原型 · 预览版:收录官方注册中心里的全部服务器,每 30 分钟同步一次。评价和账户功能将在后续阶段推出。
PopNx MCP为使用 AI 的人准备的 MCP 服务器 · 用大白话讲清楚

APKCube

作者:apkcube.com版本 1.0.0i★ –i在云端运行
注册名称com.apkcube/apkcube

安装

概览

作者提供的说明(英文原文)

Search Android apps, check APK signing and scans, and get verified APK download links.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数:意见、测量和人气是不同的东西。

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

  • 连接方式: 在云端运行
  • 传输方式: Streamable HTTP
  • 分类: 搜索与 AI 记忆

安装

选择你使用的 AI 应用,然后复制设置。

安装之前

你需要

你用的是哪个应用?

在上方选择你的应用。我们会记住它,下次按钮会显示“安装到 …”。

适用于网页版、桌面版和手机版 Claude:

  1. 打开 Settings → Connectors
  2. 点击 Add custom connector
  3. 粘贴下面的地址,然后点击 Add
  4. 如果要求登录,请登录作者的服务
SettingsConnectors1+ Add2https://…3
https://apkcube.com/api/mcp

在终端中运行这条命令

claude mcp add --transport http apkcube https://apkcube.com/api/mcp

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "apkcube": {
      "url": "https://apkcube.com/api/mcp"
    }
  }
}

浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "apkcube": {
      "type": "http",
      "url": "https://apkcube.com/api/mcp"
    }
  }
}

浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。

ChatGPT 只能连接互联网上的服务器:

  1. 打开网页版 ChatGPT → Settings → Connectors (Apps)
  2. 点击 Create 或 Add(部分套餐需要先在 Advanced 中开启 Developer mode)
  3. 粘贴下面的地址,起个名字,然后保存
  4. 如果要求登录,请登录作者的服务
SettingsConnectors1+ Create2https://…3
https://apkcube.com/api/mcp

菜单名称可能因套餐和版本不同而略有差异。

你的选择通过 Cookie 保存在这台设备上,无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同,请以 README 为准。

它能做什么

工具名称和描述与服务器在 2026年11月6日 报告的完全一致。这些内容由作者撰写,不是我们写的;我们以纯文本形式显示。

  • search_apps

    Search the APK catalogue by name, publisher or package id. Start here when you have a phrase and need a package name. Returns 24 results a page out of at most 60 matches, so paging stops at page 3 — narrow the phrase rather than paging for more. `facets` counts the matches by typ

  • get_app

    Full record for one package: description, screenshots, rating, tags, and whether a download would be refused. Does NOT list downloadable files — use list_versions for those. An app not in the catalogue yet is looked up on Google Play live, for up to 20 seconds; UPSTREAM_UNAVAILAB

  • check_availability

    Free. Whether we hold a downloadable build of each of up to 100 packages, the newest one's versionName and versionCode, and `versions`: every build we hold by versionCode and versionName, highest code first — the cheap way to check for updates before calling list_versions or get_

  • list_versions

    Every APK/XAPK build held for a package, newest first, each with its SHA-256. Call this before get_download_url when you want a specific build — the apkId it returns is what that tool takes; without one it serves the newest. Free when we hold no builds for the package (an empty l

  • get_download_url

    Mint a short-lived signed URL for one build — the newest held unless you pass an apkId from list_versions. Costs 10 credits — the most expensive call here, and the only one that hands over a file. Check get_version_security before handing anything to a person. The URL expires in

  • request_fetch

    Ask us to download an app from Google Play when list_versions came back empty. Costs 10 credits, even when we already have builds (`READY`) or Google Play doesn't list the app — so call list_versions first. Free only when a fetch for the app is already running (`FETCHING`). A fet

  • get_fetch_status

    Where the fetch request_fetch started stands now: FETCHING (keep waiting), READY (call list_versions), or FAILED with a reason. Free when the fetch is still running (`FETCHING`); the final answer costs 1 credit, and so does a check when no fetch was requested (`FETCH_NOT_FOUND`).

  • request_variant

    Ask for an on-demand build of an app's newest release that the ordinary download does not carry: every language (`+all-langs`), the 32-bit ARM build (`armeabi-v7a`), both ARM ABIs in one bundle (`universal`), the newest build for an older Android version (`@sdkNN`), or exactly wh

  • get_variant_status

    Where one variant of an app stands: READY with the build (its `variantId` goes to get_download_url), FETCHING (keep waiting, 10–30 seconds between checks), FAILED with a reason (request_variant retries), or NEEDS_FETCH (nobody has asked for it, or it expired — call request_varian

  • list_developer_apps

    Every app we hold from one publisher, most-installed first. The slug comes from `developerSlug` on any app row.

  • list_categories

    The category taxonomy, for filtering a search. Free — this call costs no credits.

  • list_chart

    A ranked section of the catalogue. Google Play's charts (hot, grossing, latest, editors-choice), the catalogue's newest releases (new), what people downloaded here in about the last day (popular), or the newest builds we stored (updated). An unrecognised section falls back to 'ho

  • list_similar_apps

    Apps related to one package — alternatives and neighbours, as the app's page on the site shows them. Free when there is nothing to list (an empty `items`). A package that is not in the catalogue is a 404 rather than a guess.

  • get_play_details

    Google Play's full store listing for one package, in any storefront: the star histogram, install estimate, IAP price range, release date, declared permissions, content-rating descriptors, legal publisher and contact details — the store data get_app leaves out. Usually null: the w

  • list_reviews

    One page of Google Play user reviews for a package, live: stars, text, helpful votes, the app version the reviewer ran, and the developer's reply. Sort by newest (default), rating or helpfulness; up to 100 a page. Walk further pages by passing `nextCursor` back as `cursor` with t

  • get_version_security

    What one build actually IS: its SHA-256, the anti-malware verdict, the certificates that signed it, and every Android permission it declares with a plain-English gloss. Defaults to the newest build, so you do not need list_versions first. `findings` is the part to read first: it

  • list_sdks

    What OTHER companies' code is inside an app: the ad, analytics, attribution, crash-reporting, push and sign-in libraries matched in the build, each with its vendor and where it was recognised. Defaults to the newest build. This is the privacy question, not the safety one — these

  • get_protection

    Whether this build is wrapped in a commercial protector — DexProtector, Jiagu, Bangcle, Legu, AppSealing, Google's own PairIP — and what that means for everything else you can find out about it. Defaults to the newest build. A PROTECTOR IS NOT A MALWARE SIGNAL: anti-piracy, anti-

  • list_trackers

    The privacy question on its own: which advertising, analytics, install-attribution, crash-reporting, push and social sign-in SDKs are in this build, and nothing else. `list_sdks` is the same evidence unfiltered — every recognised library including HTTP clients and UI toolkits — s

  • list_permissions

    Every Android permission this build declares, sensitive ones first, each with a readable label, its capability family and a sentence saying what the app can actually do with it. Defaults to the newest build. This is the same labelling compare_versions diffs, so the two cannot nam

  • get_manifest

    What the artifact's own AndroidManifest.xml says beyond the permissions it requests — targetSdk, compileSdk, debuggable, cleartext traffic, backup, sharedUserId, install location, uses-feature, uses-library, and the components it exports without a permission guard — plus the nati

  • get_raw_scan

    The whole stored analysis record for one build, exactly as stored and with none of our rules applied — for when you want to judge the facts yourself rather than read our conclusions. It carries two things no other tool publishes: the EVIDENCE DIGEST every SDK match is drawn from

  • lookup_hash

    Which app and which build a file checksum names. Use this when you have a hash and no package name — an APK pulled off a device, a sample from a threat feed, a digest in an incident report. Takes an MD5 (32 hex), SHA-1 (40) or SHA-256 (64) and works out which from the length, so

  • lookup_certificate

    Every package we hold that one signing certificate is on record for. Android only installs an update signed by the key that signed what is already on the device, which makes the signing key the closest thing an app has to an identity across package names — so a key you found on o

  • list_developer_certificates

    Every signing key on record for one publisher's apps — lookup_certificate read the other way round. Each key says how many of the publisher's apps it signs and, in `elsewhere`, how many packages OUTSIDE the publisher it is also on: zero is ordinary, above zero is a key shared acr

  • get_signing_history

    Which certificate signed which releases of a package, and where the key moved. Android will only install an update signed by the key that signed what is already on the device, so a `hasKeyReplacement: true` means the newer build is not an update of the older one — it is a differe

  • compare_versions

    What changed between two releases: permissions gained and lost, whether the signing key moved, size and minimum Android. Name either side by version name or by version code — the code is tried first, because a version name is free text the developer sets and is often a placeholde

  • get_apps

    Summary rows for up to 100 package ids in one call — use this instead of calling get_app in a loop. Costs 1 credit PER PACKAGE, so a hundred ids cost a hundred credits however they arrive. Ids we do not hold come back in `notFound` rather than failing the call. Returns the SUMMAR

  • get_account

    How many credits are left on the key you are using, and what that key is. Free. Every successful call also reports this in `_meta`, so reach for this one when you need to know before you spend — a download costs 10 — or when your calls have been failing and you have not seen a ba

  • console_list_apps

    The apps you manage in the APKCube Developers Console — every app of every developer whose team you are on, 50 a page, with your role on each. Only works for a signed-in user (OAuth) on a verified developer's team. Free.

  • console_app_stats

    Downloads of one of your apps: per UTC day for the last 30 days (with the 30 before for comparison), the lifetime total, and the top countries of the last 7 days. Counts come from our own download log, not Google Play. Free.

  • console_list_uploads

    Builds submitted for your apps from the console or the Publishing API, newest first, with each one's status (uploading, verifying, scanning, held, published, rejected …) and, for a held or rejected build, the reason and its stable code. Pass packageName for one app. Free.

  • console_upload_status

    Where one upload stands, with the scan summary once it has one (VirusTotal counts, signing certificates and how each compares with the keys on record). Poll every 15–30 seconds while status is verifying, scanning or publishing; `held` waits for a person and can take days. Free.

  • console_security_report

    Every build we store for one of your apps with our scan verdict, VirusTotal counts, signature scheme, how its signing key compares with the keys on record, and any notice you have put on it — plus a one-line verdict on the signing history. `verdict: null` means not scanned, which

  • console_update_listing

    Change the text visitors read on your app's page: the short description (≤80 characters), full description (≤4000, plain text), what's new (≤500) and a YouTube link. Omit a field to keep it; pass null or an empty string to show Google Play's text for it. Goes live immediately; ou

  • console_set_version_notice

    Put a warning on one stored build of your app — `vulnerable` or `withdrawn`, a message of up to 300 characters, and optionally the version code to use instead — or lift it (`lift: true`). With `blockDownload: true` downloads of that build are refused. Applies immediately and is r

  • console_publish_upload

    Publish one of your uploads that passed its checks and is waiting as `ready` — because it was uploaded with a manual release, or is scheduled and you want it out now. It becomes downloadable at once. Refused unless the upload's status is `ready`. Needs the uploader role or above.

  • console_set_upload_release

    For one of your uploads that is not yet published: set its release to `auto` (publish when it passes), `manual` (wait for console_publish_upload) or `scheduled` with `releaseAt` (an ISO-8601 time with its offset, at least 10 minutes ahead). `manual` also cancels a schedule. Can i

基础检查i

我们检查的是任何人都能看到的信息;我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

  • ! 注意

    作者与仓库一致

    注册中心没有列出源代码仓库,因此无法将发布者(apkcube.com)与代码对应起来

  • … 尚未检查

    仍在维护

    我们还没有从 GitHub 读取这个仓库

  • … 尚未检查

    有许可证

    我们还没有从 GitHub 读取这个仓库

  • ✓ 通过

    端点有响应

    在 1836 毫秒内响应(HTTP 200)

  • – 不适用

    使用 OAuth 登录

    无需登录

  • ✓ 通过

    工具描述中没有隐藏指令

    已读取 38 个工具描述,未发现针对 AI 的隐藏指令

与“搜索与 AI 记忆”中的其他服务器比较i

  • 星标数多于此分类中其他 5654 个服务器的 0%
  • 发布到注册中心的时间比此分类中其他 5654 个服务器的 91% 更新
  • 基础检查结果等于或优于此分类中其他 5654 个服务器的 39%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时,星标数才计入。

常见问题

APKCube 安全吗?

它在 3 项适用的基础检查中通过了 2 项。我们没有阅读代码。在添加密钥或令牌之前,请先看看这个服务器要求哪些权限,并使用只具备所需权限的密钥。

它需要哪些密钥或代码?

注册中心没有列出必需的密钥,不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端?

它在作者的云端运行。通过互联网连接,无需安装,但你发送的内容会经过作者的服务器。

它还在维护吗?

GitHub 仓库最后更新于–,最新版本(1.0.0)于4天前进入注册中心。

哪些应用可以使用它?

支持 MCP 的应用,例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接,所以接受远程 MCP 服务器的应用也可以使用,例如开启开发者模式的 ChatGPT。

有什么可以替代它?

同一分类中有:Context7, Codebase Memory, Exa

替代选择

同一分类中其他作者的服务器,按星标数排序。

如何看卡片:★ GitHub 星标i三大支柱:评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Context7

作者:upstash

Up-to-date docs for AI agents

电脑或云端★ 64,224MIT昨天更新
安装

Codebase Memory

作者:DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

在你的电脑上运行★ 48,148MIT21天前更新
安装

Exa

作者:exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

在云端运行★ 5,213MIT2个月前更新
安装

作者的 README

仓库中没有找到 README

问 PopNx