frida-mobile-mcp

Mobile Frida MCP Server — AI-powered mobile app exploration and testing via Frida dynamic instrumentation.

Quick Start

npx frida-mobile-mcp

Claude Desktop Configuration

{
  "mcpServers": {
    "frida": {
      "command": "npx",
      "args": ["-y", "frida-mobile-mcp"],
      "env": {
        "FRIDA_DEVICE_ID": "emulator-5554"
      }
    }
  }
}

Features

• 32 MCP Tools — 16 high-level (Tier 1) + 16 advanced (Tier 2)
• 8 Pre-built Scripts — SSL bypass, root/jailbreak bypass, crypto monitor, network inspector, and more
• mobile-mcp Integration — UI automation (screenshots, taps, swipes) via gateway pattern
• AI-Optimized UX — Structured returns with session_context and suggested_next actions
• Android + iOS — Full support for both platforms
• Security Guardrails — Custom scripts disabled by default, memory write protection, audit logging, rate limiting

Prerequisites

• Node.js 18+ (22+ recommended)
• Frida server running on target device
  • Android: adb push frida-server /data/local/tmp/ && adb shell "/data/local/tmp/frida-server &"
  • iOS: Install via Cydia/Sileo on jailbroken device
• mobile-mcp (optional): npm install -g @mobilenext/mobile-mcp

Installation

# Run directly
npx frida-mobile-mcp

# Or install globally
npm install -g frida-mobile-mcp
frida-mobile-mcp

CLI Options

Usage: frida-mobile-mcp [options]

Options:
  --transport <type>       Transport type: stdio (default: "stdio")
  --device <id>            Frida device ID
  --allow-custom-scripts   Allow custom Frida script execution
  --allow-memory-write     Allow memory write operations
  --no-mobile-mcp          Disable mobile-mcp integration
  --debug                  Enable debug logging

Note: HTTP transport (--transport http, --port) is planned but not yet implemented. Use stdio transport (default).

Tool Reference (Tier 1)

| Tool | Description | |------|-------------| | detect_app_technologies | Detect app libraries and recommend scripts | | get_status | Overview of devices, sessions, hooks | | explore_app | Launch app + enumerate classes/modules | | hook_method | One-call method hooking (Java/ObjC/native) | | trace_method | Trace function calls for a duration | | execute_script | Run custom Frida JavaScript | | run_prebuilt_script | Run from built-in script library | | bypass_ssl_pinning | One-click SSL pinning bypass | | search_classes_and_methods | Find classes/methods by pattern | | read_memory | Read process memory | | write_memory | Write process memory (disabled by default) | | scan_memory | Search for byte patterns in memory | | get_messages | Retrieve script/hook output | | stop_instrumentation | Clean up all hooks/scripts | | mobile_action | Gateway to mobile-mcp UI tools | | frida_help | Topic-based help system |

Use frida_help({ topic: "advanced" }) to discover Tier 2 tools.

Pre-built Scripts

| Script | Platforms | Description | |--------|-----------|-------------| | ssl_pinning_bypass | Android, iOS | Bypass SSL certificate pinning | | root_jailbreak_bypass | Android, iOS | Bypass root/jailbreak detection | | class_enumeration | Android, iOS | List loaded classes with filter | | method_hook | Android, iOS | Hook method with arg/retval logging | | crypto_monitor | Android, iOS | Monitor crypto API calls | | network_inspector | Android, iOS | Monitor network socket operations | | keychain_prefs | Android, iOS | Monitor Keychain/SharedPreferences | | filesystem_monitor | Android, iOS | Monitor file I/O operations |

mobile-mcp Integration

When mobile-mcp is installed, use the mobile_action gateway:

mobile_action({ action: "mobile_take_screenshot" })
mobile_action({ action: "mobile_click_on_screen_at_coordinates", params: { x: 100, y: 200 } })
mobile_action({ action: "mobile_list_elements_on_screen" })
mobile_action({ action: "mobile_launch_app", params: { appId: "com.example.app" } })

mobile-mcp is lazily spawned on first use. All Frida tools work without it.

Configuration

Config file: ~/.config/frida-mobile-mcp/config.json

{
  "allowCustomScripts": false,
  "memoryWriteEnabled": false,
  "allowedDevices": [],
  "maxSessions": 4,
  "sessionTimeoutMinutes": 30,
  "mobileMcp": {
    "enabled": true,
    "command": "npx",
    "args": ["-y", "@mobilenext/mobile-mcp@latest"]
  },
  "rateLimits": {
    "scriptsPerMinute": 10,
    "memoryReadsPerMinute": 60,
    "sessionsPerMinute": 5
  }
}

Environment Variables

• FRIDA_DEVICE_ID — Default device ID
• FRIDA_MCP_ALLOW_CUSTOM_SCRIPTS=1 — Enable custom scripts
• FRIDA_MCP_MEMORY_WRITE=1 — Enable memory writes
• FRIDA_MCP_DEBUG=1 — Debug logging

Security

• Custom script execution disabled by default
• Memory writes disabled by default
• Device allowlist support
• Append-only audit log (~/.config/frida-mobile-mcp/audit.jsonl)
• Rate limiting per tool category
• Session timeout with auto-cleanup

License

MIT