APKCube

MCP server · hosted · v1.0.0 · com.apkcube/apkcube

Online · tested 3h agoNEW · 5h agoSeen in the registry 4h ago

Search Android apps, check APK signing and scans, and get verified APK download links.

What it does

APKCube is an MCP server, a connector that lets an AI assistant use it as a tool. It is hosted: an assistant connects to it over the internet, nothing to install.

No capability identified yet from its description.

Facts come from the Official MCP Registry, as declared by the publisher. Capabilities are matched automatically (low confidence). None of this is a test of the tool.

At a glance

Hosted (remote)YES

Local installNO

Live checkOnline · 36 tools

Version1.0.0

PriceNot in the registry

First seen03 Nov 2026

Last checked4h ago

How to connect

As declared in the Official MCP Registry · hosted endpoint tested by Electra Index 3h ago (live check)

Hosted endpoint

https://apkcube.com/api/mcp streamable-http

In Claude Code: claude mcp add --transport http apkcube https://apkcube.com/api/mcp

MCP settings (Claude Desktop, Cursor and other MCP clients)

{
  "mcpServers": {
    "apkcube": {
      "url": "https://apkcube.com/api/mcp"
    }
  }
}

Live check

Electra Index connected to the hosted endpoint 3h ago

ONLINE APKCube answered an MCP connection on 03 Nov 2026 and introduced itself as apkcube 1.0.0 (MCP protocol 2025-06-18).

36 tools offered to AI assistants

search_apps · Search the APK catalogue by name, publisher or package id. Start here when you have a phrase and need a package name. Returns 24 results a page out of at most 60 matches, so paging stops at page 3 — narrow the phrase rather than paging for
get_app · Full record for one package: description, screenshots, rating, tags, and whether a download would be refused. Does NOT list downloadable files — use list_versions for those. An app not in the catalogue yet is looked up on Google Play live,
check_availability · Free. Whether we hold a downloadable build of each of up to 100 packages, the newest one's versionName and versionCode, and `versions`: every build we hold by versionCode and versionName, highest code first — the cheap way to check for upda
list_versions · Every APK/XAPK build held for a package, newest first, each with its SHA-256. Call this before get_download_url when you want a specific build — the apkId it returns is what that tool takes; without one it serves the newest. Free when we ho
get_download_url · Mint a short-lived signed URL for one build — the newest held unless you pass an apkId from list_versions. Costs 10 credits — the most expensive call here, and the only one that hands over a file. Check get_version_security before handing a
request_fetch · Ask us to download an app from Google Play when list_versions came back empty. Costs 10 credits, even when we already have builds (`READY`) or Google Play doesn't list the app — so call list_versions first. Free only when a fetch for the ap
get_fetch_status · Where the fetch request_fetch started stands now: FETCHING (keep waiting), READY (call list_versions), or FAILED with a reason. Free when the fetch is still running (`FETCHING`); the final answer costs 1 credit, and so does a check when no
request_variant · Ask for an on-demand build of an app's newest release that the ordinary download does not carry: every language (`+all-langs`), the 32-bit ARM build (`armeabi-v7a`), both ARM ABIs in one bundle (`universal`), the newest build for an older A
get_variant_status · Where one variant of an app stands: READY with the build (its `variantId` goes to get_download_url), FETCHING (keep waiting, 10–30 seconds between checks), FAILED with a reason (request_variant retries), or NEEDS_FETCH (nobody has asked for
list_developer_apps · Every app we hold from one publisher, most-installed first. The slug comes from `developerSlug` on any app row.
list_categories · The category taxonomy, for filtering a search. Free — this call costs no credits.
list_chart · A ranked section of the catalogue. Google Play's charts (hot, grossing, latest, editors-choice), the catalogue's newest releases (new), what people downloaded here in about the last day (popular), or the newest builds we stored (updated). A

Show 24 more

list_similar_apps · Apps related to one package — alternatives and neighbours, as the app's page on the site shows them. Free when there is nothing to list (an empty `items`). A package that is not in the catalogue is a 404 rather than a guess.
get_play_details · Google Play's full store listing for one package, in any storefront: the star histogram, install estimate, IAP price range, release date, declared permissions, content-rating descriptors, legal publisher and contact details — the store data
list_reviews · One page of Google Play user reviews for a package, live: stars, text, helpful votes, the app version the reviewer ran, and the developer's reply. Sort by newest (default), rating or helpfulness; up to 100 a page. Walk further pages by pass
get_version_security · What one build actually IS: its SHA-256, the anti-malware verdict, the certificates that signed it, and every Android permission it declares with a plain-English gloss. Defaults to the newest build, so you do not need list_versions first. `
list_sdks · What OTHER companies' code is inside an app: the ad, analytics, attribution, crash-reporting, push and sign-in libraries matched in the build, each with its vendor and where it was recognised. Defaults to the newest build. This is the priva
get_protection · Whether this build is wrapped in a commercial protector — DexProtector, Jiagu, Bangcle, Legu, AppSealing, Google's own PairIP — and what that means for everything else you can find out about it. Defaults to the newest build. A PROTECTOR IS
list_trackers · The privacy question on its own: which advertising, analytics, install-attribution, crash-reporting, push and social sign-in SDKs are in this build, and nothing else. `list_sdks` is the same evidence unfiltered — every recognised library in
list_permissions · Every Android permission this build declares, sensitive ones first, each with a readable label, its capability family and a sentence saying what the app can actually do with it. Defaults to the newest build. This is the same labelling compa
get_manifest · What the artifact's own AndroidManifest.xml says beyond the permissions it requests — targetSdk, compileSdk, debuggable, cleartext traffic, backup, sharedUserId, install location, uses-feature, uses-library, and the components it exports wi
get_raw_scan · The whole stored analysis record for one build, exactly as stored and with none of our rules applied — for when you want to judge the facts yourself rather than read our conclusions. It carries two things no other tool publishes: the EVIDEN
lookup_hash · Which app and which build a file checksum names. Use this when you have a hash and no package name — an APK pulled off a device, a sample from a threat feed, a digest in an incident report. Takes an MD5 (32 hex), SHA-1 (40) or SHA-256 (64)
lookup_certificate · Every package we hold that one signing certificate is on record for. Android only installs an update signed by the key that signed what is already on the device, which makes the signing key the closest thing an app has to an identity across
list_developer_certificates · Every signing key on record for one publisher's apps — lookup_certificate read the other way round. Each key says how many of the publisher's apps it signs and, in `elsewhere`, how many packages OUTSIDE the publisher it is also on: zero is
get_signing_history · Which certificate signed which releases of a package, and where the key moved. Android will only install an update signed by the key that signed what is already on the device, so a `hasKeyReplacement: true` means the newer build is not an u
compare_versions · What changed between two releases: permissions gained and lost, whether the signing key moved, size and minimum Android. Name either side by version name or by version code — the code is tried first, because a version name is free text the
get_apps · Summary rows for up to 100 package ids in one call — use this instead of calling get_app in a loop. Costs 1 credit PER PACKAGE, so a hundred ids cost a hundred credits however they arrive. Ids we do not hold come back in `notFound` rather t
get_account · How many credits are left on the key you are using, and what that key is. Free. Every successful call also reports this in `_meta`, so reach for this one when you need to know before you spend — a download costs 10 — or when your calls have
console_list_apps · The apps you manage in the APKCube Developers Console — every app of every developer whose team you are on, 50 a page, with your role on each. Only works for a signed-in user (OAuth) on a verified developer's team. Free.
console_app_stats · Downloads of one of your apps: per UTC day for the last 30 days (with the 30 before for comparison), the lifetime total, and the top countries of the last 7 days. Counts come from our own download log, not Google Play. Free.
console_list_uploads · Builds submitted for your apps from the console or the Publishing API, newest first, with each one's status (uploading, verifying, scanning, held, published, rejected …) and, for a held or rejected build, the reason and its stable code. Pas
console_upload_status · Where one upload stands, with the scan summary once it has one (VirusTotal counts, signing certificates and how each compares with the keys on record). Poll every 15–30 seconds while status is verifying, scanning or publishing; `held` waits
console_security_report · Every build we store for one of your apps with our scan verdict, VirusTotal counts, signature scheme, how its signing key compares with the keys on record, and any notice you have put on it — plus a one-line verdict on the signing history.
console_update_listing · Change the text visitors read on your app's page: the short description (≤80 characters), full description (≤4000, plain text), what's new (≤500) and a YouTube link. Omit a field to keep it; pass null or an empty string to show Google Play'
console_set_version_notice · Put a warning on one stored build of your app — `vulnerable` or `withdrawn`, a message of up to 300 characters, and optionally the version code to use instead — or lift it (`lift: true`). With `blockDownload: true` downloads of that build a

What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method

Is this your server? Monitoring Pro: a check every 30 minutes and an email within the hour when it stops answering. Launch offer: $39.99 once, for life.

Facts & evidence

Each fact shows where it was seen and when.

Fact	Value	Evidence	Source	Last confirmed
Hosted endpoint	https://apkcube.com/api/mcp	DECLARED	SRC-001 Official MCP Registry	4h ago
Local install (package)	no	DECLARED	SRC-001 Official MCP Registry	4h ago
Remote access (hosted)	yes	DECLARED	SRC-001 Official MCP Registry	4h ago
Website	https://apkcube.com/docs/mcp	DECLARED	SRC-001 Official MCP Registry	4h ago
Registry status	active	DECLARED	SRC-001 Official MCP Registry	4h ago
Version	1.0.0	DECLARED	SRC-001 Official MCP Registry	4h ago
MCP server	yes	DECLARED	SRC-001 Official MCP Registry	4h ago

Change history

NEW03 Nov 2026
first seen in the index

Is this page accurate?

Flag it and our robot re-checks the official source. Reports never change a score.

Is APKCube still online?

Free alerts · no account▲ 0

Do you run APKCube? Know when it stops answering

For publishers · optional

Its hosted endpoint can be monitored. Monitoring Pro connects every 30 minutes like an AI assistant, emails you within the hour when it stops answering, keeps a 90-day availability history and adds your answer rate to your badge.

Monitor APKCubeLaunch offer $39.99 once, for life instead of $9.99/month · All plans

Monitoring never changes a score or a rank.

Questions about APKCube

How do I connect APKCube?

Use the hosted endpoint https://apkcube.com/api/mcp in your assistant's MCP settings. The exact settings are in "How to connect" above, as declared in the Official MCP Registry.

What tools does APKCube offer?

When Electra Index connected on 03 Nov 2026, it listed 36 tools: search_apps, get_app, check_availability, list_versions, get_download_url, request_fetch, get_fetch_status, request_variant and more. The full list is in "Live check" above.

Is APKCube online?

Yes. Its hosted endpoint answered an MCP connection from Electra Index 3h ago.