Androidacy Module Manager keeps Magisk modules installable after Magisk Manager dropped them

The gap left by Magisk Manager dropping online module downloads

The official Magisk Manager app has discontinued support for online module downloads, which removes the download half of the workflow for anyone who wants the zip packages that plug into the Magisk framework on a rooted device. Androidacy Module Manager, previously known as Fox's Magisk Module Manager and abbreviated FoxMMM, exists to cover that half: it finds modules, installs them, keeps them updated, and lets you add repositories beyond the default ones. The project states plainly that it is not officially endorsed by Magisk, KernelSU, Google, or any other affiliated entity, so it should be read as a third party app in the Magisk ecosystem rather than an official channel. It is written in Kotlin, and the developer describes the V3 line as a bottom up rewrite in Kotlin and Compose with near zero webviews, aiming at a faster experience than the earlier build. The intended user is narrow but clear: a rooted device owner who already has Magisk working, wants a searchable index of modules, and is willing to install one more app to manage them.

Repositories, search and automatic updates form the actual mechanism

The app is organised around repositories rather than around a single built-in catalogue. The feature list covers downloading, installing and managing modules, searching for new ones, adding your own repositories, automatic updates, monet theming, and an MD3 compliant interface. Two repositories ship as defaults. The first is the official Androidacy repository, described as fast, optimised and secure, and it may show non-intrusive ads. The second is the Magisk Alt Repo, a community-driven collection that the README explicitly says is not affiliated with Magisk or Topjohnwu and may contain low quality or malicious modules. Automatic updates are the part that changes daily behaviour, because modules are small packages that can go stale quickly and a rooted system is exactly the kind of system where a stale module quietly conflicts with a newer system app. The consequence is that the trust boundary of this project is not the app binary, it is whatever repository you let it read from.

Getting the APK: no F-Droid build, no install command

There is no install command to copy here, and the documentation does not pretend otherwise. The stated path is to visit the Androidacy downloads page on the developer website and download the latest .apk for the device architecture in question, so the reader is choosing an architecture specific binary by hand rather than letting a package manager resolve it. The project is also listed on Google Play under the application id com.androidacy.modulemanager, and the README points there with a Google Play badge, so the Play listing is a second distribution route for the same app. F-Droid builds are explicitly out of scope: the README says they are no longer being maintained, asks users not to use them, and warns that they are no longer considered official and may be broken or missing features. A first real use therefore means picking a device architecture, obtaining the .apk, installing it, then adding a module from one of the two default repositories and letting automatic updates handle it from then on.

Expired builds are a deliberate brake on old installs

This project is unusual in that it deliberately expires its own binaries. The README states that all builds before 2.3.7 are expired and cannot be used, and that 2.3.8 is now expired as well, with the recommendation to use the v3 version. It also labels the app as currently in maintenance mode. The release history behind that wording shows v2.3.8-1 dated 2025-03-31, v2.3.7 dated 2024-03-17, and v2.3.6 dated 2024-01-04, so the older line that many rooted users have on their devices is not merely outdated, it is deliberately unusable. The last push to the repository was on 2026-04-09, and no V3 stable release is listed among the recent releases. The practical cost for an adopter is that an expired install can fail to fetch anything, and the remedy the project points to is a version whose availability is described as coming soon. The README does not document a rollback path, so there is no stated way to return to a working build once the recommended one is unavailable.

VirusTotal scanning, ads and a subscription in one repository

The Androidacy repository carries a small set of features that are exclusive to it rather than to the app: automatic VirusTotal scans, community module reviews, and revenue sharing that financially rewards module developers. The app is ad supported, and the README explains that the ads are what allow the app and the repository to remain free, with the option to remove them through a subscription. The revenue sharing claim is the interesting structural one, because it means the catalogue operator has a financial interest in the volume of module traffic, which is a different arrangement from a plain index. Monet theming is listed among the user facing features. For a user the practical question is whether an ad supported, subscription gated interface that also profits from repository traffic is acceptable inside a tool that is handling privileged zip payloads for a rooted system.

Where the risk sits: clones, community repos and KernelSU support

The README warns that any project carrying the FoxMMM or AMM name that was not obtained from this repository, the official Androidacy Google Play listing, or the developer website may not be safe and may contain malicious code intended to take over the device. That warning is the most concrete risk statement the project makes, and it points at the real weakness of the design: a module manager is a convenient installer for arbitrary privileged code, so a substituted build is high value to an attacker. Two further constraints deserve attention. First, the default community repository is explicitly flagged as possibly holding low quality or malicious modules, and a custom repository support feature means users can add further sources of their own. Second, KernelSU support is labelled experimental at version 0.5.0 or later, while Magisk is listed at 21.0 or 24.0 or later and Android at 8.0 or 9.0 or later, with stable Wi-Fi recommended and a note that a VPN may be required in certain regions.

What a Compose rewrite changes, and what it leaves undocumented

The V3 rewrite is the substantive technical change in the project: a move to Kotlin and Compose with near zero webviews, a faster experience by the developer's description, an MD3 interface. Removing webviews from an app that renders module metadata and install controls is a reasonable way to avoid the slow embedded browser path that many older root tools used, and the effect is a native-feeling list and search interface. What the documentation does not carry is a description of the internals that a reviewer would want: the README does not document how modules are verified before installation beyond the VirusTotal scanning offered by the Androidacy repository, it does not document how a module is uninstalled or whether partial removal is supported, and it does not document a rollback for a module that breaks the boot sequence. The Weblate translation platform is also no longer available, with advanced users invited to send a pull request on GitHub instead, which means localisation now depends on one channel.

Editorial conclusion

Adopt it if you run Magisk on a device you own and want a searchable module catalogue with automatic updates and per-module VirusTotal scanning, and you are willing to pull the .apk from the developer's website rather than F-Droid. Skip it if you need a build with a predictable release cadence, if you depend on KernelSU without accepting its experimental status, or if you intend to install from community repositories you have not audited yourself. Before installing anything, confirm that your Android version and Magisk version sit at or above the documented minimums, verify the APK against the official Androidacy distribution channel, and read the Terms of Service and EULA alongside the LGPL-3.0 licence, since the licence alone does not cover use of the hosted services.

Frequently asked questions

Official sources

1. Androidacy/MagiskModuleManager on GitHub
2. License: LGPL-3.0
3. Project website
4. README
5. Releases