mosesmrima/adb-tv-mcp

Review signals: 39 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 9 distinct locations. 39 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

Local or hosted: local

Run the adb-tv-mcp stdio MCP server and call the adb_devices tool, which lists ADB devices

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000
cd <guest-path> && git status 2>&1 | head -3; ls -R | head -50; echo "CDP=$CDP_URL"
cd <guest-path> && tail -c 900 README.md; echo ---; which node npm adb; node -v 2>&1; npm -v 2>&1; cat package.json; cat /etc/os-release | head -2
curl -s -m 10 -w '\nHTTP %{http_code}\n' $CDP_URL/json/version; echo; ls -la <guest-path> 2>&1 | head; ls /inputs 2>&1
cd <guest-path> && npm install 2>&1 | tail -5 && npm run build 2>&1 | tail -5 && ls dist
sudo -n apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -2; sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y -qq adb 2>&1 | tail -3; which adb && adb version 2>&1 | head -2
cd <guest-path> && grep -n "registerTool\|server.tool\|name:" src/index.ts | head -60; grep -n -A12 "adb_devices\"" src/index.ts | head -40
cd <guest-path> && ls -la .coldpass && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","<guest-path>"],"cwd":"<guest-path>","env":{"ADB_PATH":"/usr/bin/adb"},"tool":"adb_devices","arguments":{},"expected_text":"List of devices attached"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"adb_devices lists connected devices and their state","source":"README.md","quote_note":"table row","source_file":"README.md","input":"adb_devices with no arguments","expected":"List of devices attached header from adb","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"adb_devices","arguments":{},"expected_text":"List of devices attached","env":{"ADB_PATH":"/usr/bin/adb"},"cwd":"<guest-path>"},
{"kind":"claim","claim":"adb_devices lists connected devices and their state","source":"README.md","input":"adb_devices","expected":"adb device list","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"adb_devices","arguments":{},"expected_text":"List of devices attached","env":{"ADB_PATH":"/usr/bin/adb"},"cwd":"<guest-path>"}]
EOF
python3 -I -c 'import json;json.load(open(".coldpass/probe.json"));json.load(open(".coldpass/claims.json"));print("ok")'
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"adb_devices lists connected devices and their state","source":"Lists the connected devices and their state.","input":"adb_devices with no arguments","expected":"adb device list header","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"adb_devices","arguments":{},"expected_text":"List of devices attached","env":{"ADB_PATH":"/usr/bin/adb"},"cwd":"<guest-path>"},
{"kind":"claim","claim":"server calls adb for each request","source":"The server sends each request to the `adb` program.","input":"adb_devices","expected":"adb device list header","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"adb_devices","arguments":{},"expected_text":"List of devices attached","env":{"ADB_PATH":"/usr/bin/adb"},"cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && timeout 20 npm start < /dev/null; echo "exit=$?"
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"documented start command launches the MCP stdio server","source":"README.md Development section: npm start # run the compiled server","input":"empty stdin so the stdio server exits on EOF","expected":"server starts and exits 0","argv":["npm","start"],"cwd":"<guest-path>","env":{},"stdin":"","expected_text":"> [email protected] start"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: src/index.ts and package.json scripts (build, start, dev). The server is a stdio MCP server that only runs tool calls when a client sends them; there is no cron, scheduler, loop, webhook, or --once/--now option in the README or source.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import sys,json;d=json.load(sys.stdin);print(d.get("valid"),d.get("problems"));print(d.get("replay",{}).get("status"))' 2>&1 | head -30
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the adb-tv-mcp stdio MCP server and call the adb_devices tool, which lists ADB devices","operation_scope":"Linux (Ubuntu 24.04), Node v22.23.4 and npm 10.9.9 (README requires Node 18+), android platform-tools adb 1.0.41 from apt, no physical Android device attached, so the device list is empty","steps":["npm install","npm run build","sudo apt-get -o DPkg::Lock::Timeout=300 install -y adb","node <guest-path> (MCP stdio server) with tool adb_devices -> 'List of devices attached'","npm start (documented start command, run with empty stdin)"],"deviations":["adb was not preinstalled; installed Ubuntu package adb (platform-tools) via apt-get, as the README requires the Android platform-tools package","No Android device was available, so adb_devices returned only the empty header; device-control tools were not exercised against real hardware","The shared CDP browser endpoint was checked (HTTP 200) but not used, because this product does not need a browser","npm install reported audit advisories; not addressed, since they are not part of the README procedure"],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c 'import json;d=json.load(open(".coldpass/report.json"));print(d["outcome"], d["fault_owner"])'; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 400