mobile-re-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MOBILE_RE_MCP_ALLOWED_DIRS | No | Optional sandbox: set MOBILE_RE_MCP_ALLOWED_DIRS (':' separated on macOS/Linux, ';' on Windows) to restrict the tools to specific directories, e.g. "/Users/me/apks". |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| android_api_extractorA | Decompiles an APK and extracts Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode. Outputs a list of API endpoints or a Postman collection. |
| apk_manifest_analyzerA | Parses AndroidManifest.xml from an APK. Extracts package info, activities, services, receivers, intent filters, and highlights security-relevant flags like exported components, debuggable, and allowBackup. |
| apk_permissions_checkerB | Extracts and categorizes permissions requested by an APK. Dangerous permissions (those that grant access to sensitive user data or device features) are highlighted separately. |
| android_google_servicesA | Extracts Google and Firebase configuration from an APK. Parses google-services.json if present, then scans resources.arsc for string values using the strings command. If a smali_folder (apktool output) is provided, parses res/values/strings.xml directly for structured key=value output. |
| android_secrets_scannerA | Scans an APK for hardcoded secrets and API keys. Without smali_folder: runs strings on classes*.dex and resources.arsc, plus scans text assets inside the APK. With smali_folder (apktool output): scans res/values/strings.xml and assets as plain text files. |
| ios_manifest_analyzerA | Parses Info.plist from an IPA file. Extracts bundle ID, version, URL schemes, App Transport Security settings, background modes, and highlights insecure configurations. |
| ios_permissions_checkerB | Extracts privacy permission usage descriptions from an IPA's Info.plist. Each permission is categorized by risk level (HIGH / MEDIUM / LOW) with an explanation. |
| ios_entitlements_checkerA | Extracts and analyzes entitlements embedded in the iOS app binary using codesign. Detects dangerous entitlements like get-task-allow (debug builds), iCloud containers, and keychain groups. |
| ios_binary_stringsB | Extracts printable strings from an iOS app binary and filters for security-relevant patterns: HTTP/S URLs, API keys, AWS/Firebase/Google credentials, email addresses, and private IP addresses. |
| ios_frameworks_detectorA | Lists all third-party frameworks bundled inside an IPA (from the Frameworks/ directory). Maps known frameworks to categories: networking, analytics, ads, attribution, crash reporting, etc. Highlights privacy-relevant SDKs. |
| ios_google_servicesA | Extracts Google and Firebase configuration from an IPA. Parses GoogleService-Info.plist for API key, project ID, database URL, storage bucket, GCM sender ID, and OAuth client IDs. Also applies Google pattern scanning across all text plist and JSON files in the IPA. |
| ios_secrets_scannerB | Scans an IPA for hardcoded secrets and API keys. Layer 1: scans text resource files (JSON, XML, .strings, XML plists) inside the IPA. Layer 2: extracts the app binary and runs the strings command to find constants in compiled code. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
Most tools are clearly separated by platform and artifact type, such as manifest, permissions, entitlements, and frameworks. However, several scanning tools overlap: ios_binary_strings and ios_secrets_scanner both hunt for credentials in binaries/resources, and Google/Firebase extraction overlaps with secret scanning on both platforms.
Names are consistently snake_case and descriptive, generally following a platform/artifact/action pattern. There is a minor prefix inconsistency between android_ and apk_ for Android tools, but the convention remains predictable.
The 12 tools are well-scoped for a mobile reverse-engineering server and are evenly split between Android and iOS analysis needs. Each tool appears to earn its place without excessive fragmentation.
The surface covers core static-analysis tasks: manifests, permissions, secrets, Google/Firebase config, API extraction, binary strings, frameworks, and entitlements. There are still notable gaps such as signing/certificate validation, Android third-party SDK/framework mapping, iOS endpoint extraction, and certificate pinning or network security configuration analysis.