Which integrations are available for this server?

Provides Android mobile application penetration testing capabilities, including APK analysis, decompilation, repackaging, signing, Frida server and script execution, and emulator management. Provides iOS penetration testing capabilities through Frida scripts for jailbreak detection bypass, SSL pinning bypass, and biometric/pin bypass. Includes Frida-based SSL bypass scripting targeted at the TikTok app for security testing.

How do I use OpenAPK?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@OpenAPK analyze the APK at /path/to/app.apk and check its permissions and secrets" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

OpenAPK

by 0xLLVEL

Overview Schema Source Related Servers Discussions Admin

JavaScript

Local

OpenAPK

A Python MCP (Model Context Protocol) server for mobile application penetration testing with 83+ tools covering Frida, Frida-server, Frida-gadget, apktool, jadx, dex2jar, smali, APK analysis, APK decompile/build, APK signing, emulator support, and system compatibility checking.

Features

83 MCP Tools for mobile pentesting
Auto-download missing tools (jadx, dex2jar, apktool, build-tools)
Frida Integration - Server management, script execution, gadget injection
55+ FSR Scripts - SSL bypass, root bypass, emulator bypass, and more
APK Analysis - Manifest, permissions, activities, services, secrets scan
Decompilation - Java source (jadx), Smali (apktool), DEX to JAR (dex2jar)
APK Signing - Sign, verify, zipalign, keystore generation
Emulator Support - Nox Player, BlueStacks, MEmu
System Check - Verify all tools are installed and working

Related MCP server: Mobile Pentest MCP Server — Extended

Requirements

Python 3.10+
ADB (Android Debug Bridge)
Frida tools
Java JDK 11+

Installation

1. Clone the repository

git clone https://github.com/yourusername/openapk.git
cd openapk

2. Run setup (creates venv + installs requirements)

setup.bat

3. Configure opencode

Add to ~/.config/opencode/opencode.json:

{
  "mcp": {
    "openapk": {
      "type": "local",
      "command": ["C:\\path\\to\\openapk\\.venv\\Scripts\\python.exe", "C:\\path\\to\\openapk\\server.py"],
      "enabled": true,
      "timeout": 30000
    }
  }
}

4. Restart opencode

The MCP server will load automatically.

Quick Start

# Check system status
check_system

# Install all missing tools
install_all_missing

# Update FSR scripts
fsr_update_scripts

# Connect to Nox Player
connect_nox

# Analyze an APK
apk_analyze("path/to/app.apk")

Available Tools (83)

System Check (6)

Tool	Description
`check_system`	Full system compatibility check
`check_core_tools`	Python, ADB, Frida, Java, Frida Gadget
`check_decompile_tools`	jadx, apktool, dex2jar
`check_signing_tools`	apksigner, keytool, zipalign, aapt
`check_emulators`	Nox, BlueStacks, MEmu
`check_frida_scripts`	Verify pre-built scripts

Tool Installer (7)

Tool	Description
`install_tool`	Install any tool by name
`install_jadx`	Download & install jadx
`install_dex2jar`	Download & install dex2jar
`install_apktool`	Download & install apktool
`install_uber_apk_signer`	Download & install uber-apk-signer
`install_build_tools`	Download & install Android SDK Build Tools
`install_all_missing`	Auto-detect & install all missing tools
`list_installed_tools`	Show tools installed by MCP

ADB Device Management (13)

Tool	Description
`adb_list_devices`	List all connected devices
`adb_connect`	Connect via TCP/IP
`adb_disconnect`	Disconnect from device
`adb_shell`	Execute shell command
`adb_install_apk`	Install APK to device
`adb_uninstall_app`	Uninstall app
`adb_push`	Push file to device
`adb_pull`	Pull file from device
`adb_screenshot`	Capture screenshot
`adb_logcat`	Get device logs
`adb_get_props`	Get device properties
`adb_start_app`	Start application
`adb_stop_app`	Force stop application

Emulator Management (5)

Tool	Description
`detect_emulators`	Detect installed emulators
`connect_nox`	Connect to Nox Player
`connect_emulator`	Connect to any emulator
`start_nox`	Start Nox Player
`start_emulator`	Start any emulator

Frida Server (7)

Tool	Description
`frida_start_server`	Auto-download & start frida-server
`frida_stop_server`	Stop frida-server
`frida_restart_server`	Restart frida-server
`frida_check_server`	Check if frida-server running
`frida_get_version`	Get frida-server version
`frida_list_processes`	List running processes
`frida_list_apps`	List installed apps

Frida Script Runner (13)

Tool	Description
`frida_run_script`	Run custom Frida script
`frida_run_script_file`	Run script from file
`frida_ssl_bypass`	Bypass SSL pinning
`frida_root_bypass`	Bypass root detection
`frida_emulator_bypass`	Bypass emulator detection
`frida_anti_debug_bypass`	Bypass anti-debug
`frida_trace_function`	Trace Java method
`frida_find_classes`	Find loaded classes
`frida_find_methods`	List class methods
`frida_list_modules`	List native modules
`frida_memory_dump`	Dump memory at address
`frida_memory_scan`	Scan memory for pattern

Frida Gadget (4)

Tool	Description
`gadget_inject`	Inject Frida Gadget into APK
`gadget_inject_with_script`	Inject Gadget + custom JS
`gadget_inject_custom`	Inject custom Gadget .so
`gadget_verify`	Check if Gadget present

FSR Scripts (6)

Tool	Description
`fsr_list_scripts`	List available FSR scripts
`fsr_run_script`	Run a specific FSR script
`fsr_run_category`	Run all scripts in a category
`fsr_run_ssl_bypass_all`	Run all SSL bypass scripts
`fsr_update_scripts`	Download/update FSR scripts from GitHub

APK Analysis (11)

Tool	Description
`apk_analyze`	Full APK analysis
`apk_manifest`	Dump AndroidManifest.xml
`apk_permissions`	List permissions
`apk_activities`	List activities
`apk_services`	List services
`apk_providers`	List content providers
`apk_receivers`	List broadcast receivers
`apk_certificates`	Show signing certificates
`apk_deep_links`	Extract deep links
`apk_native_libs`	List native libraries
`apk_secrets_scan`	Scan for secrets/API keys

Decompile (6)

Tool	Description
`decompile_jadx`	Decompile to Java source
`decompile_apktool`	Decompile to Smali + resources
`decompile_dex2jar`	Convert DEX to JAR
`smali_disassemble`	DEX → Smali
`smali_assemble`	Smali → DEX
`apk_extract_dex`	Extract DEX from APK

Build & Sign (6)

Tool	Description
`apk_build`	Build APK from decoded dir
`apk_sign`	Sign APK with keystore
`apk_verify_signature`	Verify APK signature
`apk_zipalign`	Zipalign APK
`apk_generate_keystore`	Generate signing keystore
`apk_list_keystores`	List available keystores

FSR Script Categories

Category	Scripts	Description
`android`	9	Biometric bypass, emulator bypass, pin bypass
`ios`	15	Jailbreak bypass, SSL, biometric
`ssl`	21	Universal SSL bypass, OkHttp, Flutter, TikTok
`root`	10	Root detection bypass variants

Project Structure

openapk/
├── server.py                  # MCP server entry point (83 tools)
├── config.py                  # Paths and emulator configs
├── requirements.txt           # Python dependencies
├── setup.bat                  # Windows setup script
├── start.bat                  # Windows start script
├── tools/
│   ├── adb.py                 # ADB + emulator management
│   ├── frida_manager.py       # Frida server lifecycle
│   ├── frida_runner.py        # Frida script execution
│   ├── frida_gadget.py        # Gadget injection
│   ├── apk_analyzer.py        # APK analysis
│   ├── decompiler.py          # jadx/apktool/dex2jar/smali
│   ├── builder.py             # APK build
│   ├── signer.py              # APK signing
│   ├── checker.py             # System compatibility check
│   ├── installer.py           # Tool downloader/installer
│   └── utils.py               # Shared utilities
├── frida_scripts/
│   ├── *.js                   # Pre-built bypass scripts
│   └── fsr/                   # FSR scripts (55+)
│       ├── android/
│       ├── ios/
│       ├── ssl/
│       └── root/
└── workspace/
    ├── apks/                  # User APK files
    ├── decoded/               # Decompiled output
    ├── java_src/              # Java source output
    ├── smali/                 # Smali output
    ├── jars/                  # JAR output
    └── tools_bin/             # Auto-downloaded tools
        ├── jadx/
        ├── dex-tools-v2.4/
        ├── apktool/
        ├── uber-apk-signer/
        └── build-tools/

Environment Variables

Variable	Default	Description
`ADB_PATH`	`adb`	Path to ADB executable
`JADX_PATH`	`jadx`	Path to jadx
`APKTOOL_PATH`	`apktool`	Path to apktool
`DEX2JAR_PATH`	`d2j-dex2jar`	Path to dex2jar
`JAVA_HOME`	-	Java installation path
`NOX_ADB_HOST`	`127.0.0.1`	Nox ADB host
`NOX_ADB_PORT`	`62001`	Nox ADB port

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

pentest-mcp-server A
io.github.cyanheads
Offline methodology engine for authorized penetration testing, CTF, and security research.
Penetration Testing Security
721
androidcliagentgate-mcp
com.clauxel.androidcliagentgate
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Developer Tools CI/CD & DevOps Command Line
2
mobilerun
io.github.droidrun
Control real Android and iOS devices with LLM agents — tap, swipe, type, automate flows.
Testing & QA Tools App Automation
38,854
Busymate DevToolsOAuth
dev.busymate
Capture, inspect & debug HTTPS traffic across iOS, Android, browsers & backends — 304 MCP tools.
Observability Developer Tools
2

Related MCP Servers

SO Analyzer MCP
Developer Tools Code Analysis Security
1600822305
F
license
Not graded
quality
F
maintenance
Enables analysis of native Android libraries (SO files) and Flutter applications, including decompilation, function identification, SSL certificate bypass patching, and binary modification through 30+ specialized tools.
Updated 10 months ago (2025-12-12 02:30 UTC)
12
-
Mobile Pentest MCP Server —
Penetration Testing Code Analysis
mtsboy01
A
license
Not graded
quality
D
maintenance
Enables authorized Android security testing with static and dynamic analysis, Frida instrumentation, storage inspection, and traffic interception via MCP tools.
Updated 3 months ago (2026-06-12 10:00 UTC)
1
MIT
mobsf-mcp
Penetration Testing Autonomous Agents Code Analysis
plur1bu5
A
license
Not graded
quality
C
maintenance
Enables AI agents to perform autonomous Android security analysis, including static analysis, dynamic analysis, and Frida instrumentation, powered by MobSF.
Updated 2 months ago (2026-07-26 13:57 UTC)
2
MIT
Mobix
Penetration Testing Security Autonomous Agents
blackfoxxx
A
license
Not graded
quality
B
maintenance
Authorized Android pentest lab, drivable by hand or by AI — Frida bypass chain, live traffic capture with automatic IDOR flagging, full MCP control plane, web dashboard.
Updated a month ago (2026-08-14 12:22 UTC)
7
MIT

OpenAPK

Features

Requirements

Installation

1. Clone the repository

2. Run setup (creates venv + installs requirements)

3. Configure opencode

4. Restart opencode

Quick Start

Available Tools (83)

System Check (6)

Tool Installer (7)

ADB Device Management (13)

Emulator Management (5)

Frida Server (7)

Frida Script Runner (13)

Frida Gadget (4)

FSR Scripts (6)

APK Analysis (11)

Decompile (6)

Build & Sign (6)

FSR Script Categories

Project Structure

Environment Variables

License

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

SO Analyzer MCP

Mobile Pentest MCP Server —

mobsf-mcp

Mobix