Enables dynamic instrumentation of Android apps via Frida: spawning apps suspended, exploring and searching classes/methods, hooking Java methods, tracing calls, enumerating modules/exports/symbols, reading/writing/scanning memory, dumping module memory for Ghidra/IDA, bypassing SSL pinning (TrustManager, OkHttp, Conscrypt) and capturing TLS keys/plaintext.
Enables dynamic instrumentation of iOS apps via Frida (jailbroken or Frida Gadget): hooking Objective-C methods such as -[Class sel:], tracing, module and symbol enumeration on the ObjC runtime, memory analysis, SSL pinning bypass (SecTrust, ATS, BoringSSL) and TLS key/plaintext capture, plus optional UI automation.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@frida-mobile-mcp attach to com.example.app on the emulator and bypass its SSL pinning"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that gives AI agents dynamic instrumentation of Android and iOS apps through Frida 17, and runs next to REA, ReVa (Ghidra) and IDA MCP servers. It exposes 71 tools: high-level ones that manage devices, sessions and scripts for you (explore an app, hook a Java/ObjC/native method, trace calls, map reachability coverage and autonomously drive the UI toward it, find secrets in memory and turn them into reusable friTap patterns, cast a wide net over crypto, bypass SSL pinning, capture TLS keys and plaintext with friTap, run prebuilt analysis scripts, validate custom scripts) and low-level primitives (spawn/attach, module and symbol enumeration, address resolution, control-flow analysis, memory dumps). Addresses use the same module+0xoffset notation as Ghidra/IDA so results move between static and dynamic tools without conversion, and every result carries an evidence envelope (evidence_id, limitations, coverage). Optional UI automation goes through mobile-mcp.
npx frida-mobile-mcp # stdio MCP server (default `serve` command)
frida-mobile-mcp doctor # check Node, frida-node, adb, devices, frida-server, bridge bundles
frida-mobile-mcp setup --client cursor # write the server into a client config (claude-code, claude-desktop, cursor, vscode, windsurf, codex)
frida-mobile-mcp gadget --platform android --print # generate a frida-gadget config.json + APK/IPA repackaging guidanceThe gadget command generates a frida-gadget config.json (--interaction listen or --interaction script) and prints the APK/IPA repackaging steps. Embedding the gadget is the only way to instrument native detection that runs in .init_array / JNI_OnLoad before an attach-time script can load, and it removes the frida-server :27042 port as a fingerprint — see frida_help({ topic: "evasion" }).
Claude Code:
claude mcp add frida -- npx -y frida-mobile-mcpClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"frida": {
"command": "npx",
"args": ["-y", "frida-mobile-mcp"],
"env": { "FRIDA_DEVICE_ID": "emulator-5554" }
}
}
}Per-client instructions, HTTP mode and remote frida-server setup are in docs/clients.md. A Claude Desktop extension manifest (manifest.json, MCPB) and an MCP registry entry (server.json) ship in the repo.
Related MCP server: Frida MCP Server
Node.js >= 22.12 (CI runs 22 and 24 on Linux, macOS and Windows). npm install runs the frida package's install script, which downloads the native frida-node prebuild.
A device or emulator running frida-server 17.x. This package depends on frida-node ^17.24.3; frida-server on the device must have the same major version (17) and ideally the same minor version. frida-mobile-mcp doctor prints both versions and flags mismatches.
Android: download the matching frida-server-17.x.y-android-<arch>.xz from https://github.com/frida/frida/releases, then
xz -d frida-server-17.24.3-android-arm64.xz
adb push frida-server-17.24.3-android-arm64 /data/local/tmp/frida-server
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "su -c '/data/local/tmp/frida-server &'"iOS: a jailbroken device with the matching Frida package from the Frida Cydia/Sileo repository. Non-jailbroken devices need the app repackaged with the Frida Gadget; the server then attaches to the gadget-enabled process like any other.
Optional: pip install friTap for capture_tls (otherwise the pinned agent is downloaded on first use), and network access for npx -y @mobilenext/mobile-mcp@latest on first mobile_action.
Bridges are bundled. Frida 17 no longer ships the Java/ObjC bridges in the GumJS runtime. npm run build:bridges bundles frida-java-bridge and frida-objc-bridge into dist/bridges/{java,objc}.js; the server injects the right one by platform (Java on Android, ObjC on iOS/macOS) ahead of every script.
Legacy scripts still work. execute_script runs classic (non-module) scripts through Script.evaluate, so a Java.perform(...) script written for Frida 16 runs unchanged and keeps its own line numbers in errors. ES modules (import Java from "frida-java-bridge", JS or TS) are compiled on the host with the Frida Compiler; frida-compile bundles (starting with the 📦 marker) are loaded as-is.
Removed APIs are linted. validate_script flags the static Module.findExportByName/findBaseAddress/enumerateExports, Memory.readX/writeX and *Sync enumerators that throw on Frida 17 and suggests the Module-instance / NativePointer replacements. Generated scripts get findExport(lib, name) and hookNative(lib, name, callbacks) helpers from the agent preamble, and template options as __FRIDA_MCP__.options.
analyze_native_function uses Process.findFunctionRange and the Frida 17.12+ ControlFlowGraph (with a linear-disassembly fallback reported in limitations).
Tool | Description |
| Connected devices, active sessions (platform, script count, last activity), hooks, traces and recent detaches/crashes. Run first and after a session is lost. |
| Topic help: overview, hooking, tracing, memory, scripts, native, tls, mobile, examples, advanced, evasion, script_catalog, script_api, recipes, interop. |
| Fingerprint libraries, frameworks and security mechanisms; returns recommended script targets. |
| Spawn an app suspended, instrument, resume; returns pid, platform, modules and a filtered class list. |
| Identify the installed artifact: version, SDK levels, debuggable, installer and every APK (base + splits) with on-device sha256/size; |
| Regex search over classes (and methods with |
| Full shape of one loaded class: every method overload with parameter/return types and a hook-ready |
| Find where an app does crypto (or any API family) without assuming |
| Content-aware memory scan for the structure of secrets: RC4 S-box ( |
| Turn a located secret into a reusable anchor pattern (stable byte signature near the key + offset): re-locate it with |
| Crypto-oracle wide net: discover and hook all likely crypto sinks at once (app-owned classes + |
| Reachability map: arm cheap persistent entry-hooks over a class/package/module scope and track covered vs cold targets across |
| Autonomously drive an instrumented session's UI toward uncovered code — taps on-screen elements breadth-first and stops the instant a crypto/secret signal fires (or coverage stalls / |
| Watch for late-loaded |
| Perform a UI action and block until the resulting hook/message output arrives, so you learn which hook a tap fired (or that none did). |
| Hook Java ( |
| frida-trace style tracing of glob patterns ( |
| Run a custom script: classic JS (bridges injected), ES module JS/TS (compiled with the Frida Compiler) or a frida-compile bundle. |
| Syntax, type and Frida 17 removed-API check without a device. Use before |
| Run one of the 9 prebuilt scripts below; call without |
| One-click pinning bypass (Android: TrustManager, OkHttp CertificatePinner, Conscrypt; iOS: SecTrust, ATS, BoringSSL). |
| friTap: TLS session keys (NSS key log) and optional decrypted plaintext / synthetic pcap for OpenSSL/BoringSSL, Conscrypt, NSS, GnuTLS, wolfSSL, mbedTLS, Secure Transport and more. Accepts friTap |
| Read up to 4 MB at any address notation; returns hex plus absolute address and |
| Write hex bytes to memory. Disabled unless |
| Byte-pattern scan ( |
| Buffered hook invocations, trace hits, |
| Re-read a persisted tool result (params, status, structured result) by |
| Export persisted results as a JSON or Markdown bundle, inline or to a file. |
| Remove all hooks, scripts and traces on a target and detach. |
| Unload a single script (hook, trace or custom) from a session while keeping it attached. |
| Gateway to mobile-mcp UI automation (screenshot, elements, tap, swipe, type, launch app, list apps). |
| Search the purpose-indexed library of ready-to-run classic-JS recipes (custom crypto-key capture, native/JNI hooks, classloader/intent/WebView, iOS Keychain); returns ranked recipes with source to adapt and run via |
| Save a script under |
| List scripts saved with |
| Run a saved script by name against a target. Requires |
| Export a script as a standalone classic |
Tool | Description |
| Local, USB and remote Frida devices (frida-ls-devices). |
| Select the active device by ID, type or remote host. |
| OS version, architecture and system parameters. |
| Running processes (frida-ps). |
| Installed and running applications. |
| Foreground application. |
| Spawn suspended for early instrumentation; resume with |
| Attach to a running process by PID or name. |
| Resume a suspended process. |
| Kill a process. |
| Detach a session and unload its scripts. |
| Sessions managed by this server. |
| Enable / disable / list device-wide spawn gating — hold newly spawned (incl. child/isolated) processes suspended for early instrumentation; release with |
| Enable / disable child gating on a session so forked/exec'd child processes are held for instrumentation. |
| Pin a loaded script in the target so it survives detach (fire-and-forget: no more messages/unload) — leave a bypass/monitor running while you free the session. |
| Loaded modules with name, base, end, size, path; regex |
| Exports of a module, paginated. |
| Imports of a module with the providing module, paginated. |
| Symbols including non-exported/debug symbols; regex filter and paging inside the agent (Linux, Android, iOS, macOS). |
| Translate |
| Function range, basic blocks and edges, first instructions; addresses as absolute and |
| Dump a module base-relative to a host file (under cwd, the temp dir or |
| Threads with id, name, state, current pc as |
| Low-level |
| Remove a hook by ID. |
| Android (adb): report frida-server PIDs, device CPU ABI, matching frida release arch, and the GitHub |
| Android (adb): push a local (decompressed) frida-server binary to the device and |
| Android (adb): start frida-server daemonized (optionally via |
| Android (adb): signal the matching frida-server process to stop ( |
| Android (adb): run an arbitrary device shell command. Disabled by default — requires |
| Android (adb): dump the last N logcat lines (one-shot), optional |
| Android (adb): move files between host and device. |
| Android (adb): add / remove / list port forwards (reach a frida-server on a non-default device port). |
| Inject a native library (.so/.dylib) from the host into a process via Frida's injector, independent of the JS engine — the parity path for a prebuilt gadget/agent or custom .so. Disabled by default — needs |
mobile_action({ action, params }) forwards to a lazily spawned mobile-mcp process (npx -y @mobilenext/mobile-mcp@latest by default, configurable via mobileMcp, disabled with --no-mobile-mcp). Call it without action to list the available actions. All Frida tools work without it; when it cannot start the error is MOBILE_MCP_UNAVAILABLE.
The server also exposes frida:// resources (version, devices, processes, apps, sessions, messages, script catalog, persisted evidence via frida://evidence and frida://evidence/{id}) and five workflow prompts (explore_app, security_audit, trace_functionality, write_frida_script, hunt_secrets).
Script | Purpose |
| Bypass certificate pinning (TrustManager, OkHttp, Conscrypt, WebView; SecTrust, ATS, BoringSSL, AFNetworking) |
| Bypass root/jailbreak detection (Java, SystemProperties, native fopen/access/stat, canOpenURL, sysctl) |
| List loaded Java/ObjC classes with a regex filter, optionally with methods |
| Generic method hook (Java/ObjC methods or a native |
| javax.crypto, CommonCrypto and OpenSSL calls |
| Sockets, DNS, UDP and TLS SSL_read/SSL_write (plaintext bytes with |
| iOS Keychain and Android SharedPreferences access |
| File I/O and SQLite |
| Observe ( |
Every tool that takes or returns a native address uses one vocabulary:
Form | Meaning | Example |
| export or ELF/Mach-O symbol |
|
| offset from the module base (Ghidra/IDA RVA); decimal |
|
| absolute runtime address |
|
| global export searched across all modules |
|
Results prefer module+0xoffset so a static tool can decompile at image base + offset; absolute addresses appear only outside known modules and come with a limitations entry.
Every successful call returns result, evidence_id (UUID, also written to the audit log), limitations[], coverage (complete | unknown), session_context and suggested_next. Errors carry code, category, retryable, remediation and recovery_actions. Every result, errors included, is also persisted to the evidence store and retrievable by its evidence_id via get_evidence, export_evidence_bundle and the frida://evidence/{id} resource (frida://evidence lists the latest 100). Field semantics and the error-code table are in docs/interop.md; the agent workflow around them is in skills/mobile-dynamic-analysis/SKILL.md.
frida-mobile-mcp is built to run next to ReVa (Ghidra), ida-pro-mcp (IDA Pro) and REA: the static side answers what the code says, this server answers what it does at runtime. A static tool finds libfoo.so+0x1234; hook_method or analyze_native_function take that string as-is; backtraces and resolve_address give offsets back in the same form for decompilation. enumerate_modules returns base/end for rebasing a Ghidra/IDA project, dump_module_memory writes a base-relative image of an unpacked library for raw import, and capture_tls shows the bytes a statically found wrapper actually puts on the wire. A three-server client configuration and a full static -> dynamic -> static walkthrough are in docs/interop.md.
REA covers static Android analysis (inspect_android_package, inspect_android_method), ADB housekeeping and a generic Frida lane for desktop binaries; this server covers the mobile runtime (Java/ObjC bridges, prebuilt scripts, TLS keys, memory, UI driving). Register both in the same client, start with get_app_info so both servers analyse the same APK hash, and keep the combined catalog small with FRIDA_MCP_TOOL_PROFILE=core and FRIDA_MCP_TOOLS_EXCLUDE=adb_*,frida_server_*. Both servers return an evidence envelope with citable evidence_ids and an export_evidence_bundle tool, so one finding ledger can cite both. Routing rules, install lines, the field and error-code mapping and an APK -> static -> hook -> report walkthrough are in docs/rea.md.
frida-mobile-mcp --transport http --port 3000 # loopback (127.0.0.1), token optional
FRIDA_MCP_HTTP_TOKEN=<token> frida-mobile-mcp --transport http --host 0.0.0.0 --port 3000Streamable HTTP endpoint at /mcp with one MCP session per client (Mcp-Session-Id); DELETE /mcp with that header ends the session. The server binds to loopback by default; a Bearer token (--http-token or FRIDA_MCP_HTTP_TOKEN) is mandatory when --host is not a loopback address and the server refuses to start without one. Host and Origin headers are validated against the bound host (DNS-rebinding protection). There is no TLS; use a reverse proxy or SSH tunnel across networks. --port 0 picks a free port; the bound URL is printed as a JSON line on stderr. Full curl examples: docs/clients.md.
import { McpServer } from '@modelcontextprotocol/server';
import { createServer, registerFridaTools, createSessionServer } from 'frida-mobile-mcp';
const server = createServer({ allowCustomScripts: false }); // ready-made McpServer with every tool
// or add the tools to your own server:
const mine = new McpServer({ name: 'my-agent', version: '1.0.0' });
const deviceManager = registerFridaTools(mine, { resources: true, prompts: false });
// or one server per HTTP session:
const perSession = createSessionServer();Also exported: scriptRegistry, DeviceManager, composeAgentSource/createAgentScript, findRemovedApis, loadBridgeSource, startHttpServer, createStdioTransport, loadConfig, ensureState and the types (dist/lib.d.ts).
Config file ~/.config/frida-mobile-mcp/config.json (merged over defaults, then CLI flags, then environment):
{
"allowCustomScripts": false,
"memoryWriteEnabled": false,
"allowNativeInjection": false,
"allowedDevices": [],
"maxSessions": 4,
"sessionTimeoutMinutes": 30,
"maxMessageBuffer": 1000,
"auditLogPath": "~/.config/frida-mobile-mcp/audit.jsonl",
"evidence": { "enabled": true, "path": "~/.config/frida-mobile-mcp/evidence", "maxMb": 200, "maxEntries": 5000, "maxEntryKb": 2048 },
"mobileMcp": { "enabled": true, "command": "npx", "args": ["-y", "@mobilenext/mobile-mcp@latest"] },
"rateLimits": { "scriptsPerMinute": 10, "memoryReadsPerMinute": 60, "sessionsPerMinute": 5 }
}Variable | Default | Description |
| first USB device | Device to use; same as |
| unset |
|
| unset |
|
| unset |
|
| unset |
|
| unset |
|
| unset |
|
| unset | Auth token of that frida-server ( |
| unset | Path to the PEM certificate of a TLS frida-server ( |
| unset | Bearer token for the HTTP transport; same as |
|
|
|
|
|
|
| (none) | Comma-separated tool-name globs never registered, e.g. |
|
| Truncation limit for a single tool response |
| Frida default |
|
| unset |
|
|
|
|
|
| Evidence store directory ( |
|
| Size cap of the evidence store; the oldest records are pruned beyond it |
|
| Directory with the bundled |
|
| Project dir the Frida Compiler uses for ES module scripts |
| unset | Path to a |
|
| friTap tag to download when no local agent is found |
| pinned for | Bare sha256 of the downloaded friTap agent for the selected |
execute_script and custom hook_function handler bodies are refused with CUSTOM_SCRIPTS_DISABLED unless allowCustomScripts is on; prebuilt scripts and typed hook tools never need it.
write_memory is refused with MEMORY_WRITE_DISABLED unless memoryWriteEnabled is on. Prebuilt scripts that write target memory (e.g. anti_frida_evasion with mode=spoof) and watch_loads with spoof=true are gated the same way.
inject_library is refused with NATIVE_INJECTION_DISABLED unless allowNativeInjection is on — a capability kept separate from allowCustomScripts so native code injection can be withheld even when JS agents are permitted.
allowedDevices restricts which device IDs may be used (empty = any).
Rate limits per minute for script loads, memory reads/scans and attach/spawn (RATE_LIMIT_EXCEEDED, retryable); maxSessions and sessionTimeoutMinutes cap concurrent and idle sessions.
Every tool call is appended to the JSONL audit log at auditLogPath with its evidence_id.
Every tool result (including memory dumps' metadata, read memory and found secrets) is persisted under the evidence path (evidence.path, default ~/.config/frida-mobile-mcp/evidence) with mode 0600; opt out with FRIDA_MCP_EVIDENCE=0.
dump_module_memory only writes under the current directory, the OS temp directory or ~/.config/frida-mobile-mcp/dumps.
HTTP transport: loopback bind by default, token required off-loopback, Host/Origin validation.
See SECURITY.md for reporting vulnerabilities.
Version mismatch (unable to connect to remote frida-server, protocol/"unexpected message" errors, timeouts while adb devices works): frida-server on the device must be 17.x matching frida-node. Run frida-mobile-mcp doctor, then push the matching release (see Requirements).
"Timeout was reached" / app killed after spawn: Android kills a spawned app that stays suspended for more than ~10 s (Frida >= 17.6 cannot disable the launch timeout). explore_app resumes before class enumeration for this reason; with spawn_process, call resume_process promptly. If spawning is slow, launch the app first and attach (spawn: false / attach_process).
No Java messages right after hooking: Java hooks install inside Java.perform, which runs once the ART VM is up. Poll get_messages again after a few seconds. "Java is not available" means a native-only process; use hook_function, enumerate_exports or analyze_native_function.
Frida java bridge bundle not found: run npm run build:bridges (part of npm run build and pretest) or point FRIDA_MCP_BRIDGES_DIR at a directory with java.js/objc.js.
npm install fails downloading the frida prebuild: the frida package fetches its native binding in an install script; make sure install scripts are allowed (npm ci --foreground-scripts shows the download) and GitHub releases are reachable.
Two devices attached: set FRIDA_DEVICE_ID/--device, pass device to the tool, or select_device; with allowedDevices set an unlisted device yields DEVICE_NOT_FOUND.
SESSION_LOST / "script destroyed": the app crashed or was detached; get_status shows recent_detaches. Re-running the hook tool creates a fresh session; frequent crashes right after hooking point to anti-Frida checks (root_jailbreak_bypass, capture_tls({ anti_root: true })).
FRITAP_AGENT_UNAVAILABLE: pip install friTap, set FRITAP_AGENT_PATH, or allow the download (allow_download: true).
npm ci --foreground-scripts # installs deps and the frida prebuild
npm run build # build:bridges (rollup bundles of the Java/ObjC bridges) + tsc
npm run lint # tsc --noEmit
npm test # vitest (pretest rebuilds the bridges); device suites are skipped
npm run dev # tsc --watchDevice end-to-end tests opt in through environment variables:
FRIDA_MCP_E2E_DEVICE=emulator-5556 FRIDA_MCP_E2E_TARGET=com.example.rc4demo npx vitest run test/e2e
FRIDA_MCP_E2E_DEVICE=emulator-5556 npx vitest run test/fritap/capture-tls.e2e.test.tsThe older FRIDA_E2E=1, FRIDA_DEVICE_ID and FRIDA_E2E_TARGET names still work for the capture_tls test.
Commits follow Conventional Commits (feat:, fix:, docs:, ...); release-please opens the release PR, maintains CHANGELOG.md and the publish job in release.yml publishes to npm via OIDC trusted publishing. See CONTRIBUTING.md and AGENTS.md.
This server cannot be deployed
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Let AI agents control Android and iOS devices on Mobilerun Cloud: screen, input, apps, workflows.
Search and inspect source-pinned agent skills, plugins and tools through a free public MCP.
Melaya is a remote MCP server. It gives an assistant hands on your own Android phone and browser: it reads the screen through the accessibility tree, then taps, types and navigates inside the apps and sites you allow-list, with no per-app API. It also builds, schedules and runs agent pipelines across 6k+ connected tools. OAuth 2.1, nothing to install.
