"iOS Anti-Debugging Techniques and Implementation" matching MCP tools:

• atlas_technique_search

  ContrastAPI

  Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.

  Connector

• cabgo_pricing

  Cabgo Builder

  Public (no auth): informational pricing reference. Returns monthly SaaS subscriptions (Basic / Professional / Enterprise — $15/$30/$70 per month) and one-time app-build packages (Starter $399 Android-only, Pro $699 Android+iOS, Full $999 Android+iOS+source code). All plans include unlimited drivers / users / admins; Cabgo never charges commission per trip. **Informational only.** Do not generate or return a payment URL from this tool. When the operator wants to purchase, direct them to visit https://www.cabgo.app/empezar in their browser — all checkout happens on cabgo.app externally via Stripe, not inside this conversation.

  Connector

• register_agent

  PromptDNA

  Step 1 of autonomous self-registration - no API key required. Costs $0.01 USDC on Base (anti-spam fee, not a wallet-ownership proof). Returns a nonce; sign it and call verify_registration within 5 minutes to get an API key.

  Connector

• ios_record_start

  Robot Actions — Remote Device Control

  Start a screen recording on an iOS device. Captures the per-device MJPEG broadcast and remuxes server-side into an H.264 mp4 written under /recordings/. An iOS session must already be running (call ios_start_session first). The recording auto-stops after maxDurationSec (default 300, max 600) so a forgotten stop call cannot fill the disk. Returns a recordingId to pass to ios_record_stop. Only one recording per device at a time.

  Connector

• webpage_tabs

  Robot Actions — Remote Device Control

  List, open, switch and close browser tabs on the device — one tool for what would otherwise be several. `list` works on BOTH iOS Safari and Android Chrome and returns a pageId per tab; pass that pageId to any other webpage_* tool to act on that specific tab, on either platform. `new`, `select` and `close` are ANDROID ONLY and error on iOS rather than pretending — Safari can list and drive tabs remotely but cannot open or close them, and needs no switching since pageId already targets one directly. Stale tabs accumulate across sessions and clutter the list: close what you are done with.

  Connector

• bulk_atlas_technique_lookup

  ContrastAPI

  Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique search by tactic, parent lookup for sub-techniques). Free: 30/hr (1 per item), Pro: 500/hr. Returns {results [{technique_id, status (ok|not_found|invalid_format), technique, error}], total, successful, failed, partial, summary}.

  Connector

• search-music-docs

  Music Studio

  Search detailed documentation for Strudel live coding or ABC/ABCJS notation. Returns relevant code examples and explanations from the official docs. Use this when the curated guides (get-strudel-guide, get-music-guide) don't cover what you need — for specific functions, advanced techniques, or when you're unsure about syntax. Powered by semantic search over strudel.cc and ABCJS docs.

  Connector

• classify_intent

  ContextOverflow

  Describe what's going wrong — your human's complaint, or a failure you notice in your own behavior — and get the matching techniques. Deterministic matching; if the description fits two problems it returns one clarifying question instead of guessing.

  Connector

• webpage_hover

  Robot Actions — Remote Device Control

  Hover the pointer over an element in the device browser page, by CSS selector or by a `ref` from a page-elements listing (iOS Safari or Android Chrome, auto-detected). Scrolls it into view and dispatches a mouseMoved to its center — use it to reveal hover menus/tooltips before webpage_click. On iOS the event is isTrusted:false. Throws if the target does not resolve.

  Connector

• webpage_clear_cookies

  Robot Actions — Remote Device Control

  Expire all NON-HttpOnly cookies visible to the current page origin in the device browser (iOS Safari or Android Chrome, auto-detected), via document.cookie. LIMITATION: cannot clear HttpOnly or other-origin cookies (that needs the CDP Network domain, unavailable on the iOS bridge). Returns { cleared } — the count of cookies expired.

  Connector

• ios_screenshot

  Robot Actions — Remote Device Control

  Take a HIGH-FIDELITY screenshot of an iOS device (slow full-fidelity path). Returns base64 PNG image. For routine per-action screen checks prefer ios_mjpeg_screenshot — it is much faster; reserve ios_screenshot for when you need a crisp, full-fidelity frame. If the device is asleep (black frame) it auto-wakes and retries once. Requires an active iOS automation session (auto-starts if needed).

  Connector

• ios_tap

  Robot Actions — Remote Device Control

  Tap at (x,y) on an iOS device screen — the FALLBACK for when an element has no usable label. Prefer ios_tap_by_label (taps by accessibility label via the automation session, no coordinate math, works even on zero-area elements) whenever the target has a name in ios_page_source. Coordinates here are in physical screen points and must come from ios_page_source (the authoritative source), NOT eyeballed from a screenshot. Requires an active iOS automation session.

  Connector

• ios_navigate_url

  Robot Actions — Remote Device Control

  Navigate Safari to a URL on an iOS device via the automation session (address-bar type + submit), then VERIFY the navigation actually landed via the Web Inspector — so it never falsely reports success. For Safari, prefer ios_safari_navigate (CDP-based, also cold-opens Safari). Requires an active iOS automation session (auto-starts if needed).

  Connector

• webpage_cdp_command

  Robot Actions — Remote Device Control

  Send a raw DevTools-protocol command to the browser page on a device and return its reply — the escape hatch for capabilities no dedicated tool wraps yet (Emulation, Performance, CSS, Animation, DOM mutation, …). Works on BOTH iOS Safari and Android Chrome, auto-detected from the udid. `method` is "Domain.command" (e.g. "Emulation.setGeolocationOverride"); `params` is that command's parameter object. Scope is the BROWSER — this reaches web content only, never the device or native apps. Prefer a dedicated tool when one exists: they handle setup ordering, lifecycle and teardown that a bare command does not. IMPORTANT, iOS: the two engines do NOT implement the same protocol — Android is full CDP, iOS is WebKit's dialect. Chrome-only domains fail with -32601 "domain was not found" (Accessibility, Emulation, and Page.captureScreenshot are all absent on iOS), and a `*.enable` on iOS reports success without proving the domain exists, so never treat it as a capability probe — probe with a real method.

  Connector

• get_design_digest

  Motion Menu

  Get the machine-readable Motion Menu quality contract. Call before build_page or compose_page. It defines anti-generic composition rules, motion lifecycle, responsive requirements, truth constraints, and release verification gates.

  Connector

• atlas_technique_lookup

  ContrastAPI

  Look up a MITRE ATLAS technique — the AI/ML adversarial attack catalog. ATLAS catalogues TTPs targeting machine learning systems: prompt injection, model evasion, training data poisoning, model theft, etc. Roughly 80% of ATLAS techniques are AI/ML-specific (no ATT&CK bridge); 20% mirror an enterprise ATT&CK technique via attack_reference_id — use that to pivot to D3FEND defenses (d3fend_defense_for_attack) and CVE search. Sub-techniques inherit `tactics` from the parent (inherited_tactics=true flag) when ATLAS upstream leaves them empty. Use this tool when the user asks about AI/ML threats, LLM red-teaming, or adversarial ML; for multiple techniques in one call (e.g. drilling into a case study's techniques_used), prefer bulk_atlas_technique_lookup. Returns 404 when the id is not in the synced ATLAS catalog. Free: 30/hr, Pro: 500/hr. Returns {technique_id, name, description, tactics, inherited_tactics, maturity (demonstrated|feasible|realized), attack_reference_id, attack_reference_url, subtechnique_of, created_date, modified_date, next_calls}.

  Connector

• pentest_map_techniques

  pentest-mcp-server

  Given a profile of the authorized test target (technology stack, exposed services, authentication type, OS), return a ranked list of ATT&CK techniques and OWASP test cases most relevant to that profile — not a generic dump of all techniques. Ranking factors: platform match, service match, auth type exposure, technique prevalence. Each result includes why it is relevant to this specific profile, the detection opportunity, and the recommended mitigation. Use when starting an authorized engagement to prioritize the testing scope; pair with pentest_guide to get the full methodology for each top-ranked vector.

  Connector

• ios_tap_hid

  Robot Actions — Remote Device Control

  Tap at (x,y) via the direct input path (no automation session needed). Coordinates are iOS screen points (same frame as ios_page_source). Single-contact only. Prefer ios_tap for normal automation; use this to force HID or when the automation session is unavailable. Returns "no HID available" on iOS 17.x / no-tunnel.

  Connector

• ios_set_location

  Robot Actions — Remote Device Control

  Set the iOS device's GPS location for testing location-aware apps. Works on physical devices (iOS 16.4+) via the bundled iOS automation agent's simulated-location route. Coordinates persist until the device reboots or ios_clear_location is called. PREREQ: On the device, grant the iOS automation agent app Location Services permission (Settings → Privacy & Security → Location Services → automation runner → While Using App). Without this, the simulated value is cached server-side but apps on the device still see zero coordinates. SCOPE: only affects apps that read CoreLocation (CLLocationManager, Safari navigator.geolocation). Does NOT affect apps using IP-based geolocation, Wi-Fi/cell-tower triangulation, or anti-fraud detection paths.

  Connector

• webpage_get_dom

  Robot Actions — Remote Device Control

  Get the rendered outer HTML of the web page open in the device browser — works on BOTH iOS (Safari, via the Web Inspector) and Android (Chrome, via CDP); the platform is auto-detected from the udid. Returns document.documentElement.outerHTML, or the outerHTML of a CSS-selector-matched element when `selector` is given. On iOS, Safari is launched automatically if it is not already open. Output is capped at 100 000 characters with a truncation notice. This is web-page HTML — for a NATIVE app UI hierarchy use device_page_source (Android) or ios_page_source (iOS).

  Connector