"iOS Anti-Debugging Techniques and Implementation" matching MCP tools:

• atlas_technique_searchA

  ContrastAPIA

  Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.

  ConnectorNo auth

• automations_configureA

  9botA

  Reads and configures welcome messages, automatic replies, anti-spam, anti-link, RSS, approval, removal, and temporary-access rules. Use it for ongoing reactions to group events; use schedules_manage for future delivery and participants_manage for a one-time sanction. Specialized operations publish narrower schemas, and omitted patch fields remain unchanged. Preview and simulation do not remove members, while enabled rules can later cause external messages, approvals, or removals. For a preview, set input.preview=true; preview never applies the mutation. When confirmation is required, repeat the same operation and parameters with the returned input.confirmation_id.

  Connector

  Destructive

  OAuth

• webpage_cdp_commandA

  Robot Actions — Remote Device ControlB

  Send a raw DevTools-protocol command to the browser page on a device and return its reply — the escape hatch for capabilities no dedicated tool wraps yet (Emulation, Performance, CSS, Animation, DOM mutation, …). Works on BOTH iOS Safari and Android Chrome, auto-detected from the udid. `method` is "Domain.command" (e.g. "Emulation.setGeolocationOverride"); `params` is that command's parameter object. Scope is the BROWSER — this reaches web content only, never the device or native apps. Prefer a dedicated tool when one exists: they handle setup ordering, lifecycle and teardown that a bare command does not. IMPORTANT, iOS: the two engines do NOT implement the same protocol — Android is full CDP, iOS is WebKit's dialect. Chrome-only domains fail with -32601 "domain was not found" (Accessibility, Emulation, and Page.captureScreenshot are all absent on iOS), and a `*.enable` on iOS reports success without proving the domain exists, so never treat it as a capability probe — probe with a real method.

  Connector

  Destructive

  OAuth

• ios_set_device_languageA

  Robot Actions — Remote Device ControlB

  Change the iOS device's system language and / or locale (persistent, affects every app). iOS may relaunch SpringBoard to apply the change — expect a 5-10s flicker, and the value can take a few seconds to read back. Pass a BASE language code ("fr", not "fr-CA"): iOS reports a region-qualified language but refuses to set one, so a regional code is split into its base language plus a locale automatically. For per-app testing without changing the whole device, prefer ios_launch_app_in_language.

  ConnectorOAuth

• bulk_atlas_technique_lookupA

  ContrastAPIA

  Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique search by tactic, parent lookup for sub-techniques). Free: 30/hr (1 per item), Pro: 500/hr. Returns {results [{technique_id, status (ok|not_found|invalid_format), technique, error}], total, successful, failed, partial, summary}.

  ConnectorNo auth

• audit_ios_screenA

  RavenA

  Audit a rendered iOS screen from a view-hierarchy/accessibility snapshot (and optional screenshot). Alias of audit_screen with platform:"ios". Call with no arguments for the expected snapshot shape. Call with {elements:[{label,rect:{x,y,w,h},role,fontPt,fgColor,bgColor}],viewport:{w,h}} to score 44×44pt touch targets, contrast (with iOS secondaryLabel/tertiaryLabel treated as platform-standard — warn not fail), and visual rhythm (alignment, gap consistency, optical balance) in points. Same return shape as audit_page. Taste-profile bindings are not available on the hosted (remote) endpoint (per-user state is a later phase). Omit 'project'/'profile' to run the stateless iOS screen audit.

  ConnectorNo auth

• classify_intentA

  ContextOverflowA

  Describe what's going wrong — your human's complaint, or a failure you notice in your own behavior — and get the matching techniques. Deterministic matching; if the description fits two problems it returns one clarifying question instead of guessing.

  ConnectorNo auth

• get_design_digestA

  Motion MenuA

  Get the machine-readable Motion Menu quality contract. Call before build_page. It defines anti-generic composition rules, motion lifecycle, responsive requirements, truth constraints, and release verification gates.

  ConnectorNo auth

• sonar_track_appA

  sonarA

  WRITE tool — links the second-store version of an existing Sonar product (e.g. the product already tracks the iOS app and you want to add the Android version, or vice versa). Each product holds at most one iOS + one Android app; to start tracking a brand-new app, use sonar_create_product instead. Requires an Indie plan (trial counts) and an authorized Sonar account or an API key with the write scope.

  ConnectorNo auth

• atlas_technique_lookupA

  ContrastAPIA

  Look up a MITRE ATLAS technique — the AI/ML adversarial attack catalog. ATLAS catalogues TTPs targeting machine learning systems: prompt injection, model evasion, training data poisoning, model theft, etc. Roughly 80% of ATLAS techniques are AI/ML-specific (no ATT&CK bridge); 20% mirror an enterprise ATT&CK technique via attack_reference_id — use that to pivot to D3FEND defenses (d3fend_defense_for_attack) and CVE search. Sub-techniques inherit `tactics` from the parent (inherited_tactics=true flag) when ATLAS upstream leaves them empty. Use this tool when the user asks about AI/ML threats, LLM red-teaming, or adversarial ML; for multiple techniques in one call (e.g. drilling into a case study's techniques_used), prefer bulk_atlas_technique_lookup. Returns 404 when the id is not in the synced ATLAS catalog. Free: 30/hr, Pro: 500/hr. Returns {technique_id, name, description, tactics, inherited_tactics, maturity (demonstrated|feasible|realized), attack_reference_id, attack_reference_url, subtechnique_of, created_date, modified_date, next_calls}.

  ConnectorNo auth

• ios_mjpeg_screenshotA

  Robot Actions — Remote Device ControlB

  PREFERRED fast screenshot of an iOS device via the MJPEG stream. Returns the JPEG image PLUS a text block with the image pixel size and the device POINT size, and the exact formula to convert a pixel you read off the image into iOS screen points for the HID/tap tools (the image is NOT 1:1 with device points — guessing that scale is the #1 cause of missed taps). Much faster than ios_screenshot; use it for routine per-action checks. Auto-wakes on a black frame. Requires an active iOS automation session, because the speed comes from reading the frame stream that session is already running — with no session, use ios_fast_screenshot instead.

  ConnectorOAuth

• ios_list_appsA

  Robot Actions — Remote Device ControlB

  List the apps installed on an iOS device — user apps AND system apps like Settings and Safari, which the raw listing's default hides. Returns bundleId, name and type. Internal bundles are excluded: iOS reports 264 installed bundles on a typical iPad, of which ~51 are apps and the rest are XPC helpers and view services (MediaRemoteUIService, AAUIViewService, SpringBoard). Pass includeInternal to see those too. No automation session required.

  ConnectorOAuth

• ios_set_locationA

  Robot Actions — Remote Device ControlB

  Set the iOS device's GPS location for testing location-aware apps. Needs no automation session: it drives the device's own developer location-simulation service, and falls back to the automation agent's route only if that is unavailable. Stays in effect until ios_clear_location, a device reboot, or a restart of the device service (the simulation is a held connection on iOS 17+ — the reply's `transport` says which route ran). SCOPE: only affects apps that read CoreLocation (CLLocationManager, Safari navigator.geolocation). Does NOT affect apps using IP-based geolocation, Wi-Fi/cell-tower triangulation, or anti-fraud detection paths.

  ConnectorOAuth

• pentest_lookup_groupA

  pentest-mcp-serverA

  Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.

  ConnectorNo auth

• start_campaignA

  Salesbot - B2B outreach LinkedIn MCP Server with CRM and emailA

  Start (activate) an existing campaign: schedules the outreach actions for its contacts and sets status to 'running'. The campaign must already have contacts (add_contacts_to_campaign) and steps. Execution still respects daily limits, allowed hours and anti-detection delays.

  ConnectorAPI key

• get_waterpark_rulesA

  WiplashA

  Read the current public Wiplash karma prices, registration allowance, feedback settlement rules, and Cabana costs. Internal endpoints and implementation details are omitted.

  ConnectorNo auth

• ios_record_startA

  Robot Actions — Remote Device ControlB

  Start a screen recording on an iOS device. Captures the per-device MJPEG broadcast and remuxes server-side into an H.264 mp4 written under /recordings/. An iOS session must already be running (call ios_start_session first). The recording auto-stops after maxDurationSec (default 300, max 600) so a forgotten stop call cannot fill the disk. Returns a recordingId to pass to ios_record_stop. Only one recording per device at a time.

  ConnectorOAuth

• ios_contacts_hidA

  Robot Actions — Remote Device ControlB

  Press-and-HOLD up to five contacts at once via direct HID input (no automation session needed), WITHOUT lifting. One call is one frame, so all fingers land at the same instant — call it repeatedly to steer them (a two-finger drag, two on-screen thumbsticks). Fingers stay held until ios_release_contacts_hid. Coordinates are iOS screen points. Returns "no HID available" on iOS 17.x / no-tunnel.

  ConnectorOAuth

• ios_fast_screenshotA

  Robot Actions — Remote Device ControlB

  Take a screenshot of an iOS device (no automation session required). Returns PNG image. Alternative to ios_screenshot when the iOS automation session is not running: it needs no session, but captures fresh from the device on every call, so it is slower per shot than ios_mjpeg_screenshot (which is fast only because a session is already streaming frames).

  ConnectorOAuth

• get_anti_patternsA

  GodPrompt MCP ServerA

  Returns references/03-ANTI-PATTERNS.md — red flags, rationalizations, and recovery patterns. Covers the 10 most dangerous anti-patterns that lead to broken code, scope creep, and false confidence. Load when you catch yourself rationalizing. ~9KB.

  ConnectorNo auth

• list_cometchat_bundlesA

  CometChat DocsA

  Lists every available CometChat implementation bundle with its identifier, title, target framework, and last-verified date.

  ConnectorNo auth