Which integrations are available for this server?

Provides tools for analyzing iOS app bundles (IPA), including metadata extraction, static analysis of Mach-O binaries (Objective-C class dump, Swift symbol demangling, linked frameworks, FairPlay DRM detection), dynamic instrumentation via Frida (IAP interception, network capture, runtime class enumeration), and FairPlay DRM decryption. Supports Swift symbol demangling as part of Mach-O static analysis to reveal demangled Swift symbols from iOS binaries.

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@re-ios run full analysis on ./target.ipa" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

re-ios

by gyh20062008-commits

Overview Schema Source Related Servers Discussions Admin

Python

Local

re-ios v0.2.0

MCP server for iOS reverse engineering: static analysis + Frida dynamic instrumentation.

What it does:

Parse IPA / .app bundles — metadata, entitlements, URL schemes, encryption status
Statically analyze Mach-O binaries — ObjC class dump, Swift symbol demangling, linked frameworks, archs, FairPlay DRM detection
Manage Frida devices — list USB/local/remote, enumerate processes, spawn/kill apps
Inject dynamic hooks — IAP (StoreKit) interception, NSURLSession network capture, runtime ObjC enumeration
Decrypt FairPlay DRM — orchestrate frida-ios-dump for decrypted IPA extraction
Full analysis pipeline — combine all of the above into a single comprehensive report

Tools (27 total)

Category	Tools
System	`check_ios`
IPA	`parse_ipa_tool`, `unpack_ipa_tool`, `get_ipa_entitlements`
Mach-O Static	`analyze_macho_objc`, `analyze_macho_objc_deep`, `analyze_swift_symbols`, `analyze_linked_frameworks`, `check_macho_encryption`, `analyze_macho_archs`, `full_static_analysis`
Frida Device	`frida_list_devices`, `frida_device_info`, `frida_list_processes`, `frida_find_process`, `frida_spawn_app`, `frida_resume_app`, `frida_kill_app`
Dynamic Hooks	`dynamic_enumerate_classes`, `dynamic_hook_iap`, `dynamic_hook_network`, `dynamic_check_cryptid`
Decryption	`decrypt_ipa`, `check_encryption`
Pipeline	`full_analysis`, `generate_analysis_report`, `scan_endpoints`

Related MCP server: fuzzmind-frida-mcp

Installation

pip install -e .
re-ios

{
  "mcpServers": {
    "re-ios": {
      "command": "re-ios"
    }
  }
}

Requirements

macOS (for native Mach-O toolchain: otool, nm, lipo, strings, file, codesign)
Python 3.11+
Frida (optional, for dynamic analysis): pip install frida
frida-ios-dump (optional, for FairPlay decryption)
class-dump (optional, for deeper ObjC analysis)

Quick Start

# Static IPA analysis
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"parse_ipa_tool","arguments":{"path":"./target.ipa"}}}' | re-ios

# Check binary encryption
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_macho_encryption","arguments":{"path":"./executable"}}}' | re-ios

# Full static pipeline
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"full_static_analysis","arguments":{"path":"./target.ipa"}}}' | re-ios

Project Structure

src/re_ios/
├── server.py              # FastMCP app (27 tools)
├── models.py              # Pydantic models
├── errors.py              # Exception hierarchy
├── logger.py              # Logging
├── macho/parser.py        # Mach-O static analysis
├── frida/
│   ├── device.py          # Device/process management
│   ├── session.py         # Script injection & RPC
│   └── scripts/           # Frida JS injection scripts
│       ├── enumerate_classes.js
│       ├── dump_ipa.js
│       ├── hook_iap.js
│       └── hook_network.js
├── ipa/
│   ├── unpack.py          # IPA parse & extract
│   └── decrypt.py         # FairPlay decryption
└── analysis/
    ├── static.py          # Report generation
    └── dynamic.py         # Dynamic analysis orchestration

Examples

Static analysis of Mach-O

analyze_macho_objc(path="./MyApp")
analyze_swift_symbols(path="./MyApp", max_symbols=100)
analyze_linked_frameworks(path="./MyApp")

Dynamic IAP hook

dynamic_hook_iap(target="com.example.app", device_type="usb", duration=30)

Network traffic capture

dynamic_hook_network(target="com.example.app", device_type="usb")

Full decryption

decrypt_ipa(bundle_id="com.example.app", output_dir="/tmp/decrypted")

Available Tools

32 tools

analyze_linked_frameworksC

Enumerate linked frameworks and libraries from a Mach-O binary.

Args: path: Path to a Mach-O binary

Inputs: path (required).

analyze_macho_archsB

List architectures in a Mach-O binary (via lipo).

Args: path: Path to a Mach-O binary

Inputs: path (required).

analyze_macho_objcB

Dump Objective-C classes from a Mach-O binary using static analysis (nm + strings).

Args: path: Path to a Mach-O binary

Inputs: path (required).

analyze_macho_objc_deepB

Deep ObjC class dump using class-dump if available, falls back to nm+strings.

Args: path: Path to a Mach-O binary

Inputs: path (required).

analyze_swift_symbolsA

Demangle Swift symbols from a Mach-O binary.

Args: path: Path to a Mach-O binary max_symbols: Maximum number of symbols to demangle (default: 500)

Inputs: path (required), max_symbols.

check_encryptionB

Check if an app is encrypted (FairPlay DRM) by reading cryptid at runtime.

Attaches to the running app and reads the cryptid field from Mach-O headers of all loaded modules.

Args: bundle_id: Bundle identifier of the target app

Inputs: bundle_id (required).

check_iosB

Report server status and available capabilities.

Inputs: no named parameters.

check_macho_encryptionB

Check if a Mach-O binary is encrypted (FairPlay DRM).

Args: path: Path to a Mach-O binary

Inputs: path (required).

decrypt_ipaA

Decrypt FairPlay DRM from an iOS app using frida-ios-dump.

Dumps decrypted IPA from a running/installed app on a tethered iOS device. Requires frida-ios-dump to be installed.

Args: bundle_id: Bundle identifier of the target app output_dir: Output directory for decrypted IPA (default: /tmp/ios_decrypted) device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: bundle_id (required), device_id, output_dir, device_type.

dynamic_check_cryptidA

Check encryption status (cryptid) of loaded Mach-O binaries at runtime.

Uses Frida to enumerate all loaded modules and read their cryptid field.

Args: target: Bundle ID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: target (required), device_id, device_type.

dynamic_enumerate_classesA

Enumerate Objective-C classes at runtime on a running iOS app.

Uses Frida to enumerate all loaded ObjC classes from a running process.

Args: target: Bundle ID or PID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: target (required), device_id, device_type.

dynamic_hook_iapA

Inject IAP (In-App Purchase) hook into a running iOS app.

Hooks StoreKit/SKPaymentQueue methods to log purchase transactions, product requests, and receipt validation attempts.

Args: target: Bundle ID or PID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional) duration: Monitoring duration in seconds (default: 30)

Inputs: target (required), duration, device_id, device_type.

dynamic_hook_networkB

Inject network interception hook into a running iOS app.

Hooks NSURLSession, CFNetwork, NSURLConnection, and WebSocket APIs to capture all network requests including URLs, headers, and body data.

Inputs: target (required), duration, device_id, device_type.

fix_app_iconsC

Verify icon references in Info.plist match actual files in .app bundle.

Args: app_dir: Path to .app bundle

Inputs: app_dir (required).

frida_device_infoA

Get detailed info about a Frida device.

Args: device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: device_id, device_type.

frida_find_processA

Find a process by name, PID, or bundle identifier.

Args: target: Process name, PID, or bundle ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: target (required), device_id, device_type.

frida_kill_appA

Kill a process by PID.

Args: pid: Process ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: pid (required), device_id, device_type.

frida_list_devicesA

List all available Frida devices (USB, local, remote).

Inputs: no named parameters.

frida_list_processesA

List running processes on a Frida device.

Args: device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: device_id, device_type.

frida_resume_appA

Resume a spawned/suspended app.

Args: pid: Process ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: pid (required), device_id, device_type.

frida_spawn_appA

Spawn an iOS app by bundle ID.

Args: bundle_id: Bundle identifier (e.g. com.example.app) device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inputs: bundle_id (required), device_id, device_type.

full_analysisA

Run a comprehensive analysis pipeline on an iOS target.

Supports three levels:

'basic': IPA metadata only
'static': Full static analysis (IPA + Mach-O + ObjC + Swift + encryption)
'dynamic': Static analysis + Frida runtime hooks (requires device)

Args: target: Path to IPA file, Mach-O binary, or bundle ID for dynamic analysis level: Analysis level: 'basic', 'static', or 'dynamic' (default: 'static') output_dir: Output directory for analysis artifacts (default: /tmp/re_ios_analysis)

Inputs: target (required), level, output_dir.

full_static_analysisA

Run full static analysis pipeline on an IPA or Mach-O binary.

Combines IPA parsing, ObjC class dump, Swift symbol demangling, linked framework enumeration, encryption check, and endpoint scanning.

Args: path: Path to IPA file or Mach-O binary

Inputs: path (required).

generate_analysis_reportB

Generate a human-readable analysis report from an IPA or analysis directory.

Args: path: Path to IPA file or Mach-O binary analysis_dir: Optional path to analysis directory (for endpoint scanning)

Inputs: path (required), analysis_dir.

get_ipa_entitlementsC

Extract entitlements from an IPA file or .app bundle.

Args: path: Path to IPA file or .app bundle

Inputs: path (required).

parse_ipa_toolA

Parse an IPA file and extract full metadata (bundle ID, version, entitlements, frameworks, encryption status).

Args: path: Path to the IPA or .app bundle

Inputs: path (required).

resign_checkA

Check signing environment: available tools and code signing identities.

Returns signing method (ldid/codesign/none), available certs, and readiness.

Inputs: no named parameters.

resign_ipa_toolB

Resign an iOS IPA or .app bundle with new identity and metadata.

Handles the full resigning workflow:

Extracts IPA or copies .app bundle
Replaces embedded.mobileprovision (if provided)
Modifies Info.plist (bundle ID, display name, version)
Signs all Mach-O binaries with ldid or codesign
Repackages into IPA

Args: input_path: Path to .ipa or .app bundle to resign output_path: Output path for resigned IPA (default: _resigned.ipa) signing_cert: Code signing identity name/SHA1 (for codesign), or None for ldid provisioning_profile: Path to .mobileprovision file to embed new_bundle_id: New bundle identifier (e.g. com.example.resigned) new_display_name: New display name for the app new_version: New version string (CFBundleShortVersionString) new_build: New build number (CFBundleVersion)

Inputs: input_path (required), new_build, new_version, output_path, +4 more.

run_skill_pipelineA

Run the full original SKILL.md static analysis pipeline (bash scripts).

Executes the shell-based analysis pipeline from the ios-reverse-engineering skill: unpack → fingerprint → macho analyze → class scan → api scan → report. All results are written to output_dir.

Args: target: Path to IPA file, .app bundle, or Mach-O binary output_dir: Output directory (default: ios_analysis_out)

Inputs: target (required), output_dir.

scan_endpointsB

Scan an analysis directory for hardcoded URLs, domains, and API paths.

Recursively scans text files for network endpoint clues.

Args: analysis_dir: Path to the analysis directory

Inputs: analysis_dir (required).

trollstore_guideA

Get the recommended workflow for combining TrollStore (on-device) with re-ios (desktop).

TrollStore on iPhone handles decryption and installation; re-ios on Mac handles deep static analysis, IAP/network hook templates, and resigning.

Returns the step-by-step workflow reference.

Inputs: no named parameters.

unpack_ipa_toolA

Extract an IPA file to a directory for further analysis.

Args: path: Path to the IPA file output_dir: Optional output directory (defaults to <ipa_name>_unpacked)

Inputs: path (required), output_dir.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.4/5.0

Scored 2026-07-09 04:15 across 32 tools

Disambiguation4/5

Most tools have clear distinct purposes, but there is some overlap: three tools for checking encryption (check_encryption, check_macho_encryption, dynamic_check_cryptid) with subtle differences, and analyze_macho_objc/analyze_macho_objc_deep are nearly identical. Descriptions help differentiate but boundaries could be clearer.

Naming Consistency4/5

Tools follow a mostly consistent verb_noun snake_case pattern (e.g., analyze_, check_, dynamic_, frida_). However, there are deviations like 'trollstore_guide' (noun_noun), 'run_skill_pipeline' (verb_verb_noun?), and some mixing of prefixes (e.g., dynamic_check vs check). Overall decent but not perfectly uniform.

Tool Count3/5

With 32 tools, the server is on the heavier side. While the domain of iOS reverse engineering is broad and warrants many tools, some functionality is duplicated (e.g., three encryption checks) and a few tools could be merged. The count is reasonable but borderline high.

Completeness4/5

The tool set covers the main iOS reverse engineering workflow: static analysis, dynamic hooking, device management, IPA manipulation, and reporting. Minor gaps like specific hooking for other frameworks or advanced patching are missing, but core functionality is well-represented.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

PeekPanda
io.github.fdarkaou
Hosted iOS app intelligence and creative research MCP server.
Research & Data Marketing Product Management
1
https://mcp.peekpanda.com/mcp
Android Security AnalyzerA
io.github.ako2345
MCP server for static security analysis of Android source code
Security Code Analysis Testing & QA Tools
423
https://android-security-analyzer.ako-labs.workers.dev/mcp
Appcircle MCP
io.appcircle
MCP server for Appcircle mobile CI/CD platform.
CI/CD & DevOps Developer Tools
2
https://mcp.appcircle.io
runtime
com.formatho
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Developer Tools Blockchain Security
1
https://mcp.formatho.com/mcp

Related MCP Servers

IDA Pro MCP
Code Execution Developer Tools
mrexodia
A
license
C
quality
B
maintenance
MCP Server for automated reverse engineering with IDA Pro.
Updated 2 months ago (2026-09-26 15:42 UTC)
43
2,334 PyPI
13,399
MIT
fuzzmind-frida-mcp
Penetration Testing Security
fuzzmind
A
license
C
quality
D
maintenance
A Frida MCP server for authorized dynamic analysis and application security research, exposing device/session management, script injection, process and memory inspection, and platform-specific workflows.
Updated 6 months ago (2026-05-01 09:52 UTC)
2
100
4
MIT
frida-ios-mcp
YPYT1
F
license
B
quality
D
maintenance
MCP server for iOS Frida exploration enabling app control, UI interaction, and media import via spawn sessions on jailbroken devices.
Updated 4 months ago (2026-07-21 09:29 UTC)
53
96 npm
2
-
rea
Code Analysis Developer Tools
morluto
A
license
Not graded
quality
B
maintenance
MCP server that enables agents to reverse engineer applications, from high-level behavior down to native binaries, using tools like Hopper and Ghidra.
Updated 2 days ago (2026-11-10 13:53 UTC)
351,335 npm
449,223
MIT

re-ios v0.2.0

Tools (27 total)

Installation

Requirements

Quick Start

Project Structure

Examples

Static analysis of Mach-O

Dynamic IAP hook

Network traffic capture

Full decryption

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

IDA Pro MCP

fuzzmind-frida-mcp

frida-ios-mcp

rea