mobile-security-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| android_api_extractorA | Decompiles an APK and extracts Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode. Outputs a list of API endpoints or a Postman collection. |
| apk_manifest_analyzerA | Parses AndroidManifest.xml from an APK. Extracts package info, activities, services, receivers, intent filters, and highlights security-relevant flags like exported components, debuggable, and allowBackup. |
| apk_permissions_checkerB | Extracts and categorizes permissions requested by an APK. Dangerous permissions (those that grant access to sensitive user data or device features) are highlighted separately. |
| android_google_servicesA | Extracts Google and Firebase configuration from an APK. Parses google-services.json if present, then scans resources.arsc for string values using the strings command. If a smali_folder (apktool output) is provided, parses res/values/strings.xml directly for structured key=value output. |
| android_secrets_scannerA | Scans an APK for hardcoded secrets and API keys. Without smali_folder: runs strings on classes*.dex and resources.arsc, plus scans text assets inside the APK. With smali_folder (apktool output): scans res/values/strings.xml and assets as plain text files. |
| ios_manifest_analyzerB | Parses Info.plist from an IPA file. Extracts bundle ID, version, URL schemes, App Transport Security settings, background modes, and highlights insecure configurations. |
| ios_permissions_checkerB | Extracts privacy permission usage descriptions from an IPA's Info.plist. Each permission is categorized by risk level (HIGH / MEDIUM / LOW) with an explanation. |
| ios_entitlements_checkerA | Extracts and analyzes entitlements embedded in the iOS app binary using codesign. Detects dangerous entitlements like get-task-allow (debug builds), iCloud containers, and keychain groups. |
| ios_binary_stringsA | Extracts printable strings from an iOS app binary and filters for security-relevant patterns: HTTP/S URLs, API keys, AWS/Firebase/Google credentials, email addresses, and private IP addresses. |
| ios_frameworks_detectorA | Lists all third-party frameworks bundled inside an IPA (from the Frameworks/ directory). Maps known frameworks to categories: networking, analytics, ads, attribution, crash reporting, etc. Highlights privacy-relevant SDKs. |
| ios_google_servicesA | Extracts Google and Firebase configuration from an IPA. Parses GoogleService-Info.plist for API key, project ID, database URL, storage bucket, GCM sender ID, and OAuth client IDs. Also applies Google pattern scanning across all text plist and JSON files in the IPA. |
| ios_secrets_scannerA | Scans an IPA for hardcoded secrets and API keys. Layer 1: scans text resource files (JSON, XML, .strings, XML plists) inside the IPA. Layer 2: extracts the app binary and runs the strings command to find constants in compiled code. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
Each tool targets a distinct platform (Android vs iOS) and a specific security analysis function (e.g., permissions, secrets, manifests, frameworks). There is no overlap in purpose.
All tools follow a consistent snake_case pattern with a platform prefix (android_ or ios_) followed by a descriptive noun phrase. No mixing of conventions.
12 tools cover both Android and iOS comprehensively without redundancy. The count is well-scoped for the domain of mobile security analysis.
Core areas (manifest, permissions, secrets, configurations, frameworks, API endpoints) are covered. Minor gaps include lack of dynamic analysis or network security checks, but static analysis is thorough.