Which integrations are available for this server?

Extracts Firebase configuration from Android and iOS apps, providing project IDs, API keys, database URLs, storage buckets, and OAuth clients. Extracts Google service configuration from mobile apps, including Firebase and Google Cloud Platform settings from google-services.json and GoogleService-Info.plist. Inspects iOS app entitlements related to iCloud, such as iCloud containers and key-value storage, through ios_entitlements_checker. Generates Postman collection JSON from API endpoints extracted during Android app analysis using android_api_extractor.

How do I use mobile-security-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mobile-security-mcp Analyze the permissions in /path/to/app.apk" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mobile-security-mcp

by Serhatcck

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

mobile-security-mcp is an MCP (Model Context Protocol) server that gives Claude — and any MCP-compatible AI client — the ability to analyze Android APK and iOS IPA files for security issues through natural language conversation.

Security researchers, mobile pentesters, and app developers can now audit permissions, extract API endpoints, detect hardcoded secrets, inspect Firebase configuration, and enumerate third-party SDKs by simply asking Claude — no scripting required.

Features

Android

Tool	What it does
`apk_manifest_analyzer`	Parses `AndroidManifest.xml` — flags `debuggable`, `allowBackup`, exported components, intent filters
`apk_permissions_checker`	Categorizes all permissions into dangerous vs normal with risk explanations
`android_api_extractor`	Decompiles smali bytecode to extract Retrofit HTTP endpoints and OkHttp3 fields
`android_google_services`	Extracts Firebase/GCP config from `google-services.json` and `resources.arsc` string values
`android_secrets_scanner`	Scans DEX bytecode + `resources.arsc` + assets for hardcoded API keys and credentials

iOS

Tool	What it does
`ios_manifest_analyzer`	Parses `Info.plist` — flags ATS misconfigs, URL schemes, background modes
`ios_permissions_checker`	Categorizes privacy permission declarations by HIGH / MEDIUM / LOW risk
`ios_entitlements_checker`	Extracts entitlements via `codesign` — flags `get-task-allow`, sandbox bypass, iCloud containers
`ios_binary_strings`	Extracts URLs, emails, IPs, and API key patterns from the Mach-O binary
`ios_frameworks_detector`	Lists bundled frameworks, maps ~60 known SDKs (analytics, ads, attribution, crash reporting)
`ios_google_services`	Parses `GoogleService-Info.plist` for full Firebase configuration
`ios_secrets_scanner`	Scans app binary + resource files for hardcoded secrets and credentials

Shared Pattern Registry

All secret and Google service detection patterns live in a single patterns.ts — easy to extend, used by both Android and iOS scanners.

Related MCP server: mobile-debug-mcp

Installation

npm install -g mobile-security-mcp

Configure Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "mobile-security-mcp": {
      "command": "npx",
      "args": ["mobile-security-mcp"]
    }
  }
}

Config file locations:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Run from source

git clone https://github.com/Serhatcck/mobile-security-mcp.git
cd mobile-security-mcp
npm install && npm run build

{
  "mcpServers": {
    "mobile-security-mcp": {
      "command": "node",
      "args": ["/absolute/path/to/mobile-security-mcp/dist/index.js"]
    }
  }
}

Usage

Once configured, restart Claude Desktop and start a conversation:

"Analyze the permissions in /path/to/app.apk"

"Check this IPA for hardcoded API keys: /path/to/app.ipa"

"What Firebase services does this APK use?"

"Are there any exported components in this APK that could be an attack surface?"

"Show me all third-party SDKs in this iOS app and flag any privacy risks"

Prerequisites

Android:

apktool — required for android_api_extractor (brew install apktool)
aapt (optional) — speeds up manifest parsing, part of Android SDK build tools

iOS (macOS only):

codesign, plutil, strings — all built into macOS, no install needed

Tools

`apk_manifest_analyzer`

Input:  apk_path (string)
Output: Package info, security flags, components, intent filters, warnings

`apk_permissions_checker`

Input:  apk_path (string)
Output: Dangerous permissions (highlighted) + normal permissions + risk summary

`android_api_extractor`

Input:  apk_path OR smali_folder (string), output_format (txt|postman)
Output: Retrofit HTTP endpoints or Postman collection JSON

`android_google_services`

Input:  apk_path (string), smali_folder (optional)
Output: Firebase project ID, API keys, database URL, storage bucket, OAuth clients

`android_secrets_scanner`

Input:  apk_path (string), smali_folder (optional), min_length (default 8)
Output: Hardcoded credentials found in DEX + resources.arsc + assets

`ios_manifest_analyzer`

Input:  ipa_path (string)
Output: Bundle info, ATS settings, URL schemes, background modes, warnings

`ios_permissions_checker`

Input:  ipa_path (string)
Output: Privacy permissions grouped by HIGH/MEDIUM/LOW risk with usage descriptions

`ios_entitlements_checker`

Input:  ipa_path (string)
Output: Entitlements extracted from binary, high-risk flags, simulator detection

`ios_binary_strings`

Input:  ipa_path (string), filter (all|url|key|email|ip), min_length (default 6)
Output: Filtered strings from Mach-O binary

`ios_frameworks_detector`

Input:  ipa_path (string)
Output: Bundled frameworks grouped by category with privacy risk annotations

`ios_google_services`

Input:  ipa_path (string)
Output: Full GoogleService-Info.plist contents + pattern scan of resource files

`ios_secrets_scanner`

Input:  ipa_path (string), min_length (default 8)
Output: Secrets found in resource files and binary, split by layer with severity

Demo

demo

Regenerate with VHS: brew install charmbracelet/tap/vhs && vhs docs/demo.tape

Contributing

See CONTRIBUTING.md for development setup, how to add new tools, and PR guidelines.

Security

See SECURITY.md for how to report vulnerabilities privately.

Changelog

See CHANGELOG.md.

License

MIT © Serhatcck

Available Tools

12 tools

android_api_extractorA

Decompiles an APK and extracts Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode. Outputs a list of API endpoints or a Postman collection.

Inputs: apk_path, smali_folder, output_format.

android_google_servicesA

Extracts Google and Firebase configuration from an APK. Parses google-services.json if present, then scans resources.arsc for string values using the strings command. If a smali_folder (apktool output) is provided, parses res/values/strings.xml directly for structured key=value output.

Inputs: apk_path (required), smali_folder.

android_secrets_scannerA

Scans an APK for hardcoded secrets and API keys. Without smali_folder: runs strings on classes*.dex and resources.arsc, plus scans text assets inside the APK. With smali_folder (apktool output): scans res/values/strings.xml and assets as plain text files.

Inputs: apk_path (required), smali_folder, min_length.

apk_manifest_analyzerA

Parses AndroidManifest.xml from an APK. Extracts package info, activities, services, receivers, intent filters, and highlights security-relevant flags like exported components, debuggable, and allowBackup.

Inputs: apk_path (required).

apk_permissions_checkerB

Extracts and categorizes permissions requested by an APK. Dangerous permissions (those that grant access to sensitive user data or device features) are highlighted separately.

Inputs: apk_path (required).

ios_binary_stringsA

Extracts printable strings from an iOS app binary and filters for security-relevant patterns: HTTP/S URLs, API keys, AWS/Firebase/Google credentials, email addresses, and private IP addresses.

Inputs: ipa_path (required), filter, min_length.

ios_entitlements_checkerA

Extracts and analyzes entitlements embedded in the iOS app binary using codesign. Detects dangerous entitlements like get-task-allow (debug builds), iCloud containers, and keychain groups.

Inputs: ipa_path (required).

ios_frameworks_detectorA

Lists all third-party frameworks bundled inside an IPA (from the Frameworks/ directory). Maps known frameworks to categories: networking, analytics, ads, attribution, crash reporting, etc. Highlights privacy-relevant SDKs.

Inputs: ipa_path (required).

ios_google_servicesA

Extracts Google and Firebase configuration from an IPA. Parses GoogleService-Info.plist for API key, project ID, database URL, storage bucket, GCM sender ID, and OAuth client IDs. Also applies Google pattern scanning across all text plist and JSON files in the IPA.

Inputs: ipa_path (required).

ios_manifest_analyzerB

Parses Info.plist from an IPA file. Extracts bundle ID, version, URL schemes, App Transport Security settings, background modes, and highlights insecure configurations.

Inputs: ipa_path (required).

ios_permissions_checkerB

Extracts privacy permission usage descriptions from an IPA's Info.plist. Each permission is categorized by risk level (HIGH / MEDIUM / LOW) with an explanation.

Inputs: ipa_path (required).

ios_secrets_scannerA

Scans an IPA for hardcoded secrets and API keys. Layer 1: scans text resource files (JSON, XML, .strings, XML plists) inside the IPA. Layer 2: extracts the app binary and runs the strings command to find constants in compiled code.

Inputs: ipa_path (required), min_length.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored 2026-06-12 14:36 across 12 tools

Disambiguation5/5

Each tool targets a distinct platform (Android vs iOS) and a specific security analysis function (e.g., permissions, secrets, manifests, frameworks). There is no overlap in purpose.

Naming Consistency5/5

All tools follow a consistent snake_case pattern with a platform prefix (android_ or ios_) followed by a descriptive noun phrase. No mixing of conventions.

Tool Count5/5

12 tools cover both Android and iOS comprehensively without redundancy. The count is well-scoped for the domain of mobile security analysis.

Completeness4/5

Core areas (manifest, permissions, secrets, configurations, frameworks, API endpoints) are covered. Minor gaps include lack of dynamic analysis or network security checks, but static analysis is thorough.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

MCP Fortress
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
https://server.smithery.ai/@mcp-fortress/mcp-fortress-server/mcp
Android Security AnalyzerA
io.github.ako2345
MCP server for static security analysis of Android source code
Security Code Analysis Testing & QA Tools
423
https://android-security-analyzer.ako-labs.workers.dev/mcp
MCPVetter
com.mcpvetter
Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.
Penetration Testing Code Analysis Testing & QA Tools
1
https://mcpvetter.com/mcp
skill-audit-mcpA
io.github.eltociear
MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.
Security Penetration Testing
1115
https://eltociear-skill-audit.hf.space/mcp

Related MCP Servers

Reversecore_MCP
Code Analysis Penetration Testing
sjkim1127
A
license
Not graded
quality
B
maintenance
An enterprise-grade MCP server for AI-powered reverse engineering. Enables AI agents to perform comprehensive binary analysis through natural language commands.
Updated 2 days ago (2026-11-10 02:07 UTC)
81 PyPI
220
MIT
mobile-debug-mcp
Developer Tools Testing & QA Tools
clivejefferies
A
license
B
quality
B
maintenance
A minimal, secure MCP server for AI-assisted mobile development, enabling build, install, interact, and inspect Android/iOS apps.
Updated 6 days ago (2026-11-06 19:35 UTC)
53
468 npm
14
Apache 2.0
VulnPilot
Code Analysis Testing & QA Tools
arojit
A
license
A
quality
D
maintenance
An MCP server that gives AI assistants the ability to check open-source packages for vulnerabilities, enrich findings with real-world exploit intelligence, and statically analyse whether vulnerable code is actually reachable in your project.
Updated 3 months ago (2026-08-01 07:16 UTC)
3
1
Apache 2.0
jadx-rpc
Code Analysis Developer Tools
AsherDLL
A
license
Not graded
quality
D
maintenance
MCP server for analyzing Android APK, DEX, or JAR files via a headless jadx engine, enabling LLM agents to query decompiled code, symbols, call graphs, and more.
Updated 4 months ago (2026-07-27 20:18 UTC)
2
GPL 3.0

Features

Android

iOS

Shared Pattern Registry

Installation

Configure Claude Desktop

Run from source

Usage

Prerequisites

Tools

apk_manifest_analyzer

apk_permissions_checker

android_api_extractor

android_google_services

android_secrets_scanner

ios_manifest_analyzer

ios_permissions_checker

ios_entitlements_checker

ios_binary_strings

ios_frameworks_detector

ios_google_services

ios_secrets_scanner

Demo

Contributing

Security

Changelog

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Reversecore_MCP

mobile-debug-mcp

VulnPilot

jadx-rpc

`apk_manifest_analyzer`

`apk_permissions_checker`

`android_api_extractor`

`android_google_services`

`android_secrets_scanner`

`ios_manifest_analyzer`

`ios_permissions_checker`

`ios_entitlements_checker`

`ios_binary_strings`

`ios_frameworks_detector`

`ios_google_services`

`ios_secrets_scanner`