Developers

Drive a device from your own code.

The same selector resolves a device across the Python and TypeScript SDKs, the CLI, and an MCP server. Streaming channels bring logs, shell, screen, and traffic back as first-class objects.

API reference View on GitHub

pentest.py

from orchard_sdk import Orchard
oc = Orchard(api_key="orc_...")
# spawn a masked Android device on the fleet
dev = oc.sandboxes.create(platform="android", image="cuttlefish", tag="pentest")
dev.wait_until("running")
# intercept TLS through your own Burp over a reverse tunnel
dev.proxy.tunnel(to="127.0.0.1:8080")
# bypass SSL pinning with a Frida script, stream the hooks back
for msg in dev.frida.stream(script="pinning-bypass.js"):
    print(msg["payload"])

Surfaces

Four ways in, one model.

Python SDK

orchard-sdk

Sandboxes, snapshots, templates, files & apps
Live channels: logs, shell, screen frames, mitm flows
frida inject/stream, debugger, gdb_bridge()
Sync and asyncio (orchard_sdk.aio)

TypeScript SDK

@orchard/sdk

A deliberately parallel API to Python
Channel<T> streams: for-await plus an emitter
Logs, shell, screen, and mitm as typed streams
First-class in Node and edge runtimes

CLI

orchard

sandbox, tag, input, frida, snapshot, template
adb, tunnel, scrcpy, vnc, screen, shell, logs
remote (cloud), debugger, gdb
--json everywhere for scripting

MCP server

orchard-mcp

Puts a device in front of an LLM agent
screenshot then tap / swipe / type / launch
frida_inject, gdb_bridge, screen_webrtc
The see, reason, tap loop over stdio

CI/CD

Create and test on real devices in your pipeline.

Short-lived, scoped API keys keep pipeline credentials tight. Create a device, run a job, tear it down, from the CI tool you already use.

GitHub Actions

GitLab CI

Jenkins

CircleCI

Travis CI

Build beyond real devices.

Spin up a device, drive it, inspect it. Self-hosted on your own fleet or in the cloud, with the SDK, CLI, and MCP your team already works in.

Launch console Request access

10 credits = $1 · self-host free · air-gapped ready