# PreviewAPK (mcpb · previewapk.mcpb)

Give your AI agent a real cloud Android phone: push APKs, drive it, get screenshots and logs.

- Trust score: 39/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `previewapk.siteport.site`: 33/100, [markdown](https://verifymcp.io/servers/livetaub-previewapk/previewapk-2.md), [page](https://verifymcp.io/servers/livetaub-previewapk/previewapk-2)
- mcpb · `previewapk.mcpb`: 39/100 (this document), [markdown](https://verifymcp.io/servers/livetaub-previewapk/previewapk.md), [page](https://verifymcp.io/servers/livetaub-previewapk/previewapk)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/livetaub/previewapk/releases/download/v1.1.1/previewapk.mcpb`
- Transport: `stdio`
- SHA-256: `c367eeb063e3f8afadfc8526c54f70ca7c240d6273bfbbee671049c35381d1c6`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3182 tokens (~117/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 77/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 31% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "previewapk_press_key" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the PreviewAPK MCP server?

PreviewAPK ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, c367eeb063e3f8afadfc8526c54f70ca7c240d6273bfbbee671049c35381d1c6; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/livetaub/previewapk/releases/download/v1.1.1/previewapk.mcpb`
- SHA-256: `c367eeb063e3f8afadfc8526c54f70ca7c240d6273bfbbee671049c35381d1c6`

### Verify on macOS / Linux

```bash
echo "c367eeb063e3f8afadfc8526c54f70ca7c240d6273bfbbee671049c35381d1c6  previewapk.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\previewapk.mcpb).Hash -eq "c367eeb063e3f8afadfc8526c54f70ca7c240d6273bfbbee671049c35381d1c6"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 39, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 38, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 37, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 36, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 35, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 34, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 33, +1)

- [security regression] Provenance: fail → unverified
- [security regression] Stability: 0.00 → unverified
- [functional regression] Schema quality: 68 → 77
- [functional regression] License: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 15% → 31%
- [functional] Licence: MIT

### 2026-10-22 (score 32)

First indexed and scored.

## MCP tools (27)

### `previewapk_list_devices` (~66 tokens)

List the devices on this account: name, id, profile, Android version, status, attached app. Call this FIRST when the account may have more than one device, then pass the chosen device's name (or id) as the 'device' argument to the other tools.

### `previewapk_use_device` (~79 tokens)

Select your working device — the 'cd' of PreviewAPK. After selecting, every other tool talks to this device until you select another or start one (starting also selects). Pass the device NAME (e.g. 'Device 1') or its id, from previewapk_list_devices.

Input parameters:

- `device` (string, required): device name or id

### `previewapk_status` (~107 tokens)

State of the owner's PreviewAPK device(s): attached app, session status, driver, links. Also carries the handoff block (a pending request for the human: reason + when), the agent's finish_report once filed, and — exactly once, on the first status read after the human hands the wheel back — handback_note + resumed:true: that is how you learn the handback happened, no chat message needed.

Input parameters:

- `device` (string): device name or id (optional)

### `previewapk_push_apk` (~181 tokens)

Upload an APK file from this machine to the device. If the device is OFF it becomes the attached app (then call previewapk_start). If the device is RUNNING and you hold the wheel, the new app is hot-swapped in live — installed and relaunched with no reboot. Returns the parsed app info (swapped=true on a hot swap; deduped=true when identical bytes were already stored). Installing an OLDER versionCode over the app in a live session is refused (version_downgrade) unless replace=true, which uninstalls the installed app first — its data is deleted.

Input parameters:

- `device` (string)
- `path` (string, required): local path to the .apk file
- `replace` (boolean): allow replacing a newer installed build with an older one (uninstalls first, deleting its data)

### `previewapk_start` (~80 tokens)

Start a preview session for the device's attached app. driver='agent': you drive and screenshot; the human watches. driver='user': the human drives in the portal; your input is refused. Returns links info — share the session_url from previewapk_get_links with the human.

Input parameters:

- `device` (string, required)
- `driver` (string)

### `previewapk_stop` (~61 tokens)

Stop the session. The session link dies with it. (previewapk_feedback files a field report about the tool — what broke, what worked, what you wish it had; reports directly shape what gets fixed and built next.)

Input parameters:

- `device` (string)

### `previewapk_get_links` (~56 tokens)

The share link for the live session (view-only; minted at start, dies when the session ends), plus driver state — including driver_note, which tells you if the user took the wheel.

Input parameters:

- `device` (string)

### `previewapk_tap` (~134 tokens)

Tap the screen. Either coordinates (0..1 fractions of the screen, resolution-independent) or a ref from previewapk_observe: pass ref + snapshot_id and the server re-finds that exact element on the current screen first — if it moved or changed, the call fails with stale_snapshot instead of tapping the wrong thing. Requires an agent-driven session.

Input parameters:

- `device` (string)
- `ref` (integer): element number from a previewapk_observe snapshot
- `snapshot_id` (string): the snapshot_id that ref belongs to
- `x` (number)
- `y` (number)

### `previewapk_swipe` (~86 tokens)

Swipe from (x1,y1) to (x2,y2), 0..1 fractions. duration_ms optional (default 300).

Input parameters:

- `device` (string)
- `duration_ms` (integer)
- `x1` (number, required)
- `x2` (number, required)
- `y1` (number, required)
- `y2` (number, required)

### `previewapk_press_key` (~57 tokens)

Send an Android keycode: 4=Back, 3=Home, 187=Recents, 66=Enter, 67=Delete.

Input parameters:

- `device` (string)
- `keycode` (integer, required)

### `previewapk_type_text` (~62 tokens)

Type text into the currently focused field on the device. The field must be focused first (tap it) — the call fails honestly when nothing is focused, instead of typing into the void.

Input parameters:

- `device` (string)
- `text` (string, required)

### `previewapk_relaunch` (~51 tokens)

Bring the session's app back to the foreground — after Back exits to the launcher, or the app crashed or was closed. Takes about 2 seconds; no reboot.

Input parameters:

- `device` (string)

### `previewapk_screenshot` (~93 tokens)

Capture the device's current screen as an image you can see (the real screen — it agrees with the hierarchy). Use it to verify your changes look right. The download resumes automatically if the connection is cut; pass scale=0.5 on weak networks for a quarter-size transfer.

Input parameters:

- `device` (string)
- `scale` (number): 0.5 = half-size frame (smaller transfer)

### `previewapk_handoff` (~61 tokens)

Pass the wheel mid-session: to='user' lets the human drive in the portal (e.g. after you've verified a feature); to='agent' gives control back to you.

Input parameters:

- `device` (string)
- `to` (string, required)

### `previewapk_get_logs` (~118 tokens)

Read the attached app's debug log (logcat) from this session — its prints, warnings, errors and crash traces. Check it after actions and whenever something misbehaves: a crash's exact reason is here. Works after the session ends too (the saved tail of the last session).

Input parameters:

- `contains` (string): only lines containing this text
- `device` (string)
- `errors_only` (boolean)
- `lines` (integer)
- `since_seconds` (number): only lines from the last N seconds

### `previewapk_feedback` (~164 tokens)

File a field report about THIS tool — you are one of the few who actually use it, and your report is read and tallied by the team that builds it. Say what broke or behaved unexpectedly (broke), what worked well (worked), what feature you wished it had for your task (wish), and anything you had to work around (workaround). One call, any subset of fields. File it before you stop the session, while the details are fresh — the wishes of working agents are the roadmap.

Input parameters:

- `broke` (string)
- `device` (string)
- `rating` (integer): overall reliability this session, 1-5
- `wish` (string)
- `workaround` (string)
- `worked` (string)

### `previewapk_hierarchy` (~85 tokens)

Get the current screen as a UI element tree (class, text, content-desc, resource id, bounds, center coordinates, state flags) instead of pixels. Much faster and cheaper than a screenshot for navigation and assertions: find elements, read values, check state. Use previewapk_screenshot for visual checks (layout, overlap, images).

Input parameters:

- `device` (string)

### `previewapk_tap_text` (~104 tokens)

Tap the element whose visible text matches (exact match preferred, else substring; use index to pick among matches). If several elements match at the same level and no index is given, the call returns an ambiguous_target result with the candidates instead of guessing. Resolves the element's center from the UI hierarchy — prefer this over coordinate taps whenever the target has text.

Input parameters:

- `device` (string)
- `index` (integer)
- `text` (string, required)

### `previewapk_observe` (~153 tokens)

Read the current screen as a compact numbered snapshot: foreground app, keyboard state, screen size, and the useful elements (ref, type, text, desc, id, pixel bounds/center, state flags) in reading order — plus the same snapshot as compact text. Much cheaper than a screenshot and cheaper than the full hierarchy. Keep the snapshot_id: previewapk_tap with ref + snapshot_id taps an element from it safely (stale_snapshot if the screen changed). Set screenshot=true to also get the frame as an image.

Input parameters:

- `device` (string)
- `scale` (number): screenshot scale, e.g. 0.5 (only with screenshot=true)
- `screenshot` (boolean)

### `previewapk_act` (~201 tokens)

Run a batch of up to 20 actions in order on the device: tap (x/y fractions, or target {text|id|desc, nth}, or target {ref, snapshot_id}), swipe {x1,y1,x2,y2}, long_press, double_tap, type {text, clear, submit}, key {key: back|home|recents|enter|delete or code}, open_app {package}, close_app {package}, open_url {url}, notifications, wait {ms}, wait_for {text|id|desc, present, timeout_s}. Stops at the first failure — earlier actions stay done — and returns per-action results with timing and error envelopes. NEVER replay a batch whose outcome you don't know; observe first. observe='ui'|'screenshot'|'both' attaches the screen after the batch.

Input parameters:

- `actions` (array, required)
- `device` (string)
- `observe` (string)

### `previewapk_wait_for` (~195 tokens)

Wait until an element is present on screen (or gone, with present=false), polling the UI. Returns {found, waited_ms} — found=false at the timeout is a result, not an error. Use after actions that load content instead of sleeping blind. With condition='driver' instead of an element: wait until the human hands the wheel back to you (after previewapk_request_human or any takeover) — the result carries the handback note (handback_note, resumed) when there is one. Driver waits default to timeout_s=300 (max 600): a human step takes human time.

Input parameters:

- `condition` (string): 'driver' waits for the handback instead of an element
- `desc` (string)
- `device` (string)
- `id` (string)
- `present` (boolean)
- `text` (string)
- `timeout_s` (number)

### `previewapk_record_start` (~85 tokens)

Start recording the device screen to an MP4 (screenrecord; one recording caps at 180s). Stop it with previewapk_record_stop, then download with previewapk_record_download. A recording in progress is stopped and saved automatically if the session ends or the phone reboots.

Input parameters:

- `device` (string)
- `name` (string): a label for the recording

### `previewapk_record_stop` (~61 tokens)

Stop the running recording. The MP4 is pulled off the device to the server and indexed (rec_id, size, duration) — download it with previewapk_record_download. Recordings stay downloadable after the session ends.

Input parameters:

- `device` (string)

### `previewapk_record_download` (~92 tokens)

Download a finished recording's MP4 to a local file path on this machine (resumable — a cut transfer picks up where it stopped). Omit rec_id to get the session's latest finished recording.

Input parameters:

- `device` (string)
- `path` (string, required): local file path to save the MP4 to
- `rec_id` (string): from previewapk_record_stop (default: latest)

### `previewapk_request_human` (~173 tokens)

Ask the human for a step only a human should do: a password or 2FA code typed on the phone itself, a payment or consent approval, a CAPTCHA, anything sensitive or irreversible. Records the request in the portal (the device card shows 'Your agent needs you') and returns message_for_human — relay it to the human VERBATIM in chat, then park on previewapk_wait_for with condition='driver' until the wheel comes back (the handback note rides that result). Never ask the human to paste a password or code into chat for you to type — the human types it on the phone. Requires a live session you are driving.

Input parameters:

- `device` (string)
- `reason` (string, required): one short line: what the human needs to do (max ~200 chars)

### `previewapk_finish` (~229 tokens)

File the wrap-up when your work on this session is done, and get back message_for_human — relay it to the human VERBATIM. The counts in it (session duration, actions taken, errors) are composed by the SERVER from the session's real record — never state counts from your own memory instead. The report is also stored on the session (visible in the portal, kept in the session archive after the session ends). end_session defaults to FALSE: finishing does not stop the phone — it stays live at the portal link and idle-stops on the normal 15-minute rule. Pass end_session=true only when the human should get the session-record wording and the phone should stop now. File your previewapk_feedback field report too — finish is the human's summary, feedback is the tool team's.

Input parameters:

- `device` (string)
- `end_session` (boolean): also stop the session after filing (default false)
- `summary` (string, required): what you tested or checked, in your own words (max ~1000 chars)
- `verdict` (string): optional overall verdict

### `previewapk_device` (~348 tokens)

Device controls for realistic QA. action='set_timezone' (IANA tz, e.g. America/New_York) — verified on the device. action='set_locale' (BCP 47 tag, e.g. de-DE; package optional, defaults to the session app) — per-app language, Android 13+ style; relaunch the app if it doesn't switch live. action='set_location' (lat, lon) — GPS reports a mock fix until cleared. action='clear_location'. action='push_file' (local_path on this machine, remote_path under /sdcard, max 10 MB) — test fixtures, seed files. action='pull_file' (remote_path, local_path, max 10 MB). action='list_files' (remote_path folder, default Download). action='delete_file' (remote_path). action='reboot' — restarts the phone (same phone, same data: app, files and settings survive; ~a minute; a running recording is saved first). There is NO clipboard control: not available on these phones.

Input parameters:

- `action` (string, required)
- `device` (string)
- `lat` (number)
- `local_path` (string): file on this machine (push_file: source; pull_file: destination)
- `locale` (string): BCP 47 tag (set_locale)
- `lon` (number)
- `package` (string): app package (set_locale; default: session app)
- `remote_path` (string): path on the device, under /sdcard (e.g. Download/fixture.json)
- `tz` (string): IANA timezone (set_timezone)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/livetaub-previewapk/previewapk#diagnostics

## Score history

- 2026-11-05: 39
- 2026-11-04: 38
- 2026-11-03: 38
- 2026-11-02: 38
- 2026-11-01: 37
- 2026-10-31: 37
- 2026-10-30: 36
- 2026-10-29: 36
- 2026-10-28: 35
- 2026-10-27: 35
- 2026-10-26: 34
- 2026-10-25: 34
- 2026-10-24: 33
- 2026-10-23: 33
- 2026-10-22: 32

## Common questions

### What is the PreviewAPK MCP server?

PreviewAPK is an MCP server listed in the public MCP registry as io.github.livetaub/previewapk. Give your AI agent a real cloud Android phone: push APKs, drive it, get screenshots and logs. This page covers its MCPB bundle (https://github.com/livetaub/previewapk/releases/download/v1.1.1/previewapk.mcpb).

### Is the PreviewAPK MCP server safe to use?

PreviewAPK scores 39 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the PreviewAPK MCP server expose?

PreviewAPK exposes 27 tools: previewapk_list_devices, previewapk_use_device, previewapk_status, previewapk_push_apk, previewapk_start, and 22 more. Their descriptions and schemas cost roughly 3,182 tokens of context every time the server is loaded.

### What licence is the PreviewAPK MCP server under?

PreviewAPK declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/livetaub/previewapk
- Website: https://previewapk.siteport.site/
- Changelog RSS feed: https://verifymcp.io/servers/livetaub-previewapk/previewapk.xml
- Changelog JSON feed: https://verifymcp.io/servers/livetaub-previewapk/previewapk.json
- HTML version of this page: https://verifymcp.io/servers/livetaub-previewapk/previewapk