pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "android-mcp"
version = "0.1.0"
description = "Mobile security audit MCP server — wraps apktool, jadx, mobsf, androguard, frida-helpers, and adjacent Android security tooling under one MCP surface"
requires-python = ">=3.12"
license = "AGPL-3.0-or-later"
readme = "README.md"

dependencies = [
    "fastmcp>=2.0.0",
    "fastapi>=0.115.0",
    "uvicorn>=0.30.0",
    "anyio>=4.0.0",
    "pydantic>=2.0.0",
    # Mobile-security toolchain — installed as PEP517 deps where possible,
    # shelled out to OS packages where not. See README "Installing the
    # backend tools" for the OS-package shopping list (apktool, jadx CLI,
    # frida, etc.).
    "androguard>=4.0.0",          # APK static analysis (manifest, dex, signatures)
    "yara-python>=4.5.0",         # malware-rule scanning over decompiled output
    "lief>=0.16.0",                # ELF/Mach-O inside APKs (native .so files)
    "cryptography>=42.0.0",       # certificate / signing analysis
    "requests>=2.31.0",            # MobSF REST API client
    # React Native bundle extraction: hermes-dec decodes Hermes bytecode
    # (.hbc) bundles to readable JS, jsbeautifier unminifies plain JS
    # bundles so downstream tree-sitter slicing can find declaration
    # boundaries. tree_sitter + tree_sitter_javascript drive the slicer
    # itself. All four are pure-Python so they install cleanly inside
    # the FastMCP runtime.
    "hermes-dec>=1.0.0",           # Hermes (.hbc) decompiler — pure Python
    "jsbeautifier>=1.15.0",        # plain-JS unminifier
    "tree-sitter>=0.21.0",         # syntactic slicer engine
    "tree-sitter-javascript>=0.21.0",   # JS grammar for the slicer
]

[project.optional-dependencies]
dynamic = [
    # Optional — only needed if you want to drive Frida from inside this MCP
    # instead of running it externally. Most operators keep frida out of the
    # MCP and use the dedicated frida-server-on-device flow.
    "frida>=16.0.0",
    "frida-tools>=12.0.0",
]
scanners = [
    # Optional pure-Python static scanners that this MCP shells out to.
    # Operators install these into the same venv they run android-mcp from
    # so the CLIs land on PATH. CLIs that are not pip-installable (apktool,
    # jadx, adb, drozer-agent, AndroBugs, MobSF) stay in the OS-prereq
    # README table — they cannot be expressed here.
    "qark>=4.0.0",
    "objection>=1.11.0",
]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "ruff>=0.5.0",
    "mypy>=1.10",
    # JSON Schema 2020-12 validator — drives tests/test_schemas.py which
    # asserts every registered MCP tool exposes a valid input schema.
    "jsonschema>=4.21",
    # FastAPI TestClient transport — pytest hits build_app() over HTTP
    # instead of poking the tool index directly, so the test matches the
    # AILA bridge's real call shape.
    "httpx>=0.27",
]

[project.scripts]
android-mcp = "android_mcp.__main__:main"

[tool.ruff]
target-version = "py312"
line-length = 120

[tool.pytest.ini_options]
asyncio_mode = "auto"
# Make `pytest` work from a clean checkout without requiring PYTHONPATH=src
# or `pip install -e .`. Standard pytest idiom for src/ layouts (pytest >= 7).
pythonpath = ["src"]