mobile-re-mcp

An MCP server that reads Android APKs and iOS IPAs and tells your AI assistant what is inside: permissions, exported components, hardcoded secrets, Firebase config, App Transport Security settings, entitlements and bundled SDKs. You ask in plain language, the assistant calls the right tool, and the findings come back. It only reads files and never runs the app. This repo also holds a second server for the live side of the work (adb, Frida, mitmproxy and patching on a real device). It is written in Python and described further down.

An example

The sample below is an APK made for this README: a small notes app with a few deliberate mistakes in it. You ask:

Check /home/me/apks/NotesDemo.apk for anything risky.

The assistant runs the manifest analyzer, the permissions checker and the secrets scanner. The output is trimmed here, and key values are masked:

=== Android Manifest Analysis ===
Package Name : com.example.notes
Version Name : 2.3.1
--- Security Flags ---
  debuggable          : TRUE  ⚠ DANGER
  allowBackup         : TRUE  ⚠ WARNING
  usesCleartextTraffic: TRUE  ⚠ DANGER
--- Exported Components (android:exported="true") ---
  ⚠ 5 exported component(s):
    - com.example.notes.MainActivity (activity)
    - com.example.notes.ShareActivity (activity)
    - com.example.notes.SyncService (service)
    - com.example.notes.BootReceiver (receiver)
    - com.example.notes.NotesProvider (provider)

=== APK Permissions Analysis ===
--- Dangerous Permissions (4) ---
  ⚠ android.permission.CAMERA
  ⚠ android.permission.ACCESS_FINE_LOCATION
  ⚠ android.permission.READ_CONTACTS
  ⚠ android.permission.WRITE_EXTERNAL_STORAGE

=== Android Secrets Scanner ===
[CRITICAL] AWS Access Key ID
  → AKIA…DEMO
⚠ 1 CRITICAL finding(s) — immediate review required.

From there you can keep talking: "Which of those exported components can I drop?" The assistant already has the findings and can answer. iOS works the same way with an IPA and the ios_* tools.

Related MCP server: mobile-security-mcp

Install

npm install -g mobile-re-mcp

You need Node 22 or newer. The server speaks MCP over stdio, so register it with your client as a command. Claude Code:

claude mcp add mobile-re -- npx -y mobile-re-mcp

opencode, in ~/.config/opencode/opencode.json:

{
  "mcp": {
    "mobile-re": { "type": "local", "command": ["npx", "-y", "mobile-re-mcp"], "enabled": true }
  }
}

Claude Desktop, in claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\):

{
  "mcpServers": {
    "mobile-re": { "command": "npx", "args": ["-y", "mobile-re-mcp"] }
  }
}

Other clients work the same way: command npx, arguments -y mobile-re-mcp. If your client cannot see your shell's PATH (common with nvm), give it the full path to node and to dist/index.js in the global install instead. To run from a checkout, use git clone https://github.com/FlyPhantomFly/mobile-re-mcp.git, then npm ci && npm run build, and point the client at node /path/to/mobile-re-mcp/dist/index.js.

What to ask

• "Which permissions in /path/to/app.apk are dangerous, and why?"

• "Are any components in this APK exported where an attacker could reach them?"

• "What API endpoints does this APK call?"

• "Which Firebase project does this app use, and are its keys in the app?"

• "Scan this IPA for hardcoded keys and tell me where each one was found."

• "Which third-party SDKs does this iOS app bundle, and which of them track users?"

Tools

Every tool takes the file as an absolute path, apk_path for Android or ipa_path for iOS.

Some tools take extra options. smali_folder lets the Android tools reuse an existing decompile. android_api_extractor also takes output_format (txt or postman). The scanners take min_length, and ios_binary_strings takes filter (all, url, key, email or ip). aapt, apktool, strings and plutil need to be on your PATH. plutil and codesign only exist on macOS. Most real IPAs use binary plists, so on Linux the plist-based iOS tools only work on IPAs with XML plists, and the full iOS set is best run on a Mac. On Windows the tools start without a shell, so apktool has to resolve to a real .exe, not apktool.bat.

Staying safe

• External programs are started with an argument array, never through a shell, so a crafted path cannot inject a command.

• The file has to exist, be an absolute path and look like a ZIP (.apk or .ipa).

• To limit where the server may read, set MOBILE_RE_MCP_ALLOWED_DIRS (separate folders with :, or ; on Windows). For example, in the Claude Desktop entry add "env": { "MOBILE_RE_MCP_ALLOWED_DIRS": "/home/me/apks" }.

• An untrusted app is hostile input for apktool, aapt and strings. Keep them updated, and for samples you do not trust, run the server in a VM or container.

• Findings, including any secrets that were found, go to your AI client and so to its model provider.

The Python server

The Python server in python/ is for the work that needs a running app. It drives adb, Frida, mitmproxy, apktool and jadx against a test phone, so the assistant can decompile an app, hook it, read its traffic, patch it, sign it and install it again. It is Android only, has about 55 tools, and several of them can change your device, which is why they ask for approval first.

pip install "mobile-re-mcp[all]"

The command is mobile-re-mcp-py. The setup, tool list and safety notes are in python/README.md. The usual order is the npm server first, to see what an app asks for and leaks, then the Python server when you need the app running. You can install either one without the other, and both share a version number.

Working on it

Build with npm ci && npm run build. CONTRIBUTING.md explains how to add a tool or a detection pattern, SECURITY.md is for reporting vulnerabilities, and CHANGELOG.md lists what changed.

License

MIT. © 2026 FlyPhantomFly.