Loading ToolBench
Android Frida bridge MCP server for dynamic instrumentation and runtime inspection of Android applications
Barbatos exhibits critical definition gaps across nearly all tools. While tool names follow verb_noun conventions (listClassesStream, inspectClass, setFieldValue), descriptions are present but lack LLM-optimization guidance. Most critically: NO input schemas are visible in the provided source code. The RpcHandler.kt file references tool definitions but does not expose the actual JSON Schema objects. Parameter types are inferred from descriptions only (e.g., 'className' described as string, but no formal schema). Output schemas are completely undocumented, agents cannot predict return structures. Error handling is minimal; no recovery guidance or categorization. Security concerns are severe: tools like setMethodImplementation and runOnce accept arbitrary code strings with no validation, sanitization, or permission gates. The server exposes dangerous Frida capabilities (heap inspection, method hooking, gadget injection) without scope declarations or audit trails.
Count the number of live instances of a Java/Kotlin class currently on the Android heap. Performs a heap scan to find all objects of the given class. Requires an active Frida session. Returns a JSON object with a "count" field (integer). Example: {"count": 3}.
Retrieve all logged hook events from previously installed method hooks. Returns a JSON object with an "events" array containing call logs.
Get the memory addresses of all live instances of a Java/Kotlin class. Performs a heap scan and returns an array of hexadecimal memory addresses.
Perform a health check on the Barbatos server and Frida bridge. Returns a JSON object with an "overall" status field and a map of component statuses.
Install a hook on a Java/Kotlin method to intercept calls and log arguments and return values. Requires the class name and method signature. Returns a confirmation message.
Inject a gadget chain from scratch into the target process. Optionally accepts parameters to customize the injection. Returns a status object with "steps" array and "status" field indicating completion.
NO input schemas visible in source code. RpcHandler.kt references tool definitions but does not expose JSON Schema objects. All 13 tools lack formal parameter type definitions, violating pattern:constrained-input and pattern:tool-description.
Output schemas completely undocumented. Agents cannot predict return structures (e.g., does listInstances return {instances: [...], totalCount} or {results: [...], count}?). Violates pattern:response-shaper and pattern:tool.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
Inspect a Java/Kotlin class to retrieve its full structure: static attributes, instance attributes, and methods (including private, synthetic, and compiler-generated ones like R8 lambdas and Kotlin accessors). Use the fully qualified class name (e.g. "com.example.MyClass"). Requires an active Frida session. Returns a JSON object with three arrays: "staticAttributes", "instanceAttributes", and "methods", each containing the full Java signature strings.
Inspect a specific instance of a Java/Kotlin class to retrieve its current field values. Requires the class name and instance id (from listInstances). Returns a JSON object with "attributes" (map of field name to current value).
Search the classes loaded on the device and stream the matches. Filters by search_param (substring, case-insensitive) and optionally app_packageRequires an active Frida session. Returns a stream of chunks; each chunk is a JSON object with a "list" array of matching class names.
List all live instances of a Java/Kotlin class on the Android heap with their unique identifiers. Performs a heap scan and returns each instance's id, memory handle, a human-readable summary (toString-like), and the detection method used. Requires an active Frida session. Returns a JSON object with "instances" (array of {id, handle, summary, detection method}) and "totalCount".
Execute arbitrary Frida script code once in the context of the target process. Requires the class name, method signature, and code to execute. Returns a confirmation message.
Modify a field value on a live instance. Requires the class name, instance id, field name, field type, and new value. Performs type coercion and validation. Returns a success message with the modified field name.
Replace the implementation of a Java/Kotlin method with custom code. Requires the class name, method signature, and new implementation code (as a string). Returns a confirmation message.
Dangerous tools (setMethodImplementation, runOnce, injectGadgetFromScratch) accept arbitrary code/payloads with NO validation, sanitization, or permission gates. No dry-run or confirmation step. Violates pattern:secret-injection, pattern:permission-gate, and pattern:confirmation-request.
No error handling or recovery guidance. Tools fail silently or with generic messages. No categorization of retryable vs fatal errors. Violates pattern:recovery-guide and pattern:error-classification.
No audit trail, permission declarations, or scope definitions. Tools expose sensitive Frida capabilities (heap inspection, method hooking, gadget injection) without logging who called what or with what permissions. Violates pattern:audit-trail and pattern:scope-declaration.