GoMobSec MCP server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GOMOBSEC_API_KEY | Yes | Required. Your GoMobSec API key. Create one under API keys in GoMobSec. | |
| GOMOBSEC_API_URL | No | Change this only for a dedicated or on-prem GoMobSec | https://api.gomobsec.ai |
| GOMOBSEC_APP_URL | No | Base URL for the report links | https://gomobsec.ai |
| GOMOBSEC_DOWNLOAD_DIR | No | The only folder download_report writes to | ~/Downloads/gomobsec |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| whoamiA | Show which GoMobSec account the API key belongs to and its plan. |
| get_usageA | How many scans the account has used this month against its plan limit. |
| list_scansA | List the account's most recent scans, newest first (1-50). |
| get_scanB | Status of one scan and, once complete, its findings count by severity. |
| get_findingsA | Findings of a completed scan: severity, title, CWE, MASVS category, CVSS, location and description, most severe first. Optionally filter by severity. False positives are left out unless include_false_positives is true. |
| start_scanA | Upload a local Android (.apk, .xapk, .apks, .apkm) or iOS (.ipa) app to GoMobSec and start a security scan. Uses one scan from the account's plan — confirm with the user first. 'quick' and 'static' work on every plan; 'full' (static + dynamic) needs a paid plan. Returns the scan id; follow it with wait_for_scan. |
| wait_for_scanA | Wait until a scan finishes (or the timeout passes, 1-60 minutes), reporting progress, then return its status and findings count. |
| download_reportA | Download the full report of a completed scan — DOCX (pentest report), XLSX, JSON or SARIF (for code-scanning tools) — into the GoMobSec download folder (GOMOBSEC_DOWNLOAD_DIR, default ~/Downloads/gomobsec). Never overwrites an existing file. Returns the saved path. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| security_review | Review a completed scan and propose a prioritised fix plan. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool maps to a distinct resource/action: account identity, usage, scan listing, scan status, findings, scan creation, waiting, and report download. The only mild overlap is that get_scan and wait_for_scan both can return status, but wait_for_scan is clearly scoped to blocking/polling until completion.
All tool names use lowercase snake_case, which is highly consistent. However, whoami deviates from the otherwise predictable verb_noun pattern used by the other seven tools.
Eight tools are well-scoped for a mobile app security scanning workflow. The set is neither thin nor bloated, and each tool appears to earn its place in the scan lifecycle.
The surface covers the core workflow: authenticate, check usage, start a scan, wait, inspect status/findings, and download reports. Minor gaps include no cancel/delete scan operation and no broader scan-management controls, but these do not block the main use case.