io.github.namyunsu/crewdroid
NPM · CREWDROID
Light Android emulators for AI agents: text screen outline, per-device network, battery, location.
Available components
Last scanned (20 hours ago)
Scores higher than 73% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 121 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to namyunsu/crewdroid). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3953 tokens (~152/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage88
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 63% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 26 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.88 ▲ functional
- 3 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.88 ▲ functional
- Package version: 0.2.2 → 0.2.6 functional
- Package version: 0.2.2 → 0.2.4 functional
- Package version: 0.2.2 → 0.2.3 functional
- 2 Nov 26 −11
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Dependency health: 0.88 → unverified ▼ functional
- Package version: 0.2.0 → 0.2.2 functional
- Package version: 0.2.0 → 0.2.1 functional
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +14
- Provenance: fail → pass ▲ security
- The attested source repository moved: namyunsu/crewdroid security
- Schema quality: pass → fail ▼ functional
- Tool coverage: 47% → 63% ▲ functional
- Security disclosure: fail → pass ▲ functional
- Schema quality: fair → good functional
- Destructive annotations: 0 → pass functional
- Package version: 0.1.0 → 0.2.0 functional
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/crewdroid@0.2.6
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | namyunsu/crewdroid |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/namyunsu/crewdroid/.github/workflows/release.yml@refs/tags/v0.2.6 |
| Rekor log index | 3667511378 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:593445a0752dad60d34c404423251542eb0f266c063911fe2ee35415a4494462a9328c99aa607e5e7966fef08ca58831ff23a095be2fa59487daf4124 |
Background: How many MCP packages publish verified provenance →
Dependencies 121 packages
| Packages resolved | 121 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apk ~53
Read an APK's manifest on the host (aapt2): package, version, min/target SDK, permissions, exported activities, deep-link filters.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | path to the .apk on the host |
No output schema declared.
No examples provided.
app ~174
Control an app on a crewdroid emulator: perm grant|revoke|show [perm…], open <uri> (deep link / App Link), links show|force <domain>|reset (API 31+), clear, backup, restore (LocalTransport), pressure doze|standby <active|working_set|frequent|rare|restricted>|trim <level>|bg-restrict|battery-saver|reset, fill-storage <GB>|free. Setters read the state back and error on mismatch.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | – |
| onlyThisPackage | boolean | – | open only: restrict the intent to pkg |
| pkg | string | yes | application id, e.g. dev.crewdroid.probe |
| serial | string | yes | emulator-<port> |
| what | string | yes | – |
No output schema declared.
No examples provided.
devices ~57
Use to find the emulator-<port> serial every other tool needs, or to check what is already running. Returns [{serial, avd, api, profile, screen, cores, ramMB, booted}]; empty = call up.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
down ~39
End of the loop: kill every crewdroid (crew-*) emulator. Always call it when finished. Returns {killed: pids, ports}.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
env ~173
Change or read a crewdroid emulator's environment: geo <lon> <lat> [alt], battery <0-100> [ac|unplugged], rotate <0-3>, sensor acceleration x:y:z, dark on|off, font <scale>, locale <pkg> <tags> (API 33+), gsm data <home|roaming|searching|denied|off|on>, gsm signal <0-31>, sms <from> <text>, call <number> [accept|cancel], show. Every setter reads the state back and errors on mismatch.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | – |
| holdSeconds | integer | – | gsm signal only: keep re-sending for this long |
| serial | string | yes | emulator-<port> |
| what | string | yes | – |
No output schema declared.
No examples provided.
fold ~71
Fold (cover screen) or unfold (main screen) a fold/flip-profile emulator: the app gets a configuration change with the new size. No hinge/posture emulation on ATD.
| Name | Type | Req | Description |
|---|---|---|---|
| serial | string | yes | emulator-<port> |
| to | string | yes | cover = folded, main = unfolded |
No output schema declared.
No examples provided.
hammer ~70
Virtual users hit a server API concurrently, then judge the result.
| Name | Type | Req | Description |
|---|---|---|---|
| jitter | number | – | – |
| repeat | integer | – | – |
| retryRate | number | – | – |
| rules | string | – | – |
| seed | integer | – | – |
| url | string | yes | – |
| users | integer | – | – |
No output schema declared.
No examples provided.
install ~101
Use after each build: adb install -r [-g] a host .apk on one emulator or `all` crew devices (replaces the old version, keeps data). Returns ok and per device package + Success or the adb failure code (INSTALL_FAILED_*).
| Name | Type | Req | Description |
|---|---|---|---|
| apk | string | yes | host path to the .apk |
| grant | boolean | – | -g: grant all runtime permissions |
| target | string | yes | emulator-<port> or all |
No output schema declared.
No examples provided.
judge ~101
Judge server data (unique / count / noLostUpdate) and/or a proxy request log (dupSuccess / lostUpdate / lostWrite / idle) against a rules file. ok=false lists violations.
| Name | Type | Req | Description |
|---|---|---|---|
| log | string | – | proxy JSONL log (proxy tool / run with proxy), e.g. with judge/proxy.rules.json |
| rules | string | – | – |
| source | string | – | server base URL (GETs /export) or JSON file |
No output schema declared.
No examples provided.
key ~86
Use for navigation and hardware keys: back|home|enter|delete|tab|menu or any KEYCODE_*. Returns the focused window and the new screen outline (screen:false to skip).
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | – |
| key | string | yes | – |
| screen | boolean | – | false = do not return the new screen |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
launch ~133
Use to open the app after install, or restart it (restart:true) after a change. am start -W, then checks the process 2 s later. Returns component, totalTime ms and crashed; crashed:true comes with crash {exception, topFrame} (then call logs or triage).
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | – | e.g. .MainActivity; default = launcher activity |
| extras | array | – | am start extras, e.g. ["--es","check","crash"] |
| pkg | string | yes | – |
| restart | boolean | – | – |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
layout ~349
Use to find broken screens of any installed app across Galaxy screens x font sizes on ONE device (default 5 profiles x fonts 1.0/1.3/2.0 = 15 combos, ~2-4 min). Per combo the app is restarted and the launch activity (or the screen a Maestro flow reaches) is judged from the accessibility tree: wrap (button label on 2+ lines, word broken), clip (ellipsized/cut text), offscreen (no scroll can reach it), overlap (> 20 %), target (< 48 dp). Returns {ok, combos:[{profile, font, ok, findings:[{kind, text|id, bounds, detail}], png?}], summary}; png = screenshot with the finding boxes drawn. The device's screen size, density and font are restored afterwards.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | – | e.g. .MainActivity; default = launcher activity |
| extras | array | – | am start extras, e.g. ["--es","check","layout-bad"] |
| flow | string | – | Maestro flow (host path) run after each start; the screen it ends on is judged |
| fonts | array | – | font scales, default [1.0,1.3,2.0] |
| out | string | – | directory for the PNGs (default ./crewdroid-layout-<pkg>-<time>) |
| pkg | string | yes | installed package |
| profiles | array | – | profile names, default s24ultra,fold5-cover,fold5-main,flip6-cover,trifold-main |
| serial | string | yes | emulator-<port> |
| timeoutSec | integer | – | – |
No output schema declared.
No examples provided.
load ~152
Make one emulator behave like a used phone: off|low|mid|high = installed filler apps (30/80/150), background processes (5/15/30), memory ballast down to 50/30/15 % of the off-level free RAM, CPU workers at 10/25/50 % per core, alarm/job wakeups. off removes it all (keepApps keeps the fillers installed). Returns the measured guest state (MemAvailable %, load average, CPU busy %, processes, packages).
| Name | Type | Req | Description |
|---|---|---|---|
| keepApps | boolean | – | off only: keep the filler packages installed |
| level | string | yes | – |
| serial | string | yes | emulator-<port> |
| timeoutSec | integer | – | – |
No output schema declared.
No examples provided.
logs ~205
Use to see what the app printed or why it failed: one app's logcat lines only (its pid; its last pid when not running). Default: the last 40 lines at level >= I, one text line each `HH:MM:SS.mmm L Tag: message`, equal lines in a row folded `(xN)`, stack traces cut to the top 8 app frames. all:true = today's whole output at level V (max 500 lines); since:"1m" limits to recent lines; format:"json" = {lines:[{time, level, tag, message}]}.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | – |
| format | string | – | – |
| level | string | – | default I (V with all) |
| pkg | string | yes | – |
| seconds | integer | – | follow for N s |
| serial | string | yes | emulator-<port> |
| since | string | – | 60s | 90 | 2m |
No output schema declared.
No examples provided.
net ~171
Set one emulator's network state (airplane|nodata|slow|flaky|online), which link is up (wifi|cellular|both|none), switch the active link while traffic flows (handover), or mark Wi-Fi metered. Returns the transport apps see: {default: wifi|cellular|none, connected, metered}.
| Name | Type | Req | Description |
|---|---|---|---|
| during | integer | – | handover: ms with no link between old and new (default 0 = new link up before the old one goes) |
| metered | boolean | – | state=metered: true = Wi-Fi metered |
| seed | integer | – | – |
| serial | string | yes | emulator-<port> |
| state | string | yes | – |
| to | string | – | handover target (default: the other link) |
No output schema declared.
No examples provided.
perf ~118
Cold start time (force-stop, 2 s, am start -W), frames/jank %/p50-p99 (gfxinfo) and PSS java/native (meminfo) of one app. ATD has no GPU: compare frame numbers relatively.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | – | e.g. .MainActivity; default = launcher activity |
| extras | array | – | am start extras, e.g. ["--es","check","jank"] |
| pkg | string | yes | – |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
proxy ~175
Recording HTTP proxy between the emulators and your server (no app or server change): action start points every device's system proxy at it (10.0.2.2:<port+k>), stop clears it, log returns the request log. Judge the log with the judge tool's `log` input (dupSuccess / lostUpdate / lostWrite / idle).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| devices | array | – | default: every running crew emulator |
| log | string | – | JSONL path |
| loseAcks | number | – | fault injection: share of writes whose answer is dropped after the server committed them |
| port | integer | – | – |
| target | string | – | start: server base URL as seen from the host, e.g. http://127.0.0.1:5599 |
No output schema declared.
No examples provided.
run ~278
Run a multi-device scenario on any app: up, install, per-device actions (Maestro flow / intent / adb) + network schedule, drain, judge (proxy log by default), down (minutes). Give `file` (scenario JSON, docs/guide-your-app.md) OR, with no file, apk + flows + server (setupFlow, count, repeat, network optional).
| Name | Type | Req | Description |
|---|---|---|---|
| apk | string | – | no-file form: your APK (package read from it) |
| basePort | integer | – | – |
| count | integer | – | default: the file's devices.count, else 3 |
| file | string | – | scenario JSON, e.g. scenarios/photo-upload.json; omit to use apk/flows/server |
| flows | array | – | no-file form: Maestro flows run in order every iteration |
| network | boolean | – | no-file form: false = no network faults (default: all four states) |
| repeat | integer | – | no-file form: iterations per device (default 5) |
| seed | integer | – | – |
| server | string | – | no-file form: backend as the host sees it, http://host:port |
| serverPort | integer | – | – |
| setupFlow | string | – | no-file form: Maestro flow run once per device first |
| timeoutSec | integer | – | – |
No output schema declared.
No examples provided.
screen ~237
Use to READ the screen before tap/type (tree, not pixels). Default: a short outline, first line = focused window and size, then one line per visible element `[n] role "text" #id @x,y flags` (role btn/edit/text/img/list/check; a card's texts sit on its one line; `… N more below (swipe up)` = off-screen). tap {index:n} alone taps [n] of this outline. format:"json" = full tree {focus, nodes[{cls,text,desc,id,bounds,clickable,depth,...}], via}. While a Maestro flow runs the tree is empty and a line says why. For how it looks, use shot. On API 31 a black screen after a relaunch (emulator bug, ADR 0005) is recovered first and reported (blackRelaunch), not an app bug.
| Name | Type | Req | Description |
|---|---|---|---|
| bounds | boolean | – | add [l,t,r,b] to each line |
| format | string | – | – |
| png | string | – | host path for a screenshot |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
setup ~161
Use first on a new machine, or when up fails for a missing SDK/image: checks/installs the Android SDK pieces crewdroid needs (JDK 17 for sdkmanager, command-line tools, platform-tools, emulator, google_atd images). Dry run by default: returns steps [{step, status: present|missing, downloadBytes}]; yes:true installs and accepts the SDK licences.
| Name | Type | Req | Description |
|---|---|---|---|
| images | array | – | Android API levels of google_atd images, default ["34"] |
| only | array | – | limit to these steps |
| sdk | string | – | SDK directory (default ANDROID_SDK_ROOT / ANDROID_HOME, else ~/.crewdroid/android-sdk) |
| yes | boolean | – | install for real and accept the SDK licences |
No output schema declared.
No examples provided.
shot ~118
Use to SEE the screen (pixels: layout, colours, clipping). Returns an image item (PNG, also saved to file or ./crewdroid-<serial>-<time>.png) and a text line with path and size. To find a button or text to tap, use screen instead. On API 31 a fully black screen after an app relaunch (emulator bug, ADR 0005) is recovered first.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | host path for the PNG |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
swipe ~145
Use to scroll or page: swipe up|down|left|right (finger direction, middle 50 % of the screen; up scrolls content down) `times` times, or a line x1,y1 -> x2,y2 in ms. Returns the from/to points and the new screen outline (screen:false to skip).
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | – |
| format | string | – | – |
| line | array | – | [x1,y1,x2,y2] |
| ms | integer | – | – |
| screen | boolean | – | false = do not return the new screen |
| serial | string | yes | emulator-<port> |
| times | integer | – | – |
No output schema declared.
No examples provided.
tap ~224
Use to press a button or field: by text/content-desc (text), resource-id (id), a point x,y, or index alone = the [n] line of the last screen outline (no new tree read while that window still has focus). Element match = exact first, then case-insensitive contains. 0 or several matches (text/id without index) fail and list the candidates; retry with index (0-based among the matches) or id. Returns the tapped point and the new screen outline once it settled (screen:false to skip), so no separate screen call is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | – |
| id | string | – | resource-id, full or the part after :id/ |
| index | integer | – | alone: [n] of the last screen; with text/id: 0-based among the matches |
| screen | boolean | – | false = do not return the new screen |
| serial | string | yes | emulator-<port> |
| text | string | – | – |
| x | integer | – | – |
| y | integer | – | – |
No output schema declared.
No examples provided.
triage ~102
Why did the app die? Crashes (logcat crash buffer), ANRs (ActivityManager log, exit-info, /data/anr traces), exit reasons, the app's last 200 log lines, optional heap dump.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | package name, e.g. dev.crewdroid.probe |
| heap | string | – | host path for an .hprof (needs app running) |
| serial | string | yes | emulator-<port> |
No output schema declared.
No examples provided.
type ~131
Use to fill a text field: appends any text (Korean, emoji included) to the focused field through the on-device helper; into = text or resource-id of the field to tap first. Returns the field typed into and the new screen outline (screen:false to skip). Without the helper it falls back to `input text`, where non-ASCII fails with the reason.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | – |
| into | string | – | – |
| screen | boolean | – | false = do not return the new screen |
| serial | string | yes | emulator-<port> |
| text | string | yes | – |
No output schema declared.
No examples provided.
up ~329
Start of the loop: boot headless emulators (1-3 min). No args = ONE device (s24ultra, newest API <= 36), the right choice for building/checking an app; count > 1 mixes Galaxy profiles and Android versions. Returns {devices:[{serial, api, profile, wmSize}]}; pass serial to every other tool.
| Name | Type | Req | Description |
|---|---|---|---|
| allowNoHelper | boolean | – | true = keep the devices when the on-device helper fails (screen/tap/type then use the slower uiautomator/input) |
| api | integer | – | pin the image API, e.g. 31|34|36 |
| basePort | integer | – | – |
| cores | integer | – | guest CPUs, e.g. 1|2|4|6|8 (default 2; <= host CPUs) |
| count | integer | – | – |
| idleMinutes | integer | – | devices stop after this many minutes without a crewdroid call, and when this MCP server exits (default 60; 0 = never) |
| load | string | – | used-phone load applied after boot (see the load tool) |
| profiles | array | – | profile names from profiles/galaxy.json |
| ram | integer | – | guest RAM MB, 896..8192 (default 896, API 31 768) |
| timeoutSec | integer | – | – |
| wifi | boolean | – | true = each device can get its own Wi-Fi address (31 of 33 measured device boots; default: one device at a time; +9.4 % idle RAM) |
No output schema declared.
No examples provided.
How do I install the io.github.namyunsu/crewdroid MCP server?
io.github.namyunsu/crewdroid runs locally as an npm package, launched with npx -y crewdroid. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · crewdroid
claude mcp add namyunsu-crewdroid -- npx -y crewdroid
What is the io.github.namyunsu/crewdroid MCP server?
io.github.namyunsu/crewdroid is an MCP server listed in the public MCP registry as io.github.namyunsu/crewdroid. Light Android emulators for AI agents: text screen outline, per-device network, battery, location. This page covers its npm package (crewdroid).
Is the io.github.namyunsu/crewdroid MCP server safe to use?
io.github.namyunsu/crewdroid scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.namyunsu/crewdroid MCP server expose?
io.github.namyunsu/crewdroid exposes 26 tools: devices, up, down, net, judge, and 21 more. Their descriptions and schemas cost roughly 3,953 tokens of context every time the server is loaded.
Is the io.github.namyunsu/crewdroid MCP server still maintained?
io.github.namyunsu/crewdroid is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.namyunsu/crewdroid MCP server under?
io.github.namyunsu/crewdroid declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.