MCP APK tools — dexsql

Inspect Manifest declarations, packaged files and resource values with the tools below. Use SQL and smali to follow a component from its declaration to its code.

Open an APK

Open the archive with open_dataset before calling these tools. Resource-only archives are accepted; inspect has_dex before attempting SQL over code. input_index is a zero-based index in open_dataset.inputs; it is required when a dataset contains multiple archive inputs. Paths inside archives are exact entry names, never filesystem extraction targets.

Choose a tool

Tool	Use
`get_manifest`	Default summary: package/version, application attributes, SDK, component counts, paginated permission declarations. `mode: "xml"` returns paginated decoded XML.
`get_manifest_components`	Page activities, aliases, services, receivers and providers; filter `kind` or `only_exported`. Includes qualified names/descriptors, alias targets, intent actions/categories/data, metadata and launcher intent filters.
`list_resource_files`	Page archive entries and sizes; optionally filter a case-sensitive `prefix`, e.g. `assets/` or `res/`. Obfuscated APKs may use other paths.
`read_resource`	Read an exact `name`: binary Android XML becomes XML, UTF-8 stays text, other bytes use lowercase hex. `format: "hex"` forces original bytes.
`query_resources`	Page `resources.arsc` entries by `resource_id` (JSON integer), exact `name` (`type/name` or `package:type/name`), `resource_type`, name substring `contains`, or exact `configuration`.

Follow a component into code

For example, call get_manifest_components with {"dataset_id":"dataset-1","kind":"activity","only_exported":true}, then find its class descriptor with SQL and inspect methods using decode.

Continue a result

Row lists use offset, limit (1–200, default 100), total_rows, next_offset and truncated. Text/XML results store continuation under page; append page.text and pass page.next_offset back as offset. Hex results store content and next_offset at the top level; offsets count original bytes. Each byte budget includes both JSON result copies. An oversized individual row returns output_too_large; read its XML/text resource in pages instead.

Interpret values

Resource values preserve type, raw bits and configuration qualifiers. References include their IDs and names where available; they are not recursively evaluated and no device configuration is implicitly selected. Complex styles/arrays are flattened into ordered map-item rows with parent ID and item index. XML retains numeric resource IDs so it can be read independently of the resource table.

exported and enabled describe manifest configuration. Explicit exported=true is included even without an intent filter. Missing values follow target-SDK defaults assuming Android API 17+; unresolved/resource-valued or invalid configuration is null. Runtime enablement, permissions and installation validity still affect access. An activity alias names a manifest entry; use target_activity to locate its code.