com.samsung.android.svcagent Copy

A Samsung system component that every observation on this site reports as "SVC Agent", untranslated in every locale recorded, so the label is a code name rather than a description. It is preinstalled, Samsung-signed with certificates this site also records as signing the framework, has no launcher entry on any of the 44 devices that report it, and is not marked Play-eligible on any observation, so on this sample it changes only with firmware. Samsung lists it by name and package in its Common Criteria mode application lists as far back as the Galaxy Note9 on Android 8, so it is a standard part of the Samsung image, but those lists inventory applications rather than explain them. No Samsung documentation was found describing what it does, and the abbreviation is not expanded here. Community threads and app catalogues describe it confidently, including a widely repeated claim that it exists to check network availability for other apps, but nothing found supported that with evidence, so it is neither cited nor repeated as fact. What the manifest does establish is the area it works in, and it is a narrower set than most components of this kind. Per this site's provenance record it declares only ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, INTERNET, FOREGROUND_SERVICE, WAKE_LOCK, RECEIVE_BOOT_COMPLETED, READ_PRIVILEGED_PHONE_STATE, an unexported dynamic receiver permission in its own namespace, and the pair com.samsung.android.permission.READ_SCPM and WRITE_SCPM. That last pair is the useful detail. This site records the same two permission names on com.samsung.android.scpm and com.samsung.android.gru, both documented separately here, so this component asks for access in a Samsung namespace it shares with at least those two rather than one of its own. Whether any of the three is granted that access, or uses it, is not something this site records. What that namespace holds is not published by Samsung, and the abbreviation "SCPM" is used by Samsung for more than one thing, so no expansion is offered. A component that starts at boot, holds a wake lock, runs a foreground service, reads privileged phone state and reaches the network is consistent with a background agent that fetches or applies something on a schedule, but what it fetches or applies is inference from the permission set rather than a sourced fact. Version note: this component has been carried across releases rather than replaced. Samsung's application lists record version 3.0.01.2 on the Galaxy Note9 on Android 8, 5.0.00.1 on an Android 10 Galaxy S20+ and 5.0.00.11 on Android 11 devices, while this site's sample runs API 28 to 37 with versions 6.0.01.1 to 7.3.00.13, target SDK 30 to 37 and package sizes from roughly 717 KB to 1.29 MB. The jump from the 5.0.x series seen on Android 11 to the 6.x and 7.x builds seen here suggests at least one significant rework since, but which release it landed in, and what changed, could not be sourced and is flagged here as a gap rather than described. For Android Enterprise, EMM and kiosk use, no evidence was found that this package takes part in enrolment, in Android Management API policy, or in any documented Knox administrator workflow. Two points matter on a managed fleet. It shares a permission namespace with at least two other undocumented Samsung components, so it is unlikely to be self-contained, and Samsung publishes nothing about what depends on it. And its permission set is consistent with a network-capable background agent, which is a fair thing to review on a fleet with tight egress controls, though this site records neither its runtime behaviour nor what it might contact. Because its function could not be established, treat removal as untested rather than safe. Where a Samsung preinstalled app must be suppressed, Samsung documents blocking it by package name through Knox Manage's application policies; test on a single device first.

• Galaxy Note9 (SM-N960N, Android 8) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S20+ 5G (SM-G986U1, Android 10) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S21+ 5G (SM-G996B, Android 11) Common Criteria mode application list - Samsung Knox Documentation →
• Package provenance for com.samsung.android.scpm - Android System App Database →
• Package provenance for com.samsung.android.gru - Android System App Database →
• Enable or disable a specific system app - Knox Manage - Samsung Knox Documentation →
• Package provenance for com.samsung.android.svcagent - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 10 permissions: 1 signature or system-level, 6 install-time and 3 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.