{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-26","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"api.agi.tech lets an agent operate a connected Android phone through its screen. Start tasks that tap or type, inspect device state, and monitor or pause execution.","did":"ff80287d-84b3-467f-9b41-a335ba66e4e7","documentation_url":"https://docs.agi.tech/android-mcp","editorial_description":{"extended_description":"Manage device sessions, select a default device, and resume or cancel tasks. Uses include app testing and recurring phone workflows.","schema_version":1,"summary":"api.agi.tech lets an agent operate a connected Android phone through its screen.\nStart tasks that tap or type, inspect device state, and monitor or pause execution."},"homepage_url":"","icon":"","id":"ff80287d-84b3-467f-9b41-a335ba66e4e7","installs":0,"last_scanned":"","license":"","long_description":"Manage device sessions, select a default device, and resume or cancel tasks. Uses include app testing and recurring phone workflows.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The listing says the agent can use the entire phone and every app by tapping and typing like the user, without per-app integrations.","reasoning":"This is unrestricted GUI/device control over potentially banking, email, messaging, authentication, and enterprise apps.","risk_type":"browser_control","severity":"high","title":"Arbitrary phone apps can be tapped and typed into","triggering_tools_or_skills":["phone_run_task","phone_task_message","phone_session_start"]},{"evidence":"phone_run_task delegates an open-ended task whose concrete UI actions are determined at runtime across installed apps.","reasoning":"The effective action set is dynamic and can cause arbitrary side effects within device permissions.","risk_type":"code_execution","severity":"high","title":"Natural-language tasks execute hidden app actions","triggering_tools_or_skills":["phone_run_task","phone_task_resume","phone_task_cancel"]},{"evidence":"Because the tool can type/tap in every app, it can operate email, SMS, chat, and social applications.","reasoning":"Messages may be sent as the device owner unless strict per-action confirmation is enforced.","risk_type":"messaging_as_user","severity":"high","title":"Phone control can send communications through installed apps","triggering_tools_or_skills":["phone_run_task"]},{"evidence":"The claimed every-app control includes finance and commerce applications unless explicitly blocked.","reasoning":"Runtime device policies must prevent unconfirmed purchases, transfers, or subscription changes.","risk_type":"financial_transaction","severity":"high","title":"Phone control can reach payment and banking apps","triggering_tools_or_skills":["phone_run_task"]},{"evidence":"The connector selects devices and starts/stops or pauses/resumes control sessions.","reasoning":"These are privileged remote-device access controls.","risk_type":"credential_admin","severity":"high","title":"Device sessions and default-device selection can be administered","triggering_tools_or_skills":["set_default_device","phone_session_start","phone_session_end","phone_device_pause","phone_device_resume"]},{"evidence":"An agent controlling every app can see notifications, messages, documents, contacts, authentication prompts, and other private screen content.","reasoning":"This is an exceptionally broad private-data surface.","risk_type":"private_data_read","severity":"medium","title":"All on-screen app data may be exposed","triggering_tools_or_skills":["phone_get_state","phone_task_monitor","phone_run_task"]},{"evidence":"The inventory contains one generic task runner instead of enumerating app-specific capabilities.","reasoning":"The action surface changes with every installed app and device state, requiring runtime policy enforcement and audit.","risk_type":"generic_gateway","severity":"high","title":"Open-ended phone tasks hide downstream actions","triggering_tools_or_skills":["phone_run_task"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants remote control of an entire Android phone and every installed app; exact device/user confirmation and OS permissions are not stated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/ff80287d-84b3-467f-9b41-a335ba66e4e7.json","what_it_proves":"Candidate PR #125 record identity (name \"api.agi.tech\", publisher, type web_connector) and 15 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/ff80287d-84b3-467f-9b41-a335ba66e4e7: complete tool_names inventory (15 tools), remote streamable-http endpoint https://api.agi.tech/v1/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"api.agi.tech provides open-ended control over an entire phone, including arbitrary apps, communications, credentials, and potential payments.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:ff80287d-84b3-467f-9b41-a335ba66e4e7","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 15 tools; the connector should be treated as a high-privilege remote-control agent requiring granular confirmation and strong audit isolation.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"false","browser_control":"true","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":15,"tools_or_skills_total":15},"name":"api.agi.tech","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=ff80287d-84b3-467f-9b41-a335ba66e4e7&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://theagi.company/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"AGI, Inc.","publisher_url":"https://theagi.company/blog/agi-mcp-for-every-app-on-your-phone","remote_url":"https://api.agi.tech/v1/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: This is unrestricted GUI/device control over potentially banking, email, messaging, authentication, and enterprise apps.","evidence":"Arbitrary phone apps can be tapped and typed into: The listing says the agent can use the entire phone and every app by tapping and typing like the user, without per-app integrations.","manual_risk_type":"browser_control","remediation":{"block_tool_categories":["state_change"],"steps":["Use an isolated browser profile without unrelated authenticated sessions.","Require confirmation before form submission, download, upload, or purchase actions."]},"risk_type":"browser_control","severity":"high","title":"Arbitrary phone apps can be tapped and typed into","triggering_tools":["phone_run_task","phone_task_message","phone_session_start"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The effective action set is dynamic and can cause arbitrary side effects within device permissions.; The action surface changes with every installed app and device state, requiring runtime policy enforcement and audit.","evidence":"Natural-language tasks execute hidden app actions: phone_run_task delegates an open-ended task whose concrete UI actions are determined at runtime across installed apps. | Open-ended phone tasks hide downstream actions: The inventory contains one generic task runner instead of enumerating app-specific capabilities.","manual_risk_type":"code_execution,generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Can execute code, queries, or dynamic actions","triggering_tools":["phone_run_task","phone_task_resume","phone_task_cancel"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Messages may be sent as the device owner unless strict per-action confirmation is enforced.","evidence":"Phone control can send communications through installed apps: Because the tool can type/tap in every app, it can operate email, SMS, chat, and social applications.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Phone control can send communications through installed apps","triggering_tools":["phone_run_task"]},{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Runtime device policies must prevent unconfirmed purchases, transfers, or subscription changes.","evidence":"Phone control can reach payment and banking apps: The claimed every-app control includes finance and commerce applications unless explicitly blocked.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Phone control can reach payment and banking apps","triggering_tools":["phone_run_task"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls.","evidence":"Device sessions and default-device selection can be administered: The connector selects devices and starts/stops or pauses/resumes control sessions.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Device sessions and default-device selection can be administered","triggering_tools":["set_default_device","phone_session_start","phone_session_end","phone_device_pause","phone_device_resume"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: This is an exceptionally broad private-data surface.","evidence":"All on-screen app data may be exposed: An agent controlling every app can see notifications, messages, documents, contacts, authentication prompts, and other private screen content.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"medium","title":"All on-screen app data may be exposed","triggering_tools":["phone_get_state","phone_task_monitor","phone_run_task"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@agi.tech","tags":["accesses_messaging","browser_control","modifies_data","network_access","oauth_required","reads_private_data","runs_code","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"list_devices"},{"description":"","name":"phone_device_pause","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls."}},{"description":"","name":"phone_device_resume","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls."}},{"description":"","name":"phone_device_status"},{"description":"","name":"phone_get_state","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is an exceptionally broad private-data surface."}},{"description":"","name":"phone_run_task","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Runtime device policies must prevent unconfirmed purchases, transfers, or subscription changes."}},{"description":"","name":"phone_session_end","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls."}},{"description":"","name":"phone_session_start","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls."}},{"description":"","name":"phone_task_cancel","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The effective action set is dynamic and can cause arbitrary side effects within device permissions.; The action surface changes with every installed app and device state, requiring runtime policy enforcement and audit."}},{"description":"","name":"phone_task_message","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: This is unrestricted GUI/device control over potentially banking, email, messaging, authentication, and enterprise apps."}},{"description":"","name":"phone_task_monitor","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is an exceptionally broad private-data surface."}},{"description":"","name":"phone_task_pause"},{"description":"","name":"phone_task_resume","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The effective action set is dynamic and can cause arbitrary side effects within device permissions.; The action surface changes with every installed app and device state, requiring runtime policy enforcement and audit."}},{"description":"","name":"phone_task_status"},{"description":"","name":"set_default_device","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are privileged remote-device access controls."}}],"tools_count":15,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/ff80287d-84b3-467f-9b41-a335ba66e4e7","uuid":"ff871df4-19ef-5640-8dc6-943fb176bd22","verification_tier":"community","version":""},"query_key":"api agi tech","schema_version":1,"status":"match"}