bevigil-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BEVIGIL_API_KEY | Yes | Your BeVigil API key. Get one free at bevigil.com. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| bevigil_get_hostsA | Get hostnames and domains found in an Android application's code. Use this to discover backend servers, APIs, and third-party services that a mobile app communicates with. Requires an Android package ID. Returns a list of unique hostnames/domains extracted from the app. |
| bevigil_get_subdomainsA | Discover subdomains associated with a domain, as found across mobile applications indexed by BeVigil. Useful for attack surface mapping and asset discovery. Returns a list of unique subdomains. Note: Results come from mobile app analysis, not traditional DNS enumeration. |
| bevigil_get_urlsA | Get URLs associated with a domain, as discovered from mobile application analysis. Useful for finding API endpoints, web paths, and resources referenced by apps. Returns a list of full URLs. Results may include internal/staging endpoints that are not publicly indexed by search engines. |
| bevigil_get_s3_bucketsA | Find Amazon S3 bucket names referenced in an Android application's code. Useful for discovering cloud storage assets associated with a mobile app. These buckets may contain publicly accessible data if misconfigured. Note: Finding a bucket name does NOT confirm it is vulnerable or misconfigured — further investigation is required. |
| bevigil_get_app_packagesA | Find Android application packages that reference a given hostname or domain. Use this for reverse lookups — given a server/domain, discover which mobile apps communicate with it. Useful for understanding the app ecosystem around a service. Returns package IDs and app names where available. |
| bevigil_get_wordlistA | Get a wordlist generated from an Android application's code. The wordlist includes URL paths, API endpoints, file paths, and parameters extracted from the app. Useful for fuzzing, directory brute-forcing, and understanding the app's API surface. Returns a list of path/endpoint strings. |
| bevigil_investigate_appA | Perform a comprehensive investigation of an Android application using BeVigil. This combines multiple lookups (hosts, S3 buckets, parameters, wordlist) into a single structured report. Use this when you need a broad overview of an app's exposed infrastructure rather than querying individual asset types. Returns a structured investigation summary with observed findings. Note: All findings are observed data — they do NOT indicate vulnerabilities without further analysis. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct resource type (hosts, subdomains, URLs, S3 buckets, app packages, wordlists) with clear input requirements (package ID vs domain), making misselection unlikely. The composite investigate_app is explicitly higher-level and differentiated from individual lookups.
All tools share the bevigil_ prefix and follow a consistent verb_noun pattern (get_X for direct lookups, investigate_app for the composite). Names are snake_case throughout with no mixed conventions or ambiguous verbs.
Seven tools is well within the ideal 3-15 range. Each tool represents a distinct asset-discovery query or one composite overview, so every tool earns its place without redundancy.
The set covers both app-centric queries (hosts, S3 buckets, wordlist, investigate) and domain-centric queries (subdomains, URLs, reverse package lookup), providing comprehensive coverage of mobile app attack-surface assessment with no obvious dead ends.