): Was this build's evidence ever collected? FALSE means nobody looked, and the empty list beside it says nothing about the app. TRUE with an empty list is the factual 'we looked and recognised none' —… - `apkId` (string): The build this describes — the one asked for, or the newest held. - `byCategory` (array): Counts per category, same order. Empty when the list is. - `capped` (array): Evidence tiers that hit their size cap while the artifact was being read, so the analysis worked from a subset of what the file carries. The one bound no later corpus can repair — fixing it needs the… - `codeCoverage` (string): How far the analysis reached into the app's OWN code: none — only the manifest and bundled libraries were read; partial — the code was read but not through; full — read through. Only 'full' makes an… - `complete` (boolean): The answer is bounded by none of the above: code read through, nothing capped, no protector. FALSE is the normal case and is not an error — it means this list is a floor, not a census. - `dex` (object|null): How much code was read, when any was: read of total dex files, bytes, and truncated (one file ran out of budget part-way). NULL when none was read. - `packageName` (string): The package asked for. - `protectors` (array): Commercial protectors on the build, by product name. NOT a malware signal — anti-piracy and anti-tamper are what they are sold for, Google's PairIP included — but a packed app's real code is not in c… - `rules` (string|null): The corpus version that answered THIS request. Matching runs at read time against stored evidence, so two calls either side of a deploy may legitimately name a library the earlier one could not: the… - `sources` (array): Evidence classes actually SEARCHED — manifest, natives, dex — not what was found. Empty when analyzed is false. This is the field that separates 'we looked and found nothing' from 'we never looked'. - `summary` (string): One sentence stating the finding AND its bound. Relay both halves: 'no trackers found' without 'and the code was not read' is the misreading this shape exists to prevent, and on a packed build it is… - `total` (integer): Classified libraries found — the number to quote. - `trackers` (array): Classified libraries only — advertising, analytics, install attribution, crash reporting, push messaging, social sign-in. Ordered by category, then name. - `unclassified` (integer): Recognised libraries we do NOT classify as trackers: HTTP clients, UI toolkits, anything with nothing to classify. Counted rather than listed, so the difference from the SDK inventory's total is visi… - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. ### `list_permissions` (~191 tokens) List what a build asks the device for Every Android permission this build declares, sensitive ones first, each with a readable label, its capability family and a sentence saying what the app can actually do with it. Defaults to the newest build. This is the same labelling compare_versions diffs, so the two cannot name the same permission differently. THE NULL IS THE PART TO READ: `permissions: null` means the manifest was never read and is NOT a claim that the app asks for nothing — an empty array is that claim. `sensitive` is the count worth quoting; a long list of ordinary permissions is what almost every app looks like. `defines` is separate and often misread: those are permissions this app declares for OTHER apps to hold, not things it is asking for. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `apkId` (string): The build this describes — the one asked for, or the newest held. - `byCategory` (array): Counts by capability family, most-declared first, each with how many of its names are sensitive — a family of eleven with none sensitive is a different shape of app from two that are both dangerous. - `declared` (integer|null): How many. Null when permissions is. - `defines` (array): Permissions this app DEFINES for other apps to hold — a different thing from the ones it requests. Empty when it defines none, and also empty when no manifest was read: permissions:null is how to tel… - `packageName` (string): The package asked for. - `permissions` (array|null): Sensitive first, then by label. NULL means the manifest was never read — NOT that the app declares none. An empty array is the genuine 'declares none', and the two are opposite answers to the only qu… - `sensitive` (integer|null): Of those, how many are Android-dangerous or special-access. This is the number worth reading. - `summary` (string|null): '24 declared · 5 sensitive'. Null whenever permissions is. - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. ### `get_manifest` (~226 tokens) Read what a build declares about itself What the artifact's own AndroidManifest.xml says beyond the permissions it requests — targetSdk, compileSdk, debuggable, cleartext traffic, backup, sharedUserId, install location, uses-feature, uses-library, and the components it exports without a permission guard — plus the native libraries it ships, and our rules read off the pair as `findings`. Defaults to the newest build. A KEY ABSENT INSIDE `manifest` means the manifest is silent about that attribute, never that it declares the platform default; `manifest: null` means nobody read it at all, and an empty `findings` beside that is not an all-clear. `versionMismatch` is the one to escalate: non-null means the file's own version disagrees with what the listing claims, which is what a swapped or relabelled artifact looks like. Use get_raw_scan if you want the stored record without our rules applied. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `apkId` (string): The build this describes — the one asked for, or the newest held. - `findings` (array): Our rules read off the two fields above, warnings first. Empty is NOT an all-clear: absence is never a finding, so a manifest nobody read produces none either — manifest:null beside it is how to tell. - `manifest` (object|null): What AndroidManifest.xml declares beyond the permissions it requests: targetSdk, compileSdk, debuggable, usesCleartextTraffic, allowBackup, sharedUserId, installLocation, definesPermissions, usesFeat… - `natives` (object|null): Native libraries the artifact ships: abis, libs (name, largest uncompressed size, the abis carrying it) and protectors. NULL = the archive directory could not be read; empty lists are the factual 'sh… - `packageName` (string): The package asked for. - `versionCode` (integer): Its build number. - `versionMismatch` (object|null): The artifact's own version against what the listing claimed for it, as {claimed, actual}. Non-null means the bytes are not the build the listing describes — a swapped or relabelled artifact — and it… - `versionName` (string): Version name of that build. ### `get_raw_scan` (~204 tokens) Read the stored scan record verbatim The whole stored analysis record for one build, exactly as stored and with none of our rules applied — for when you want to judge the facts yourself rather than read our conclusions. It carries two things no other tool publishes: the EVIDENCE DIGEST every SDK match is drawn from (dex package prefixes, manifest component names, intent actions, how much code was read), so you can match it against your own corpus; and each signing certificate's serial and signature algorithm. Also the raw VirusTotal counters and every flagging vendor. Prefer the narrower tools when you want an answer — get_version_security, get_protection, list_trackers, list_permissions, get_manifest — and reach for this when you want the inputs. A build nobody has scanned is `scanned: false`, which is not a clean result. Input parameters: - `apkId` (string): A specific build from list_versions. Omit for the newest one. - `packageName` (string, required): Android package id. Output parameters: - `apkId` (string): The build this describes — the one asked for, or the newest held. - `certs` (array): Every signer certificate found, with the full X.509 detail — including the serial and the certificate's own signature algorithm, which the projected signer shape does not carry. Empty on scans that p… - `evidence` (object|null): What the scan SAW, with no judgement in it: dex package prefixes truncated at `depth`, manifest component class names, intent actions, how much code was read, and which tiers were capped. Every SDK m… - `evidenceVersion` (integer|null): Which digest schema produced `evidence`. - `manifest` (object|null): The manifest facts as stored. Same object the manifest endpoint publishes. - `md5` (string|null): MD5 of the same artifact. An identifier for matching a published IOC, never an integrity check. - `natives` (object|null): The native inventory as stored: abis, libs, protectors. - `packageName` (string): The package asked for. - `pairip` (boolean|null): Google PairIP detected. NULL = not reported by the engine that scanned this. - `permissions` (array|null): Raw manifest permission names, unlabelled and in the manifest's own order. NULL = the manifest was never read; [] = it declares none. - `scanned` (boolean): A scan record exists. FALSE and everything below is null or empty — none of which means clean. - `scannedAt` (string|null): ISO 8601. - `sha1` (string|null): SHA-1 of the same artifact, ours where we computed one, else VirusTotal's. - `sha256` (string): The artifact's SHA-256, from the version row — the bytes a download serves. - `signature` (object): The legacy single-signer columns, kept because scans predating multi-signature support have these and an empty `certs`. - `status` (string|null): Queue state of the record: PENDING | ACTIVE | COMPLETED | FAILED. Only COMPLETED is a finished analysis; FAILED is one that will not finish, and its stored facts are whatever completed before it stop… - `verdict` (string|null): Our classification, as stored: verified | secure | caution | dangerous | unverified | pending. - `versionCode` (integer): Its build number. - `versionName` (string): Version name of that build. - `virusTotal` (object): The counters verbatim, every vendor that flagged the file, and the submission context. found:false means VirusTotal had no report for this hash, which is not a clean result. ### `lookup_hash` (~247 tokens) Identify a file by its checksum Which app and which build a file checksum names. Use this when you have a hash and no package name — an APK pulled off a device, a sample from a threat feed, a digest in an incident report. Takes an MD5 (32 hex), SHA-1 (40) or SHA-256 (64) and works out which from the length, so do not try to label it; colons, spaces and upper case are fine and are normalised. A miss is a real answer, not an error, and it is free when nothing matches (`found: false`): we hold no build with that checksum, and says nothing about whether the file exists elsewhere. READ `note`: only SHA-256 is carried by every stored build, so a SHA-1 or MD5 miss can mean we hold the file and never computed that digest for it — re-check with the SHA-256 if you have it. Once you have the packageName and apkId, the per-build tools will tell you what the file is. Input parameters: - `hash` (string, required): An MD5, SHA-1 or SHA-256 hex digest of the file. The algorithm is taken from its length. Output parameters: - `algorithm` (string): Inferred from the value's own length. Not a parameter you send. - `found` (boolean): We hold a build with this checksum. FALSE is a complete answer and a 200 — it says nothing about whether the file exists anywhere else. - `hash` (string): The hash as matched: lowercase hex, separators stripped. - `match` (object|null): The build, when found: packageName, appName, apkId (the id every per-build call takes), versionName, versionCode, arch, format, fileSize in bytes, sha256, isLatest and uploadedAt. - `note` (string): What a miss does and does not prove for THIS algorithm. Only SHA-256 is carried by every stored build, so a SHA-1 or MD5 miss can mean we hold the file and never computed that digest for it. ### `lookup_certificate` (~329 tokens) Find what a signing key signs Every package we hold that one signing certificate is on record for. Android only installs an update signed by the key that signed what is already on the device, which makes the signing key the closest thing an app has to an identity across package names — so a key you found on one repackaged app is worth asking about, because it has usually signed others. Takes the SHA-256 fingerprint of the DER certificate (64 hex, colons and case fine). A SHA-1 IS REFUSED, free, with the reason: the record stores one fingerprint per certificate and a SHA-1 cannot be resolved to it — get the SHA-256 (keytool prints both). BOUNDED, and `note` says how: it covers packages we have ingested and scanned, never every app the key has signed, so it is free when we hold nothing signed by the key (`total: 0`), which is not to say the key signs nothing; charged even when every package the key signed has been removed (an empty `items`). `blocked: true` means the key is on our catalogue-wide blocklist and nothing it signed can be downloaded here. Taken-down packages are counted in `blockedCount` and not listed, so a page may be shorter than `perPage`. Input parameters: - `fingerprint` (string, required): SHA-256 fingerprint of the signing certificate, 64 hex characters, with or without colons. - `page` (integer): 1-based page. Defaults to 1. - `per` (integer): Rows per page, 1–96. Defaults to 24. Output parameters: - `algorithm` (string): Always sha256. The per-package signing record stores that one fingerprint, and a SHA-1 cannot be resolved to it — sending one is refused with that reason, free. - `blocked` (boolean): This key is on the catalogue-wide signature blocklist: a download of anything it signed is refused whatever the anti-malware result said. - `blockedCount` (integer): Packages this key is on record for that are taken down. Counted across the whole key, not this page, and withheld from `items` — a lookup is not a way to read back what has been removed. - `fingerprint` (string): The fingerprint as matched: lowercase hex, no separators. - `items` (array): Newest record first. - `note` (string): What this answer is drawn from and therefore what it does not cover: the signing record we keep per package, so it covers packages we hold files for and have scanned — never every app the key has sig… - `page` (integer): 1-based page number of this result. - `perPage` (integer): Rows per page. - `subject` (string|null): Subject as recorded, e.g. 'CN=Example, O=Example Ltd'. - `total` (integer): Total matching rows across all pages. - `totalPages` (integer): Number of pages available. ### `list_developer_certificates` (~176 tokens) List a publisher's signing keys Every signing key on record for one publisher's apps — lookup_certificate read the other way round. Each key says how many of the publisher's apps it signs and, in `elsewhere`, how many packages OUTSIDE the publisher it is also on: zero is ordinary, above zero is a key shared across the publisher's accounts or somebody else's builds signed with it, and lookup_certificate on that fingerprint lists which. All keys in one answer, no pages. BOUNDED, and `note` says how: it covers the publisher's apps we have ingested and scanned. Free when we hold no signing record for any of the publisher's apps (`total: 0`). The slug comes from `developerSlug` on any app row. Input parameters: - `slug` (string, required): Publisher slug, from an app's developerSlug field. Output parameters: - `developer` (object) - `items` (array): The key on the most apps first. - `note` (string): What this answer is drawn from and therefore what it does not cover: the signing record we keep per package, so it covers this publisher's apps we hold files for and have scanned, and `elsewhere` cou… - `total` (integer): Keys in `items`. Every one — not paged; a publisher has a handful. ### `get_signing_history` (~119 tokens) Trace the signing key Which certificate signed which releases of a package, and where the key moved. Android will only install an update signed by the key that signed what is already on the device, so a `hasKeyReplacement: true` means the newer build is not an update of the older one — it is a different app under the same package name, which is what a repackaged app looks like. `unreadVersions` lists releases whose signature we never read; those are gaps, not agreement. Input parameters: - `packageName` (string, required): Android package id. Output parameters: - `eras` (array): Newest era first. - `hasKeyReplacement` (boolean): At least one era shares no key with the era before it. Android will not install such a build over the existing app, and a key that changed without a rotation is the strongest repackaging signal there… - `packageName` (string): The package this timeline covers. - `signers` (array): Certificates on record for the package. - `summary` (string): One sentence naming what the timeline shows. - `unreadVersions` (array): Releases whose signing block was never read. A gap in coverage, published as a gap so it is not mistaken for agreement. ### `compare_versions` (~138 tokens) Compare two builds What changed between two releases: permissions gained and lost, whether the signing key moved, size and minimum Android. Name either side by version name or by version code — the code is tried first, because a version name is free text the developer sets and is often a placeholder. Order does not matter; the higher build number is treated as the newer. Check `permissionsKnown` before reading two empty permission lists as 'nothing changed'. Input parameters: - `from` (string, required): One release, by version name or version code. - `packageName` (string, required): Android package id. - `to` (string, required): The other release, by version name or version code. Output parameters: - `minSdk` (object|null): Minimum Android API level move, when both sides are known and differ. - `newCertShas` (array): Certificates signing the newer release but not the older one. - `noteworthy` (boolean): Worth a human's attention: a permission was gained, or the signer moved. - `packageName` (string): The package compared. - `permissionsAdded` (array) - `permissionsKnown` (boolean): Both releases had their manifests read. When FALSE the permission arrays are empty because we could not look, not because nothing moved. - `permissionsRemoved` (array) - `previousVersion` (string): The older of the two. - `signerChange` (string|null): 'same', 'added', 'narrowed', 'changed' or 'replaced'; null when either side's signature was never extracted. - `signerChangeDetail` (string|null): What it means for whoever installs the build. - `signerChangeLabel` (string|null): Short reading of `signerChange`. - `size` (object|null): Byte delta for one arch present in both releases. Null when they share none — comparing across differing split sets would report a change that is only a change in what we store. - `version` (string): The newer of the two, whichever order they were asked for in. ### `get_apps` (~134 tokens) Look up several apps Summary rows for up to 100 package ids in one call — use this instead of calling get_app in a loop. Costs 1 credit PER PACKAGE, so a hundred ids cost a hundred credits however they arrive. Ids we do not hold come back in `notFound` rather than failing the call. Returns the SUMMARY row, not the full record: it is cheaper than get_app (5) because it answers less, so reach for get_app only when you need the description or the screenshots for a particular one. Input parameters: - `packageNames` (array, required): Android package ids, 1–100. Charged per id. Output parameters: - `items` (array) - `notFound` (array): Ids with no row in the catalogue. ### `get_account` (~76 tokens) Check credits How many credits are left on the key you are using, and what that key is. Free. Every successful call also reports this in `_meta`, so reach for this one when you need to know before you spend — a download costs 10 — or when your calls have been failing and you have not seen a balance in a while. Output parameters: - `credits` (integer): Credits left on the account this key bills to, after this call. - `keyId` (string): Id of the credential that made this call, as `:` — `key:` for an API key, `oauth:` for an MCP client's OAuth grant. Treat it as an opaque string: it identifies the credential, not the accou… - `memberSince` (string): When the account was created. ### `console_list_apps` (~72 tokens) List my apps (Developers Console) The apps you manage in the APKCube Developers Console — every app of every developer whose team you are on, 50 a page, with your role on each. Only works for a signed-in user (OAuth) on a verified developer's team. Free. Input parameters: - `page` (integer): 1-based page. Output parameters: - `items` (array) - `page` (integer): This page. - `perPage` (integer): Page size. - `total` (integer): Apps across all your teams. ### `console_app_stats` (~88 tokens) Download stats for my app Downloads of one of your apps: per UTC day for the last 30 days (with the 30 before for comparison), the lifetime total, and the top countries of the last 7 days. Counts come from our own download log, not Google Play. Free. Input parameters: - `packageName` (string, required): Package id of an app on your Developers Console team, e.g. com.example.app. Output parameters: - `countries` (object) - `last30` (integer): Downloads in the last 30 days. - `lifetime` (integer): All-time downloads. - `packageName` (string): The app. - `perDay` (array) - `previous30` (integer): Downloads in the 30 days before that. ### `console_list_uploads` (~85 tokens) List my uploaded builds Builds submitted for your apps from the console or the Publishing API, newest first, with each one's status (uploading, verifying, scanning, held, published, rejected …) and, for a held or rejected build, the reason and its stable code. Pass packageName for one app. Free. Input parameters: - `packageName` (string): Optional: only this app's uploads. Output parameters: - `items` (array) - `total` (integer): Uploads matched. ### `console_upload_status` (~87 tokens) Check one uploaded build Where one upload stands, with the scan summary once it has one (VirusTotal counts, signing certificates and how each compares with the keys on record). Poll every 15–30 seconds while status is verifying, scanning or publishing; `held` waits for a person and can take days. Free. Input parameters: - `uploadId` (integer, required): The upload's id, from console_list_uploads. Output parameters: - `scan` (object|null) - `upload` (object) ### `console_security_report` (~119 tokens) Security report for my app Every build we store for one of your apps with our scan verdict, VirusTotal counts, signature scheme, how its signing key compares with the keys on record, and any notice you have put on it — plus a one-line verdict on the signing history. `verdict: null` means not scanned, which is not the same as clean. The `apkId` here is what console_set_version_notice takes. Free. Input parameters: - `packageName` (string, required): Package id of an app on your Developers Console team, e.g. com.example.app. Output parameters: - `packageName` (string): The app. - `signing` (object|null) - `versions` (array) ### `console_update_listing` (~194 tokens) Edit my app's listing text Change the text visitors read on your app's page: the short description (≤80 characters), full description (≤4000, plain text), what's new (≤500) and a YouTube link. Omit a field to keep it; pass null or an empty string to show Google Play's text for it. Goes live immediately; our moderators review afterwards. Needs the admin or owner role. Name and icon cannot be changed. Input parameters: - `description` (string): Full description, plain text, up to 4000 characters. - `packageName` (string, required): Package id of an app on your Developers Console team, e.g. com.example.app. - `recentChanges` (string): What's new in the current release, up to 500 characters. - `summary` (string): Short description, up to 80 characters. - `videoUrl` (string): A youtube.com/watch?v= or youtu.be link. Output parameters: - `listing` (object) - `packageName` (string): The app. ### `console_set_version_notice` (~222 tokens) Pull a release of my app Put a warning on one stored build of your app — `vulnerable` or `withdrawn`, a message of up to 300 characters, and optionally the version code to use instead — or lift it (`lift: true`). With `blockDownload: true` downloads of that build are refused. Applies immediately and is reversible; it does not delete anything. Take `apkId` from console_security_report. Needs the uploader role or above. Input parameters: - `apkId` (string, required): The stored build's apkId, from console_security_report. - `blockDownload` (boolean): Also refuse downloads of this build. - `kind` (string): Why the build is pulled. - `lift` (boolean): True removes the notice; the fields below are ignored. - `message` (string): Shown to visitors, up to 300 characters. - `packageName` (string, required): Package id of an app on your Developers Console team, e.g. com.example.app. - `recommendedVersionCode` (integer): Optional: the version code visitors should take instead. Output parameters: - `apkId` (string): The build. - `lifted` (boolean) - `notice` (object|null) - `packageName` (string): The app. ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp#diagnostics ## Score history - 2026-11-05: 79 - 2026-11-04: 78 - 2026-11-03: 78 ## Common questions ### What is the APKCube MCP server? APKCube is an MCP server listed in the public MCP registry as com.apkcube/apkcube. Search Android apps, check APK signing and scans, and get verified APK download links. This page covers its hosted endpoint (https://apkcube.com/api/mcp). ### Is the APKCube MCP server safe to use? APKCube scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the APKCube MCP server expose? APKCube exposes 36 tools: search_apps, get_app, check_availability, list_versions, get_download_url, and 31 more. Their descriptions and schemas cost roughly 6,838 tokens of context every time the server is loaded. ### Does the APKCube MCP server require authentication? Yes. APKCube asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything. ### Is the APKCube MCP server still maintained? APKCube is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - Remote endpoint: https://apkcube.com/api/mcp - Website: https://apkcube.com/docs/mcp - Changelog RSS feed: https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp.json - HTML version of this page: https://verifymcp.io/servers/com-apkcube-apkcube/api-mcp