Android Code SearchSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/cs-android-mcp) [](https://www.npmjs.com/package/cs-android-mcp) [](https://github.com/steveday763/csandroidmcp) [](https://opensource.org/licenses/MIT)
English | 简体中文
A Model Context Protocol (MCP) server for searching and browsing Android source code via cs.android.com.
Preview
Features
- Code Search: Search through Android source code with regex support
- File Content: Retrieve full source file contents
- Symbol Suggestions: Get autocomplete suggestions for classes, methods, files
- Multiple Projects: Search across Android, AndroidX, Android Studio, and LLVM projects
Installation
Claude Code
claude mcp add cs-android -- npx -y cs-android-mcp
Cursor
{
"mcpServers": {
"cs-android": {
"command": "npx",
"args": ["-y", "cs-android-mcp"]
}
}
}Other MCP Clients
Any MCP-compatible client can use the stdio transport:
npx -y cs-android-mcp
Or install globally:
npm install -g cs-android-mcp cs-android-mcp
Available Tools
searchandroidcode
Search for code in Android source repositories.
getfilecontent
Get the full content of a source file.
d0bf9681cdf1OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add cs-android-mcp -- npx -y [email protected]
{
"mcpServers": {
"cs-android-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (10)
10 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Activity.java | read | Android Activity base class source code |
Android | read | Android mobile operating system |
Android-LLVM | read | Android branch of the LLVM Project |
AndroidX | read | Libraries for Android development |
Context.java | read | Android Context abstract class source code |
View.java | read | Android View base class source code |
get_file_content | read | Get the full content of a source file from Android repositories |
list_projects | read | List available Android source projects that can be searched |
search_android_code | read | Search for code in Android source repositories (cs.android.com). Returns matching files and code snippets. |
suggest_symbols | read | Get symbol suggestions for a partial query (classes, methods, files) |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (2)
const API_KEY = 'AIzaSyD1ZDuAdU_IZqa3Wscr053WydRT7FoJdmQ';
@modelcontextprotocol/sdk, @types/node, typescript
Gates applied: no_behavioural_pass.
d0bf9681cdf1full audit observations/trust-audit/mcp-server/steveday763__android-code-search.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | d0bf9681cdf1 | SAFE | B | 89 | first audit |
Questions
What tools does Android Code Search expose?
10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Android Code Search safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Android Code Search need?
No credential environment variables were found in its source, so it appears to need none.
How does Android Code Search run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as cs-android-mcp at 1.0.1.
How current is this page?
The grade is for one exact copy of the source (d0bf9681cdf1), read on 2026-10-09. The repository is watched and re-audited when it changes.