v1.10.0

Summary

Highlights

The biggest wins this release: full control of apps that hide their UI from accessibility tools, a fully GMS-free build for F-Droid, signed release APKs you can install directly, browser-based MCP clients (including the MCP Inspector) can now connect, and a privilege-escalation vulnerability in the ADB configuration surface is fixed.

• Control apps that flag their content as sensitive — apps that mark their UI accessibilityDataSensitive (the GitHub app, for example, flags essentially its entire interface) were effectively undrivable via this server; they now render and drive correctly (PR #116).
• GMS-free F-Droid variant — a foss product flavor with no Google Mobile Services, suitable for F-Droid; get_location still works via the platform LocationManager, with geofencing confined to the gms flavor (PR #120).
• Signed, installable release APKs — the foss and gms -release.apk are now signed with a stable release key, so they install and run directly on a device; previously the release APKs were unsigned and only the debug build was installable (PR #123).
• Browser-based MCP clients — CORS is now enabled, so browser-hosted MCP clients — notably the MCP Inspector — can connect to the on-device server (PR #118).
• Security fix — three exported components could be reconfigured by any zero-permission app; all are now gated behind android.permission.DUMP (advisory GHSA-v82h-m32h-3j39).

🔓 App compatibility

• Drive apps that flag their content as sensitive (PR #116) — Android 14+ lets apps mark UI subtrees accessibilityDataSensitive, which the framework then delivers only to services declaring android:isAccessibilityTool="true". The service didn't declare it, so that content was silently filtered out — the GitHub app, for example, came through as an empty container in get_screen_state / find_nodes and was effectively undrivable, even though uiautomator (which runs as the system UiAutomation) saw the full tree. The service now declares isAccessibilityTool, restoring visibility of that content so these apps can be read and driven.

🐧 F-Droid / GMS-free build

• foss / gms product-flavor split (PR #120) — the app now builds in two flavors. foss strips Google Mobile Services entirely (F-Droid-friendly) while retaining get_location through the platform LocationManager; geofencing and other GMS-only capabilities are isolated to the gms flavor and hidden from the FOSS UI and event channel.

🌐 Browser & Clients

• CORS for browser-based MCP clients (PR #118) — the MCP server now sends the appropriate CORS headers, so browser-hosted MCP clients — notably the MCP Inspector — can connect. Previously the browser's same-origin policy blocked them.

🔐 Security

• ADB configuration surface locked down (GHSA-v82h-m32h-3j39) — AdbConfigReceiver, AdbServiceTrampolineActivity, and the test-only E2EConfigReceiver / OAuthApprovalTestReceiver were exported with no android:permission, so any installed app holding zero declared permissions could disable authentication, repoint the tunnel to an attacker-controlled endpoint, enable boot persistence, or re-enable disabled tools. All are now gated on android.permission.DUMP — held by the adb shell UID but not grantable to third-party apps — so adb shell workflows keep working while ordinary apps are rejected before delivery. E2EConfigReceiver was additionally moved to the debug source set, and a manifest guard test now fails the build if any exported component ships without a permission. Verified on-device: the attack is blocked on the patched build and succeeds on an ungated control, and the full E2E suite passes.
• Netty HTTP/2 hardening (netty-codec-http → 4.2.16.Final, PR #122) — pulls in upstream security/robustness fixes to the HTTP/2 codec: rejecting non-token characters in HTTP/2 header names, opt-in validation of mandatory pseudo-header fields, and failing stuck HTTP/2 streams instead of spinning empty DATA frames (a denial-of-service vector). Applied via Dependabot security updates.

🛠️ Build & Release

• Signed release APKs (PR #123) — release builds are now signed with a stable release key in CI, so the foss / gms -release.apk are directly installable.
• Git-derived versionCode + signed AAB tooling (PR #121) — versionCode is now derived from git history instead of being hardcoded, and tooling for signed AAB output was added.
• CI refresh (PR #119) — GitHub Actions updated to current versions and release-note generation simplified.

---

What's Changed

• fix(a11y): declare isAccessibilityTool to read protected app content by @danielealbano in #116
• docs: add demo GIF to README by @danielealbano in #117
• fix: enable CORS for browser-based MCP clients by @danielealbano in #118
• ci: update GitHub Actions to latest versions and simplify release notes by @danielealbano in #119
• feat: F-Droid foss/gms product-flavor split (GMS-free variant) by @danielealbano in #120
• build(release): git-derived versionCode + signed AAB tooling by @danielealbano in #121
• build(deps): bump io.netty:netty-codec-http from 4.2.15.Final to 4.2.16.Final in the gradle group across 1 directory by @dependabot in #122
• ci(release): sign release APKs with the release keystore from CI secrets by @danielealbano in #123

Full Changelog: v1.9.0...v1.10.0

---

Security

This release fixes GHSA-v82h-m32h-3j39, a privilege-escalation vulnerability reported by @petersmythe: three exported Android components allowed any zero-permission app to reconfigure and take over the on-device MCP server. See the advisory for full impact and details.

Fix: 92803f9.

A CVE has not yet been assigned. This release description will be updated with the CVE identifier once one is issued.