DeepADB v1.1.3

DeepADB v1.1.3 — Transitive Dependency Security & CI Hardening

Security patch release. Dependency lockfile, CI configuration, and test/docs files only — no tool, API, or behavior changes. Still 204 tools across 45 modules.

Security — transitive hono (4 advisories)

Bumped the transitive hono dependency 4.12.18 → 4.12.23 (the fixes landed in 4.12.21). hono is pulled in only by @modelcontextprotocol/sdk@1.29.0, whose ^4.11.4 range already permitted the patched version, so this is a lockfile refresh — no SDK or API change, and hono is not imported anywhere in DeepADB's own source.

Advisories cleared (all fixed at 4.12.21):

• HTTP request smuggling via app.mount — percent-encoded multi-byte characters in the request path could route to unintended sub-application routes.
• ipRestriction IPv6 deny-rule bypass — non-canonical IPv6 forms (compressed / explicit-zero representations) skipped configured deny rules.
• jwt middleware authorization bypass — a valid JWT presented under any Authorization scheme, not just Bearer, was accepted.
• Cookie HTTP response-splitting via serialize — crafted sameSite / priority values could inject attributes into the Set-Cookie header.

DeepADB's published transport is stdio (see server.json), so the HTTP routing and middleware paths these advisories concern are outside the default configuration; the dependency is patched regardless.

Also included (previously unreleased)

• CI supply-chain hardening — Dependabot cooldown windows (7-day npm/Actions, 30-day npm majors), npm ci --ignore-scripts on all CI installs, and full SHA-pinning of GitHub Actions.
• Device-free CI fixes — four assertions now tolerate the ubuntu-latest state where adb is installed but non-functional (no device/server).

Install

npm install -g deepadb@1.1.3

Verification

• Build: clean (zero errors, zero warnings).
• Device-free suite: 148 passed, 0 failed, 0 skipped (boundaries, result-handles, sanitizer-fuzz, supply-chain, transports).

Full details in CHANGELOG.md.

DeepADB v1.1.2

DeepADB v1.1.2 is a hardening and tooling release. 204 tools across 45 modules, 5 resources, and 4 prompts; the project gains continuous integration, coverage, a transport test suite, property-based input fuzzing, stricter type-checking and linting, and a move to the Apache 2.0 license. The full suite was re-validated end-to-end on real hardware with zero failures.

License change: DeepADB is now licensed under Apache 2.0 (previously MIT). It remains permissive and free to use; Apache 2.0 adds an explicit patent grant and asks that you retain the NOTICE file in redistributions.

What's new

• CI/CD — GitHub Actions run the build, lint, and device-free test suites on Node 22.x and 24.x, plus a coverage job; Dependabot keeps dependencies and actions current.
• Transport test suite — new device-free smoke tests exercise the HTTP/SSE, WebSocket, and GraphQL round-trips. These surfaced and fixed a GraphQL root-resolver bug affecting the devices and device queries.
• Input-sanitizer fuzzing — property-based tests (fast-check) verify the shell-quoting round-trip and the argument-rejection invariant across randomized inputs.
• Stricter builds — ESLint (flat config) runs at zero warnings, and the TypeScript compiler now enforces no-unused-locals/parameters, no-implicit-returns, and no-fallthrough.
• Security-test corrections — corrected two over-strict test assertions (tcpdump BPF-filter handling and a process-kill signal race); tool behavior is unchanged and was empirically re-verified safe.
• Hardware re-validation — re-tested on a Pixel 6a across four configurations (ADB and on-device, each with and without a screen-lock PIN), all passing with 0 failures (up to 610 checks per run).

Using this build

This prebuilt archive contains the compiled server — no build step required.

# 1. Download and extract deepadb-v1.1.2-prebuilt.zip (below)
cd deepadb-1.1.2

# 2. Install runtime dependencies only (2 packages, no dev tooling)
npm install --omit=dev

# 3. Run
npm start                       # stdio — for local MCP clients
DA_HTTP_PORT=3000 npm start     # HTTP/SSE — for remote access

Requires Node.js ≥ 22. Also available on npm: npm install -g deepadb. See README.md for full client setup and SECURITY.md before exposing a network port.

Full changelog

See CHANGELOG.md for the complete list of changes.

DeepADB v1.1.1

DeepADB v1.1.1 — Hardware Sensors, IIO Power Monitors & Comprehensive File Operations

198 tools across 44 modules — the most comprehensive ADB MCP server available.

What's New

2 New Tools in a New Module (sensors.ts)

• adb_sensor_read — Read current hardware sensor values via dumpsys sensorservice. Enumerates all sensors with vendor, type, mode, rate range, and wake capability. Category filter (13 categories) and listOnly discovery mode. Axis-labeled formatting for 3-axis sensors. 21 Android sensor types with appropriate units. No root required. Hardware-verified on Pixel 6a (44 sensors: 36 hardware + 8 AOSP virtual).
• adb_iio_read — Read raw hardware data from the Linux IIO subsystem. Auto-discovers IIO devices, classifies by kernel driver. On Tensor/Exynos devices: exposes per-rail ODPM power monitors from S2MPG PMICs — real-time power consumption per SoC subsystem (CPU big/mid/little, GPU, TPU, display, DDR, UFS, GPS, AOC, etc.) sorted with percentage breakdown. Generic IIO path handles raw channels with calibrated raw * scale + offset. Root required. Hardware-verified on Pixel 6a (2 PMICs, 16 power rails, 125 Hz sampling).

File Tools Expansion — 14 New Tools (files.ts 4 → 18)

Every new tool closes a specific security gap where MCP agents would otherwise fall back to adb_shell, bypassing the sanitization infrastructure.

Safety model applied consistently to all modifying tools:

• Hard-blocked kernel paths: /, /dev, /proc, /sys
• Depth-based recursive protection: refuse at depth ≤ 2 from root
• Symlink resolution via realpath before depth checks (prevents traversal bypass)
• Filesystem-aware warnings: erofs/squashfs (read-only), sdcardfs/FUSE (ignores chmod), vfat/FAT32 (no perms, 4GB limit, 2s timestamps), tmpfs (volatile)
• Explicit root opt-in, execution time + storage metrics on every operation

New tools: adb_file_write, adb_find, adb_file_stat, adb_file_checksum, adb_mkdir, adb_rm, adb_file_move, adb_file_copy, adb_file_chmod, adb_file_touch, adb_file_fsinfo, adb_file_chown, adb_grep, adb_file_replace.

Existing tools hardened: adb_push gained the full safety model; adb_pull/ls/cat gained execution-time metrics.

Port Forward Cleanup — 2 New Tools (forwarding.ts 3 → 5)

• adb_forward_remove — remove a specific port forward or all forwards
• adb_reverse_remove — remove a specific reverse forward or all reverse forwards
• Closes cleanup gap: test suites now properly clean up port forwards after testing

Security Hardening

• Sed shell injection in adb_file_replace — sedEscapePattern/sedEscapeReplacement didn't escape single quotes, allowing find/replace values to close the outer shell single-quote and execute arbitrary commands. Fixed with '\'' closing/reopening pattern. Zod now also rejects newlines in these fields (sed treats them as script-command separators). Canary-file regression test proves the injection payload no longer executes.
• Shell injection in adb_qemu_start append kernel cmdline (KVM path) — escape heuristic only quoted args containing =///,/:, missing payloads like append="; reboot". Fixed by extracting and exporting escapeQemuShellArg() which unconditionally wraps every QEMU arg in single quotes with '\''-closing escape. 11 unit assertions + 6 shell round-trip tests verify the property end-to-end.
• Discarded validator in adb_heap_dump — validateShellArg() was called but its error result was never checked. Subsequent shellEscape() made exploitation impractical, but the intent was clearly to reject shell metacharacters. Fixed by capturing and returning the error properly. 4 injection-rejection tests added.
• printf format string injection in AT commands — AT command string was placed in printf's format position, causing % characters in legitimate commands (e.g., AT%RESTART) to be misinterpreted. Fixed by separating format from data: printf '%s\r' '${cmd}'.

Code Quality

• sensors.ts: O(n) line-offset index with binary search replaces O(n²) substring+split; self-describing key=value IIO reads; clean domain grouping (HAL types/parsers → IIO types/parsers → tool registration)
• at-commands.ts: extracted autoDetectAtPort() shared helper, replacing 4 copies of the 15-line modem probe pattern
• files.ts: 9 shared helpers (pathDepth, isHardBlocked, resolveRealPath, getStorageInfo, detectFsType, formatMetrics, formatBytes, sedEscapePattern/Replacement); mount detection refactored from nested $(df|awk) to TypeScript-side mount-table parsing

Test Suite Hardening

• Harness correctness fixes (5 bugs): testContains/testNotContains now throw on empty expected, testRejects no longer masks crashes as rejections, getText no longer fabricates [RPC ERROR] strings, startup "Ready" race fixed with specific phrase matching, new h.assert()/h.assertEq() primitives
• Alpine VM auto-fetch for test-qemu-boot.mjs — probes and fetches kernel/initrd from dl-cdn.alpinelinux.org with atomic writes, size sanity checks, and graceful skip on failure. No more hardcoded image paths.
• On-device mode-awareness — 4 test-boundaries/test-lifecycle assertions made mode-aware via existsSync("/data/data/com.termux") to match LocalBridge's stub behavior for wireless ADB and port forwarding
• Tightened loose substring assertions across 3 suites

Dependency Hygiene

• hono 4.12.12 → 4.12.14 (patches GHSA-458j-xx4x-4375, JSX SSR HTML injection — transitive via @modelcontextprotocol/sdk)
• typescript 6.0.2 → 6.0.3 (dev dep)
• npm audit: 0 vulnerabilities

Test Results

1,609 tests executed across the four-cell validation matrix on Pixel 6a (Android 16, Termux + Magisk + QEMU 10.2.1) — 0 failures:

Configuration	Passed	Failed	Skipped	Total
ADB (no PIN)	383	0	10	393
ADB (with PIN)	387	0	6	393
On-device (no PIN)	419	0	4	423
On-device (with PIN)	420	0	3	423

On-device delta (+30 tests) reflects 5 QEMU tests that are on-device-only, 1 shell round-trip test, and 9 on-device-specific code paths in test-boundaries.

164 new tests added in v1.1.1:

• test-sensors.mjs (new suite, 30 tests)
• test-files-extended.mjs (new suite, 95 tests — includes sed injection regression)
• 4 forward cleanup
• 20 post-audit regression (qemu escape 11 unit + 6 round-trip + heap_dump 4)
• 15 coverage fills (wireless, multi-device, at_probe, profile_save, tcpdump_stop, network_auto_connect)

Prebuilt Release

The attached deepadb-v1.1.1-prebuilt.zip includes compiled JavaScript and documentation — no TypeScript compilation required:

unzip deepadb-v1.1.1-prebuilt.zip -d deepadb
cd deepadb
npm install
npm start

Or build from source:

git clone https://github.com/fullread/DeepADB.git
cd DeepADB
git checkout v1.1.1
npm install && npm run build
npm start

DeepADB v1.1.0

Added server.json metadata and mcpName field for the official MCP Registry
(registry.modelcontextprotocol.io) under namespace io.github.fullread/deepadb.

No tool changes from v1.0.9 — this release adds registry discoverability only.

DeepADB v1.0.9

DeepADB v1.0.9 — Input Completeness, UI Efficiency, Screen Control & Permission Management

180 tools across 43 modules — the most comprehensive ADB MCP server available.

What's New

6 New Tools

• adb_input_fling — High-velocity fling gesture for momentum-scrolling lists and paged views
• adb_input_pinch — Multi-touch pinch/spread gesture with layered injection: parallel input swipe (universal) or atomic binary sendevent MT Type B protocol (root, true multi-touch). Hardware-verified on Pixel 6a
• adb_revoke_permission — Revoke runtime permissions (counterpart to adb_grant_permission)
• adb_list_permissions — List and filter package permissions with install/runtime type and grant state
• adb_screencap_annotated — Screenshot with numbered UI element bounding boxes composited via zero-dependency PNG pipeline
• adb_screen_state — Combined screen state snapshot (activity, dimensions, density, orientation, battery, interactive elements) in one call

Enhancements

• adb_screen — Added lock action and pin parameter for full credential-based unlock with keyguard verification
• adb_ui_dump — Added tsv and xml output formats for token-efficient automation
• adb_batch_actions — Added fling and pinch action types

Security Hardening

• PIN shell injection prevention: Zod alphanumeric regex + shellEscape() (finding #76)
• Sendevent device node validation: /dev/ prefix check, metacharacter rejection, path traversal rejection, single-quote wrapping (#76b)
• PNG decoder hardening: full 8-byte signature verification, MAX_DIM=10000 dimension bounds, inflateSync maxOutputLength decompression bomb protection

New Infrastructure

• src/middleware/png-utils.ts — Zero-dependency PNG decode/encode/draw primitives with CRC32, 5×7 pixel font, 8-color palette

Test Results

966 tests executed across 4 configurations, 0 failures:

Configuration	Passed	Failed	Skipped	Total
ADB (no PIN)	226	0	9	235
ADB (PIN=xxxx)	230	0	5	235
On-device (no PIN)	253	0	4	257
On-device (PIN=xxxx)	257	0	0	257

Hardware-verified on Pixel 6a (Android 16, Termux + Magisk + QEMU 10.2.1).

Prebuilt Release

The attached deepadb-v1.0.9-prebuilt.zip includes compiled JavaScript and documentation — no TypeScript compilation required:

unzip deepadb-v1.0.9-prebuilt.zip -d deepadb
cd deepadb
npm install
npm start

Or build from source:

git clone https://github.com/fullread/DeepADB.git
cd DeepADB
npm install && npm run build
npm start

DeepADB v1.0.8

v1.0.8 — Input Gestures, UI Automation, Device Awareness & Crash Analysis

174 tools across 43 modules | 18 new tools | 1 new module

What's New

Input Gestures (7 tools) — input-gestures.ts

• adb_input_drag — Drag from point A to B with draganddrop + swipe fallback
• adb_input_long_press — Configurable hold duration for context menus and drag handles
• adb_input_double_tap — Configurable interval for zoom, text selection gestures
• adb_input_text — Dedicated text input with %s space encoding
• adb_open_url — Open URLs via VIEW intent
• adb_orientation — Get/set screen orientation (auto/portrait/landscape/reverse)
• adb_clipboard — Read/write device clipboard with cross-version fallbacks

UI Automation (4 tools)

• adb_tap_element — Find element by text/id/desc, tap its center in one atomic call
• adb_wait_element — Poll until element appears or disappears
• adb_wait_stable — Poll until consecutive UI dumps match (animation/transition complete)
• adb_scroll_until — Scroll repeatedly until target element found, optional auto-tap

Efficiency (2 tools)

• adb_screenshot_compressed — Capture with quality/scale metadata for token-efficient LLM workflows
• adb_batch_actions — Up to 50 input actions in a single call (tap, swipe, long_press, double_tap, keyevent, text, drag, back, home, sleep)

Device Awareness (3 tools)

• adb_screen_size — Resolution, DPI, aspect ratio, DP width, override detection
• adb_device_state — Combined snapshot: battery, network, WiFi, screen, orientation, foreground activity
• adb_notifications — Parse active notifications with package filter and importance levels

Crash Analysis & Debugging (2 tools)

• adb_crash_logs — ANR traces and tombstone crash dumps from /data/anr/ and /data/tombstones/
• adb_heap_dump — Capture .hprof heap dump from a running process for memory analysis

Architecture

• Shared ui-dump.ts middleware — parseUiNodes/UiElement extracted, eliminates duplication between ui.ts and input-gestures.ts
• Shell injection hardened: adb_batch_actions validates all 10 action types through security middleware
• SELinux-compatible heap dump path (/data/local/tmp)

Test Results

Mode	Passed	Failed	Skipped	Total
ADB (PC → USB)	208	0	5	213
On-device (Termux + Magisk)	235	0	0	235

Hardware validated on Pixel 6a, Android 16, Magisk, QEMU 10.2.1.

Install

npm install -g deepadb@1.0.8

Or download the prebuilt zip below — extract, run npm install --production, then node build/index.js.

Full changelog: CHANGELOG.md

DeepADB v1.0.7

v1.0.7 — Wireless Firmware Intelligence, AT Cross-Validation & Comparative Testing

156 tools across 42 modules — 9 new tools, security hardening, and dependency patches.

Wireless Firmware Tools (new module — 4 tools)

• adb_wifi_firmware — WiFi chipset/driver/firmware identification, supported bands (2.4/5/6 GHz), WiFi standard detection (5/6/6E/7), current connection info. MAC address opt-in only.
• adb_bluetooth_firmware — BT firmware, version (4.0–5.4 from LMP), adapter state, LE capabilities (2M PHY, Coded PHY, LE Audio), active profiles, bonded device count. MAC/name opt-in.
• adb_nfc_firmware — NFC controller type (NXP/Broadcom/Samsung/ST), firmware version, supported technologies (NFC-A/B/F/V, MIFARE), secure element (eSE/UICC), HCE support.
• adb_gps_firmware — GNSS chipset and firmware (e.g., Broadcom BCM4776), supported constellations (GPS/GLONASS/Galileo/BeiDou/QZSS/NavIC/SBAS), dual-frequency L1+L5 detection, raw GNSS measurement capabilities for spoofing detection, A-GPS/SUPL server configuration.
• Enhanced adb_firmware_probe with wireless firmware summary section.

AT Cross-Validation (1 tool)

• adb_at_cross_validate — Cross-validate baseband firmware by comparing direct modem AT command responses (ATI, AT+CGMR, AT+CGMM) against Android system properties. Shannon-specific AT+DEVCONINFO support. Flags discrepancies as potential firmware tampering, incomplete OTA updates, or property spoofing. Requires root.

Comparative Testing Workflows (1 tool)

• adb_multi_test — Run predefined diagnostic profiles (firmware, security, network, identity, full) or custom command lists across all connected devices including QEMU guests. Compares results per-check and reports matches/differences.

QEMU Guest Connectivity & Multi-Device Integration (3 tools)

• adb_qemu_connect / adb_qemu_disconnect / adb_qemu_guest_shell — Connect to running VM guest ADB services (localhost-only), execute commands through security middleware. Guest serial derived internally — no user-supplied host/IP reaches the ADB binary.
• LocalBridge multi-device routing — Commands targeting connected QEMU guests are transparently routed through the real ADB binary. Existing adb_multi_shell, adb_multi_install, and adb_multi_compare tools now operate across host + guest VMs with zero tool module changes.

Security Hardening

• Bearer token strength validation at startup: warns if DA_AUTH_TOKEN is shorter than 32 characters, has low character diversity, or matches common weak patterns.
• Updated SECURITY.md with explicit minimum token length, node -e crypto.randomBytes alternative for token generation.

Dependency Security Patch

• Patched 6 moderate vulnerabilities in transitive dependencies (hono 4.12.12, @hono/node-server 1.19.13)
• Updated @types/node 25.5.0 → 25.6.0, path-to-regexp 8.4.0 → 8.4.2
• Full audit: 0 vulnerabilities

Test Results

• ADB mode: 191 passed, 0 failed, 5 skipped
• On-device (Pixel 6a, Android 16): 218 passed, 0 failed, 0 skipped

Install

npm install -g deepadb@1.0.7

Or download the prebuilt zip below — extract, run npm install --production, then node build/index.js.

DeepADB v1.0.6

147 tools, 4 resources, 4 prompts across 41 modules.
203/203 tests passing on hardware (Pixel 6a, Android 16).

What's new in v1.0.6 — Dependency Security Patch

Patched 6 moderate vulnerabilities in transitive dependencies of @modelcontextprotocol/sdk:

• hono 4.12.9 → 4.12.12: cookie name validation bypass, cookie name prefix bypass, IPv4-mapped IPv6 bypass in ipRestriction, path traversal in toSSG, middleware bypass via repeated slashes
• @hono/node-server 1.19.11 → 1.19.13: middleware bypass via repeated slashes in serveStatic

Lockfile-only change — no source code modifications, no API changes. Updated future roadmap documentation to reflect current state.

Install

npm install -g deepadb@1.0.6

From source

git clone https://github.com/fullread/DeepADB.git && cd DeepADB
npm install && npm run build && npm start

See SECURITY.md for deployment hardening guidance and CHANGELOG.md for full version history.

DeepADB v1.0.5

147 tools, 4 resources, 4 prompts across 41 modules.
203/203 tests passing on hardware (Pixel 6a, Android 16).

What's new in v1.0.5 — Transport Security & Auth Documentation

• Bearer token authentication (DA_AUTH_TOKEN) — documented and hardened with crypto.timingSafeEqual() for all network transports (HTTP/SSE, WebSocket, GraphQL). Health endpoints exempt.
• Timing-safe token comparison — pre-computed buffer with byte-length comparison handles multi-byte UTF-8 tokens correctly
• Non-loopback binding warning — startup alert when network transports bind without authentication
• CORS consistency — Authorization header and OPTIONS preflight across all transports
• HTTPS via reverse proxy guidance added to SECURITY.md (Caddy + SSH tunnel)
• Upgraded @modelcontextprotocol/sdk 1.28.0 → 1.29.0
• Upgraded TypeScript 5.9.3 → 6.0.2, @types/node 22.x → 25.5.0

Install

npm install -g deepadb@1.0.5

From source

git clone https://github.com/fullread/DeepADB.git && cd DeepADB
npm install && npm run build && npm start

Prebuilt download

unzip deepadb-v1.0.5-prebuilt.zip && cd deepadb-v1.0.5
npm install --production && npm start

See SECURITY.md for deployment hardening guidance and CHANGELOG.md for full version history.

DeepADB v1.0.4

147 tools, 4 resources, 4 prompts across 41 modules.
203/203 tests passing on hardware (Pixel 6a, Android 16).

What's new in v1.0.4 — Dependency Security Patch

• Fix CVE-2026-4926 (CVSS 8.7 High): ReDoS vulnerability in path-to-regexp@8.3.0 — updated to 8.4.0
• Upgraded @modelcontextprotocol/sdk from 1.27.1 to 1.28.0

Install

npm install -g deepadb@1.0.4

From source

git clone https://github.com/fullread/DeepADB.git && cd DeepADB
npm install && npm run build && npm start

Prebuilt download

unzip deepadb-v1.0.4-prebuilt.zip && cd deepadb-v1.0.4
npm install --production && npm start

See SECURITY.md for deployment hardening guidance and CHANGELOG.md for full version history.