Security Model

The MCP server refuses unauthenticated requests. The secret is stored at:

/data/adb/modules/AndroidUse/.secret/mcp_secret

Use 127.0.0.1 plus adb forwarding for normal workstation access.

Screenshots

Screenshot URLs require the same MCP secret through:

• Authorization: Bearer <secret>
• X-AndroidUse-Secret
• include_secret_in_url=true only for clients that cannot send headers

Normal Android screenshots cannot reliably capture FLAG_SECURE windows. Treat secure windows, login, captcha, payment, and sensitive flows as explicit human-review cases.

Network Exposure Checklist

• Keep the listener local unless remote access is required.
• Open only one TCP port when using IPv6 inbound access.
• Do not disable the entire IPv6 firewall for normal use.
• Rotate the MCP secret after a public-network test.
• Remove temporary router rules when the test is complete.