List configured allowlisted device IDs and applications.

Get TTL-cached SSH discovery for this connection; force_refresh=true requests fresh architecture, iOS and jailbreak evidence.

Unload the inspection agent and hooks, then detach.

Read bounded, redacted trace events by sequence cursor; includes loss count.

Register bounded call tracing; optionally capture scalar arguments, return addresses and in-context stacks.

Remove a specific interceptor from this process session.

Dump headers with automatic backend selection: local binary_path uses host classdumpc; device_id/bundle_id/class_name uses the live runtime and reuses its session. Returns a local header file; preview is opt-in and bounded. Static cache: 5 minutes, 4 files, 16 MiB. Use objc_query_instances for live values.

One-call allowlisted app instance values: reuse/attach, discover class instances or read mixed-class object_ids, then read bounded ivars without arbitrary getters/descriptions. Select field_names to minimize tokens; sensitive fields are redacted. Default first 8 ivars, 20 instances, 10 per page. snapshot_id pages never rescan the heap. Foundation strings/numbers/collections are bounded; other objects return leased references. ObjC-visible classes only.

Capture a fresh bounded UIKit summary. Reuse snapshot_id + offset for immutable pages without device access. Text is opt-in; format=detail or fields selects extra metadata.

One-call allowlisted app capture with automatic session reuse/attach. Required mode=summary, screenshot or both; screenshots and text require explicit selection. Summary returns snapshot_id for paging.

Run an app-scoped batch: tap, back/dismiss, input_text, scroll, assert or bounded wait_for. Uses UIKit control/accessibility actions, not physical touch injection. Select targets by leased view_id, identifier/class/text or window x+y. No implicit wait/screenshots/text. Optional after_capture reuses the same RPC. Stops at the first failure; never automatically retries mutations.

Start/reuse app log hooks and read one filtered page from a bounded on-device ring. Pass after=next_cursor; default 20 entries, no waiting. os_log/NSLog expose format strings; NSLogv and stdio expose rendered text. Sources/buffer options apply when starting. Stop removes hooks; an active log stream keeps the session alive.

Inspect app threads, bounded backtraces or registers in one call. Frida is immediate and samples running threads. backend=lldb temporarily stops the process, supports locals, then detaches/resumes. mode=capabilities checks host LLDB and cached device debugserver availability. No arbitrary debugger commands or expression execution.

Check required Frida/LLDB/debugserver components and return actionable missing-component instructions. action=install installs absent device debugserver from the matching local Xcode iOS image or a workspace local_debugserver_path. action=repair reapplies an existing device-provided signing profile. Installation checks execution; verify actual attach separately with debug_inspect(backend=lldb).

Decrypt one loaded app Mach-O using maintained frida-ios-dump code and the existing Frida/SSH session. Default main executable, background job; module_name/path selects an app framework. action=modules lists bounded loaded candidates without dumping. Returns verified cryptid=0/UUID/SHA-256 and binary_path for objc_dump or ida_open_binary; no IPA packaging or forced framework loading.

Inspect server configuration and process-session lifecycle without touching a device.

Retrieve a long-running job result.

Cancel a job and clean up its active operation.

Access advanced Vesper primitives without loading the full catalog. action=schema returns one exact input schema; action=call validates and executes arguments. Names include objc_get_ivars, objc_get_methods, ui_inspect_view, tweak_*, ida_* and device_*. Existing operation checks apply. Use the vesper-ios skill for workflows.