mcpField
🛡
🛡MobSF MCP Tool

🛡MobSF MCP Tool

Local
github.com/pullkitsanSecurity23Updated 7w ago
Repository

About 🛡MobSF MCP Tool

An MCP server that uses the MobSF API to scan and analyze APK and IPA mobile app files. It is aimed at users who want to run mobile security analysis from Claude, 5ire or other MCP clients.

Key features

  1. 01Supports APK and IPA file scanning
  2. 02Uploads files and triggers scans via MobSF REST API
  3. 03Fetches analysis summary
  4. 04Filters large results such as strings and secrets

Use cases

  1. 01Scanning mobile app packages for security issues from an MCP client
  2. 02Retrieving summarized analysis reports for APK or IPA files

MCP support

The project is an MCP server that exposes a scanFile tool, which triggers a MobSF scan and returns the analysis to MCP clients.

#mobsf#mcp#security#apk#ipa

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "mobsf": {
      "command": "npx",
      "args": [
        "-y",
        "tsx"
      ],
      "env": {
        "MOBSF_API_KEY": "<MOBSF_API_KEY>",
        "MOBSF_URL": "<MOBSF_URL>"
      }
    }
  }
}
Run commandnpx -y tsx
Environment variables to set
MOBSF_API_KEYSecret
MOBSF_URL

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmtsx

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

🛡MobSF MCP Tool

This is an MCP (Model Context Protocol) compatible tool that allows MobSF (Mobile Security Framework) to scan APK and IPA files directly via Claude, 5ire, or any MCP-capable client.

Prerequisites

  • MobSF should be installed( and running ) on the system.
  • Download the MCP typescript sdk and rename the folder to sdk.
  • npm should be installed on the system

🚀 Features

  • Supports APK and IPA file scanning

  • Uses MobSF's REST API to:

Upload files

Trigger scans

Fetch analysis summary

Automatically filters large results like strings or secrets (to prevent output overload)

MCP-compatible interface via server.ts

🎞️ Installation

Clone the repo and install dependencies:

git clone https://github.com/pullkitsan/mobsf-mcp-server.git
cd mobsf-mcp-server
npm install

Troubleshooting

Go inside mobsf server directory and run 'npx tsx server.ts'. Install any missing npm dependency if any.

🔐 Setup

Copy the .env.example to .env:

cp .env.example .env

Edit .env to include your MobSF API key:

MOBSF_API_KEY=YOUR_MOBSF_API_KEY

MOBSF_URL=http://localhost:8000

▶️ Run the Server

  • Add the configuration settings shown at the end for claude AI desktop app, it will automatically run the server.

  • Make sure your MobSF server is running locally at http://localhost:8000.

🧲 Example Input

  • The server exposes tool scanFile . So, use any MCP client to try the following prompt scan .apk or scan .ipa. It will scan the IPA or APK file and will analyze the report(json) for you.

📌 Notes

  • Only .apk and .ipa file types are supported.

  • This tool avoids fetching large fields like raw strings or source code dumps to keep responses fast and compliant with Claude/5ire message limits.

✅ Claude Config file (Example)

 {
  "mcpServers": {
    "mobsf": {
      "command": "npx",
      "args": ["tsx", "/absolute/path/to/server.ts"]
    }
  }
}

✅ 5ire Config file example ( Windows)

  {
  "key": "mobsf",
  "command": "npx",
  "args": [
    "tsx",
    "C:\\Users\\Downloads\\mobsf-mcp-server\\server.js"
  ]
}

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.