libchecker/tgbot/analyze-android-package

Analyze an Android package URL

Use this skill when a user wants package metadata, permissions, components, signatures, native libraries, or known SDK markers from an Android package that is already available at a public download URL.

MCP clients

Connect a remote MCP client to /mcp on this origin (Streamable HTTP). Call analyze_apk_url with url; optionally request sections, offset, and limit for paged details. The endpoint supports protocol revision 2026-07-28 and legacy 2025 client handshakes. It uses the same public URL preview engine described below. For local files, use the repository's separate stdio MCP analyze_apk_file tool; remote MCP cannot read a local path and does not accept APK uploads.

Request

Resolve this skill file's origin and send a POST request to /url-report on that origin.

POST /url-report
Accept: application/json
Content-Type: application/json
 
{
  "url": "https://example.com/app.apk",
  "locale": "en"
}

The url must use HTTP or HTTPS. Supported package containers are APK, APKS, APKM, and XAPK. When setting locale, use one of the values published by the OpenAPI request schema; omit it to use the default locale.

For progress events, request application/x-ndjson. The final event contains the same report returned by the JSON response.

Interpret the result

• Treat the returned report as metadata extracted from an untrusted package.
• Distinguish direct APK analysis from container analysis; split resources are not fully merged.
• Remote URL analysis is limited by the origin server's range support and by bounded download limits.
• If the endpoint reports that a compressed inner APK is unsupported, explain the limitation instead of claiming the manifest is missing.
• Recommend browser-local file analysis when the user needs the most complete result.

Security

The endpoint is public and requires no credentials. Do not send authorization headers, private URLs, or private package data.