REA
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
Mobile Frida MCP Server - AI-powered mobile app exploration and testing via Frida instrumentation
Elige la app de IA que usas y copia la configuración.
Pasó 3/3 revisiones · Funciona en tu computadora · ✓ Comandos revisados el 14 nov 2026
Primero: ¿qué IA usas?
Elige tu app y los pasos aparecen abajo.
Funciona con Claude, pero hay que preparar algo antes
Necesitas una clave de Frida Mobile MCP (créala en el sitio del autor) · Instala Node.js en tu computadora primero (una sola vez) · Solo en la app de Claude para computadora (Windows o Mac), no en la web ni en el móvil
Una sola vez; sirve para todos los servidores que necesitan Node.js
Abre el sitio del autor, crea una cuenta y una clave de API para el siguiente paso. Consulta precios y planes gratis en su sitio.
SettingsDeveloperEdit Config
{
"mcpServers": {
"frida-mobile": {
"command": "npx",
"args": [
"-y",
"frida-mobile-mcp"
],
"env": {
"FRIDA_MCP_REMOTE_TOKEN": "your-value",
"FRIDA_MCP_HTTP_TOKEN": "your-value"
}
}
}
}Pega la clave solo en el campo de la app; nunca en un chat ni se la envíes a nadie
Usa Frida Mobile MCP y dime qué puedes hacer por mí; luego muéstrame una cosa✓ Si Claude dice que está usando Frida Mobile MCP o muestra una herramienta de Frida Mobile MCP en la respuesta, ya está conectado
El comando de arriba funciona sin estos valores. Añádelos solo si quieres cambiar algo, según la descripción del autor.
FRIDA_DEVICE_ID Default Frida device ID to use (e.g. emulator-5554 or a USB serial). Can also be set with --device.FRIDA_MCP_ALLOW_CUSTOM_SCRIPTS Set to "1" to enable execution of custom Frida scripts (execute_script and custom hook_function handlers). Disabled by default. · valor por defecto 0FRIDA_MCP_MEMORY_WRITE Set to "1" to enable the write_memory tool. Disabled by default for safety. · valor por defecto 0FRIDA_MCP_ALLOW_NATIVE_INJECTION Set to "1" to enable the inject_library tool (loads a native .so/.dylib into the target via Frida's injector). Disabled by default. · valor por defecto 0FRIDA_MCP_ALLOW_ADB_SHELL Set to "1" to enable the adb_shell tool (arbitrary shell commands on an Android device via adb). Disabled by default. · valor por defecto 0FRIDA_MCP_SNAPSHOTS Set to "1" to use V8 script-runtime snapshots to speed up repeated script loads (requires FRIDA_MCP_RUNTIME=v8). Disabled by default. · valor por defecto 0FRIDA_MCP_EVIDENCE Set to "0" to stop persisting every tool result (params, status, structured result) to the evidence store; "1" forces it on. Enabled by default. · valor por defecto 1FRIDA_MCP_EVIDENCE_PATH Directory of the evidence store (records at /YYYY-MM-DD/ .json plus index.jsonl, mode 0600). Defaults to ~/.config/frida-mobile-mcp/evidence.FRIDA_MCP_EVIDENCE_MAX_MB Size cap of the evidence store in MB; oldest records are pruned beyond it. Defaults to 200. · valor por defecto 200FRIDA_MCP_REMOTE host[:port] of a remote frida-server to add as a remote device at startup (port defaults to 27042).FRIDA_MCP_REMOTE_CERT Path to the PEM certificate of a TLS remote frida-server in FRIDA_MCP_REMOTE (frida-server --certificate).FRIDA_MCP_SCHEMA_PROFILE Tool schema profile. "compact" shortens tool schemas and descriptions for clients with small context windows. · valor por defecto fullFRIDA_MCP_TOOL_PROFILE Tool exposure profile. "core" registers only 32 core tools to keep the tool catalog small next to other MCP servers. · valor por defecto fullFRIDA_MCP_TOOLS_EXCLUDE Comma-separated tool-name globs that are never registered, e.g. "adb_*,frida_server_*".FRIDA_MCP_MAX_RESPONSE_CHARS Maximum number of characters in a single tool response; longer output is truncated. · valor por defecto 25000FRIDA_MCP_RUNTIME Frida script runtime to use for injected agents.FRIDA_MCP_DEBUG Set to "1" to enable debug logging on stderr. Can also be set with --debug. · valor por defecto 0FRIDA_MCP_BRIDGES_DIR Directory with prebuilt Java/ObjC bridge bundles (defaults to dist/bridges inside the package)FRIDA_MCP_COMPILER_PROJECT_DIR Cache directory for the frida.Compiler project used to compile ES module scriptsFRITAP_AGENT_PATH Path to a friTap fritap_agent.js bundle for capture_tls (otherwise the installed friTap Python package or a pinned download is used)FRITAP_VERSION friTap release tag to download when no local agent is found (default v2.6.5)FRITAP_AGENT_SHA256 Bare sha256 of the downloaded friTap agent for the selected FRITAP_VERSION tag. v2.6.5 is pinned in the package; set this for other tags.Las descripciones siguen en el inglés original.
Nombres de menú comprobados con la ayuda de Anthropic el 11 nov 2026 · tu pantalla puede variar un poco según la versión
ChatGPT todavía no puede conectar Frida Mobile MCP
Frida Mobile MCP se instala en tu computadora, pero ChatGPT solo conecta servidores que funcionan en la web
A · Usa una app que pueda conectar Frida Mobile MCP
B · Otros en Herramientas para desarrolladores que funcionan con ChatGPT
Elegidos entre los más usados de la misma categoría, solo los que se conectan con una dirección y sin clave
Funciona con Claude Code, pero hay que preparar algo antes
Necesitas una clave de Frida Mobile MCP (créala en el sitio del autor) · Instala Node.js en tu computadora primero (una sola vez)
Una sola vez; sirve para todos los servidores que necesitan Node.js
Abre el sitio del autor, crea una cuenta y una clave de API para el siguiente paso. Consulta precios y planes gratis en su sitio.
Mac: pulsa Command+Espacio y escribe Terminal · Windows: abre PowerShell
claude mcp add --scope user frida-mobile --env FRIDA_MCP_REMOTE_TOKEN=your-value --env FRIDA_MCP_HTTP_TOKEN=your-value -- npx -y frida-mobile-mcpCambia “your-value” por tu clave antes de pulsar Enter
Pega la clave solo en el campo de la app; nunca en un chat ni se la envíes a nadie
Deberías ver Frida Mobile MCP en la lista como conectado
Usa Frida Mobile MCP y dime qué puedes hacer por mí; luego muéstrame una cosa✓ Si Claude Code dice que está usando Frida Mobile MCP o muestra una herramienta de Frida Mobile MCP en la respuesta, ya está conectado
El comando de arriba funciona sin estos valores. Añádelos solo si quieres cambiar algo, según la descripción del autor.
FRIDA_DEVICE_ID Default Frida device ID to use (e.g. emulator-5554 or a USB serial). Can also be set with --device.FRIDA_MCP_ALLOW_CUSTOM_SCRIPTS Set to "1" to enable execution of custom Frida scripts (execute_script and custom hook_function handlers). Disabled by default. · valor por defecto 0FRIDA_MCP_MEMORY_WRITE Set to "1" to enable the write_memory tool. Disabled by default for safety. · valor por defecto 0FRIDA_MCP_ALLOW_NATIVE_INJECTION Set to "1" to enable the inject_library tool (loads a native .so/.dylib into the target via Frida's injector). Disabled by default. · valor por defecto 0FRIDA_MCP_ALLOW_ADB_SHELL Set to "1" to enable the adb_shell tool (arbitrary shell commands on an Android device via adb). Disabled by default. · valor por defecto 0FRIDA_MCP_SNAPSHOTS Set to "1" to use V8 script-runtime snapshots to speed up repeated script loads (requires FRIDA_MCP_RUNTIME=v8). Disabled by default. · valor por defecto 0FRIDA_MCP_EVIDENCE Set to "0" to stop persisting every tool result (params, status, structured result) to the evidence store; "1" forces it on. Enabled by default. · valor por defecto 1FRIDA_MCP_EVIDENCE_PATH Directory of the evidence store (records at /YYYY-MM-DD/ .json plus index.jsonl, mode 0600). Defaults to ~/.config/frida-mobile-mcp/evidence.FRIDA_MCP_EVIDENCE_MAX_MB Size cap of the evidence store in MB; oldest records are pruned beyond it. Defaults to 200. · valor por defecto 200FRIDA_MCP_REMOTE host[:port] of a remote frida-server to add as a remote device at startup (port defaults to 27042).FRIDA_MCP_REMOTE_CERT Path to the PEM certificate of a TLS remote frida-server in FRIDA_MCP_REMOTE (frida-server --certificate).FRIDA_MCP_SCHEMA_PROFILE Tool schema profile. "compact" shortens tool schemas and descriptions for clients with small context windows. · valor por defecto fullFRIDA_MCP_TOOL_PROFILE Tool exposure profile. "core" registers only 32 core tools to keep the tool catalog small next to other MCP servers. · valor por defecto fullFRIDA_MCP_TOOLS_EXCLUDE Comma-separated tool-name globs that are never registered, e.g. "adb_*,frida_server_*".FRIDA_MCP_MAX_RESPONSE_CHARS Maximum number of characters in a single tool response; longer output is truncated. · valor por defecto 25000FRIDA_MCP_RUNTIME Frida script runtime to use for injected agents.FRIDA_MCP_DEBUG Set to "1" to enable debug logging on stderr. Can also be set with --debug. · valor por defecto 0FRIDA_MCP_BRIDGES_DIR Directory with prebuilt Java/ObjC bridge bundles (defaults to dist/bridges inside the package)FRIDA_MCP_COMPILER_PROJECT_DIR Cache directory for the frida.Compiler project used to compile ES module scriptsFRITAP_AGENT_PATH Path to a friTap fritap_agent.js bundle for capture_tls (otherwise the installed friTap Python package or a pinned download is used)FRITAP_VERSION friTap release tag to download when no local agent is found (default v2.6.5)FRITAP_AGENT_SHA256 Bare sha256 of the downloaded friTap agent for the selected FRITAP_VERSION tag. v2.6.5 is pinned in the package; set this for other tags.Las descripciones siguen en el inglés original.
Nombres de menú comprobados con la ayuda de Anthropic el 11 nov 2026 · tu pantalla puede variar un poco según la versión
Funciona con Cursor, pero hay que preparar algo antes
Necesitas una clave de Frida Mobile MCP (créala en el sitio del autor) · Instala Node.js en tu computadora primero (una sola vez)
Una sola vez; sirve para todos los servidores que necesitan Node.js
Abre el sitio del autor, crea una cuenta y una clave de API para el siguiente paso. Consulta precios y planes gratis en su sitio.
En la configuración de Frida Mobile MCP, FRIDA_MCP_REMOTE_TOKEN, FRIDA_MCP_HTTP_TOKEN está vacío; añade tu clave y guarda
Pega la clave solo en el campo de la app; nunca en un chat ni se la envíes a nadie
Usa Frida Mobile MCP y dime qué puedes hacer por mí; luego muéstrame una cosa✓ Si Cursor dice que está usando Frida Mobile MCP o muestra una herramienta de Frida Mobile MCP en la respuesta, ya está conectado
El comando de arriba funciona sin estos valores. Añádelos solo si quieres cambiar algo, según la descripción del autor.
FRIDA_DEVICE_ID Default Frida device ID to use (e.g. emulator-5554 or a USB serial). Can also be set with --device.FRIDA_MCP_ALLOW_CUSTOM_SCRIPTS Set to "1" to enable execution of custom Frida scripts (execute_script and custom hook_function handlers). Disabled by default. · valor por defecto 0FRIDA_MCP_MEMORY_WRITE Set to "1" to enable the write_memory tool. Disabled by default for safety. · valor por defecto 0FRIDA_MCP_ALLOW_NATIVE_INJECTION Set to "1" to enable the inject_library tool (loads a native .so/.dylib into the target via Frida's injector). Disabled by default. · valor por defecto 0FRIDA_MCP_ALLOW_ADB_SHELL Set to "1" to enable the adb_shell tool (arbitrary shell commands on an Android device via adb). Disabled by default. · valor por defecto 0FRIDA_MCP_SNAPSHOTS Set to "1" to use V8 script-runtime snapshots to speed up repeated script loads (requires FRIDA_MCP_RUNTIME=v8). Disabled by default. · valor por defecto 0FRIDA_MCP_EVIDENCE Set to "0" to stop persisting every tool result (params, status, structured result) to the evidence store; "1" forces it on. Enabled by default. · valor por defecto 1FRIDA_MCP_EVIDENCE_PATH Directory of the evidence store (records at /YYYY-MM-DD/ .json plus index.jsonl, mode 0600). Defaults to ~/.config/frida-mobile-mcp/evidence.FRIDA_MCP_EVIDENCE_MAX_MB Size cap of the evidence store in MB; oldest records are pruned beyond it. Defaults to 200. · valor por defecto 200FRIDA_MCP_REMOTE host[:port] of a remote frida-server to add as a remote device at startup (port defaults to 27042).FRIDA_MCP_REMOTE_CERT Path to the PEM certificate of a TLS remote frida-server in FRIDA_MCP_REMOTE (frida-server --certificate).FRIDA_MCP_SCHEMA_PROFILE Tool schema profile. "compact" shortens tool schemas and descriptions for clients with small context windows. · valor por defecto fullFRIDA_MCP_TOOL_PROFILE Tool exposure profile. "core" registers only 32 core tools to keep the tool catalog small next to other MCP servers. · valor por defecto fullFRIDA_MCP_TOOLS_EXCLUDE Comma-separated tool-name globs that are never registered, e.g. "adb_*,frida_server_*".FRIDA_MCP_MAX_RESPONSE_CHARS Maximum number of characters in a single tool response; longer output is truncated. · valor por defecto 25000FRIDA_MCP_RUNTIME Frida script runtime to use for injected agents.FRIDA_MCP_DEBUG Set to "1" to enable debug logging on stderr. Can also be set with --debug. · valor por defecto 0FRIDA_MCP_BRIDGES_DIR Directory with prebuilt Java/ObjC bridge bundles (defaults to dist/bridges inside the package)FRIDA_MCP_COMPILER_PROJECT_DIR Cache directory for the frida.Compiler project used to compile ES module scriptsFRITAP_AGENT_PATH Path to a friTap fritap_agent.js bundle for capture_tls (otherwise the installed friTap Python package or a pinned download is used)FRITAP_VERSION friTap release tag to download when no local agent is found (default v2.6.5)FRITAP_AGENT_SHA256 Bare sha256 of the downloaded friTap agent for the selected FRITAP_VERSION tag. v2.6.5 is pinned in the package; set this for other tags.Las descripciones siguen en el inglés original.
Nombres de menú comprobados con la ayuda de Cursor el 11 nov 2026 · tu pantalla puede variar un poco según la versión
Funciona con VS Code, pero hay que preparar algo antes
Necesitas una clave de Frida Mobile MCP (créala en el sitio del autor) · Instala Node.js en tu computadora primero (una sola vez)
Una sola vez; sirve para todos los servidores que necesitan Node.js
Abre el sitio del autor, crea una cuenta y una clave de API para el siguiente paso. Consulta precios y planes gratis en su sitio.
En la configuración de Frida Mobile MCP, FRIDA_MCP_REMOTE_TOKEN, FRIDA_MCP_HTTP_TOKEN está vacío; añade tu clave y guarda
Pega la clave solo en el campo de la app; nunca en un chat ni se la envíes a nadie
Usa Frida Mobile MCP y dime qué puedes hacer por mí; luego muéstrame una cosa✓ Si VS Code dice que está usando Frida Mobile MCP o muestra una herramienta de Frida Mobile MCP en la respuesta, ya está conectado
El comando de arriba funciona sin estos valores. Añádelos solo si quieres cambiar algo, según la descripción del autor.
FRIDA_DEVICE_ID Default Frida device ID to use (e.g. emulator-5554 or a USB serial). Can also be set with --device.FRIDA_MCP_ALLOW_CUSTOM_SCRIPTS Set to "1" to enable execution of custom Frida scripts (execute_script and custom hook_function handlers). Disabled by default. · valor por defecto 0FRIDA_MCP_MEMORY_WRITE Set to "1" to enable the write_memory tool. Disabled by default for safety. · valor por defecto 0FRIDA_MCP_ALLOW_NATIVE_INJECTION Set to "1" to enable the inject_library tool (loads a native .so/.dylib into the target via Frida's injector). Disabled by default. · valor por defecto 0FRIDA_MCP_ALLOW_ADB_SHELL Set to "1" to enable the adb_shell tool (arbitrary shell commands on an Android device via adb). Disabled by default. · valor por defecto 0FRIDA_MCP_SNAPSHOTS Set to "1" to use V8 script-runtime snapshots to speed up repeated script loads (requires FRIDA_MCP_RUNTIME=v8). Disabled by default. · valor por defecto 0FRIDA_MCP_EVIDENCE Set to "0" to stop persisting every tool result (params, status, structured result) to the evidence store; "1" forces it on. Enabled by default. · valor por defecto 1FRIDA_MCP_EVIDENCE_PATH Directory of the evidence store (records at /YYYY-MM-DD/ .json plus index.jsonl, mode 0600). Defaults to ~/.config/frida-mobile-mcp/evidence.FRIDA_MCP_EVIDENCE_MAX_MB Size cap of the evidence store in MB; oldest records are pruned beyond it. Defaults to 200. · valor por defecto 200FRIDA_MCP_REMOTE host[:port] of a remote frida-server to add as a remote device at startup (port defaults to 27042).FRIDA_MCP_REMOTE_CERT Path to the PEM certificate of a TLS remote frida-server in FRIDA_MCP_REMOTE (frida-server --certificate).FRIDA_MCP_SCHEMA_PROFILE Tool schema profile. "compact" shortens tool schemas and descriptions for clients with small context windows. · valor por defecto fullFRIDA_MCP_TOOL_PROFILE Tool exposure profile. "core" registers only 32 core tools to keep the tool catalog small next to other MCP servers. · valor por defecto fullFRIDA_MCP_TOOLS_EXCLUDE Comma-separated tool-name globs that are never registered, e.g. "adb_*,frida_server_*".FRIDA_MCP_MAX_RESPONSE_CHARS Maximum number of characters in a single tool response; longer output is truncated. · valor por defecto 25000FRIDA_MCP_RUNTIME Frida script runtime to use for injected agents.FRIDA_MCP_DEBUG Set to "1" to enable debug logging on stderr. Can also be set with --debug. · valor por defecto 0FRIDA_MCP_BRIDGES_DIR Directory with prebuilt Java/ObjC bridge bundles (defaults to dist/bridges inside the package)FRIDA_MCP_COMPILER_PROJECT_DIR Cache directory for the frida.Compiler project used to compile ES module scriptsFRITAP_AGENT_PATH Path to a friTap fritap_agent.js bundle for capture_tls (otherwise the installed friTap Python package or a pinned download is used)FRITAP_VERSION friTap release tag to download when no local agent is found (default v2.6.5)FRITAP_AGENT_SHA256 Bare sha256 of the downloaded friTap agent for the selected FRITAP_VERSION tag. v2.6.5 is pinned in the package; set this for other tags.Las descripciones siguen en el inglés original.
Nombres de menú comprobados con la ayuda de VS Code el 11 nov 2026 · tu pantalla puede variar un poco según la versión
Otras apps que usan MCP, como Windsurf, Zed o Gemini CLI, añaden servidores de forma distinta. Míralo en la lista de apps
Ver todas las apps que usan MCP →
La configuración JSON está en “Para desarrolladores”, abajo
Claude Code
claude mcp add --scope user frida-mobile --env FRIDA_MCP_REMOTE_TOKEN=your-value --env FRIDA_MCP_HTTP_TOKEN=your-value -- npx -y frida-mobile-mcpClaude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"frida-mobile": {
"command": "npx",
"args": [
"-y",
"frida-mobile-mcp"
],
"env": {
"FRIDA_MCP_REMOTE_TOKEN": "your-value",
"FRIDA_MCP_HTTP_TOKEN": "your-value"
}
}
}
}Cursor (~/.cursor/mcp.json)
{
"mcpServers": {
"frida-mobile": {
"command": "npx",
"args": [
"-y",
"frida-mobile-mcp"
],
"env": {
"FRIDA_MCP_REMOTE_TOKEN": "your-value",
"FRIDA_MCP_HTTP_TOKEN": "your-value"
}
}
}
}VS Code (mcp.json)
{
"servers": {
"frida-mobile": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"frida-mobile-mcp"
],
"env": {
"FRIDA_MCP_REMOTE_TOKEN": "your-value",
"FRIDA_MCP_HTTP_TOKEN": "your-value"
}
}
}
}FRIDA_DEVICE_ID envFRIDA_MCP_ALLOW_CUSTOM_SCRIPTS envFRIDA_MCP_MEMORY_WRITE envFRIDA_MCP_ALLOW_NATIVE_INJECTION envFRIDA_MCP_ALLOW_ADB_SHELL envFRIDA_MCP_SNAPSHOTS envFRIDA_MCP_EVIDENCE envFRIDA_MCP_EVIDENCE_PATH envFRIDA_MCP_EVIDENCE_MAX_MB envFRIDA_MCP_REMOTE envFRIDA_MCP_REMOTE_TOKEN secreto obligatorio envFRIDA_MCP_REMOTE_CERT envFRIDA_MCP_SCHEMA_PROFILE envFRIDA_MCP_TOOL_PROFILE envFRIDA_MCP_TOOLS_EXCLUDE envFRIDA_MCP_MAX_RESPONSE_CHARS envFRIDA_MCP_HTTP_TOKEN secreto obligatorio envFRIDA_MCP_RUNTIME envFRIDA_MCP_DEBUG envFRIDA_MCP_BRIDGES_DIR envFRIDA_MCP_COMPILER_PROJECT_DIR envFRITAP_AGENT_PATH envFRITAP_VERSION envFRITAP_AGENT_SHA256 envLas descripciones siguen en el inglés original.
Esta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.
npm: frida-mobile-mcpSegún cómo se conecta este servidor y la documentación de cada app, comprobado el 10 nov 2026.
Se ejecutan en tu computadora en
ClaudeGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatRaycast
Se ejecuta en tu computadora; la lista de herramientas aparece en tu app de IA después de instalarlo.
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 14 nov 2026
El nombre en el registro se verificó con la cuenta de GitHub monkeywave, dueña del repo
Último cambio de código: anteayer
Usa MIT
Este se ejecuta en tu computadora; no hay endpoint en internet
Se ejecuta en tu computadora y usa ajustes locales en su lugar
Se ejecuta en tu computadora; solo podemos leer listas de herramientas de endpoints en internet
Pregunta, comparte un consejo o avisa de que no funciona. Ordenado por lo que la gente marcó como útil.
Aún no hay publicaciones. Sé la primera persona en preguntar o compartir.
Lo publicado aquí lo escriben usuarios, no el equipo de PopNx.
Aún no hay reseñas
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Superó 3 de 3 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
Debes completar: FRIDA_MCP_REMOTE_TOKEN, FRIDA_MCP_HTTP_TOKEN
Se ejecuta en tu computadora. Tu app de IA lo inicia cuando hace falta, y los datos no pasan por los servidores del creador (a menos que el propio servidor llame a un servicio en línea).
El repo de GitHub cambió por última vez anteayer, y la última versión (0.7.3) llegó al registro anteayer.
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code. También necesitas Node.js en tu computadora.
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:↓ Descargas por semanai★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
A powerful toolkit for coding, providing semantic retrieval and editing capabilities.
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
An MCP server that gives AI agents dynamic instrumentation of Android and iOS apps through Frida 17, and runs next to REA, ReVa (Ghidra) and IDA MCP servers. It exposes 71 tools: high-level ones that manage devices, sessions and scripts for you (explore an app, hook a Java/ObjC/native method, trace calls, map reachability coverage and autonomously drive the UI toward it, find secrets in memory and turn them into reusable friTap patterns, cast a wide net over crypto, bypass SSL pinning, capture TLS keys and plaintext with friTap, run prebuilt analysis scripts, validate custom scripts) and low-level primitives (spawn/attach, module and symbol enumeration, address resolution, control-flow analysis, memory dumps). Addresses use the same module+0xoffset notation as Ghidra/IDA so results move between static and dynamic tools without conversion, and every result carries an evidence envelope (evidence_id, limitations, coverage). Optional UI automation goes through mobile-mcp.
npx frida-mobile-mcp # stdio MCP server (default `serve` command)
frida-mobile-mcp doctor # check Node, frida-node, adb, devices, frida-server, bridge bundles frida-mobile-mcp setup --client cursor # write the server into a client config (claude-code, claude-desktop, cursor, vscode, windsurf, codex) frida-mobile-mcp gadget --platform android --print # generate a frida-gadget config.json + APK/IPA repackaging guidance
The gadget command generates a frida-gadget config.json (--interaction listen or --interaction script) and prints the APK/IPA repackaging steps. Embedding the gadget is the only way to instrument native detection that runs in .init_array / JNI_OnLoad before an attach-time script can load, and it removes the frida-server :27042 port as a fingerprint — see frida_help({ topic: "evasion" }).
Claude Code:
claude mcp add frida -- npx -y frida-mobile-mcp
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": { "frida": { "command": "npx", "args": ["-y", "frida-mobile-mcp"], "env": { "FRIDA_DEVICE_ID": "emulator-5554" } } } }
Per-client instructions, HTTP mode and remote frida-server setup are in docs/clients.md. A Claude Desktop extension manifest (manifest.json, MCPB) and an MCP registry entry (server.json) ship in the repo.
npm install runs the frida package's install script, which downloads the native frida-node prebuild.^17.24.3; frida-server on the device must have the same major version (17) and ideally the same minor version. frida-mobile-mcp doctor prints both versions and flags mismatches.frida-server-17.x.y-android- .xz from https://github.com/frida/frida/releases, then xz -d frida-server-17.24.3-android-arm64.xz
adb push frida-server-17.24.3-android-arm64 /data/local/tmp/frida-server adb shell "chmod 755 /data/local/tmp/frida-server" adb shell "su -c '/data/local/tmp/frida-server &'"
pip install friTap for capture_tls (otherwise the pinned agent is downloaded on first use), and network access for npx -y @mobilenext/mobile-mcp@latest on first mobile_action.npm run build:bridges bundles frida-java-bridge and frida-objc-bridge into dist/bridges/{java,objc}.js; the server injects the right one by platform (Java on Android, ObjC on iOS/macOS) ahead of every script.execute_script runs classic (non-module) scripts through Script.evaluate, so a Java.perform(...) script written for Frida 16 runs unchanged and keeps its own line numbers in errors. ES modules (import Java from "frida-java-bridge", JS or TS) are compiled on the host with the Frida Compiler; frida-compile bundles (starting with the 📦 marker) are loaded as-is.validate_script flags the static Module.findExportByName/findBaseAddress/enumerateExports, Memory.readX/writeX and *Sync enumerators that throw on Frida 17 and suggests the Module-instance / NativePointer replacements. Generated scripts get findExport(lib, name) and hookNative(lib, name, callbacks) helpers from the agent preamble, and template options as __FRIDA_MCP__.options.analyze_native_function uses Process.findFunctionRange and the Frida 17.12+ ControlFlowGraph (with a linear-disassembly fallback reported in limitations).| Tool | Description |
|---|---|
get_status | Connected devices, active sessions (platform, script count, last activity), hooks, traces and recent detaches/crashes. Run first and after a session is lost. |
frida_help | Topic help: overview, hooking, tracing, memory, scripts, native, tls, mobile, examples, advanced, evasion, script_catalog, script_api, recipes, interop. |
detect_app_technologies | Fingerprint libraries, frameworks and security mechanisms; returns recommended script targets. |
explore_app | Spawn an app suspended, instrument, resume; returns pid, platform, modules and a filtered class list. |
get_app_info | Identify the installed artifact: version, SDK levels, debuggable, installer and every APK (base + splits) with on-device sha256/size; pull_to pulls and hash-verifies them for a static tool such as REA inspect_android_package. iOS: Frida app parameters only. |
search_classes_and_methods | Regex search over classes (and methods with include_methods) in a running app. |
describe_class | Full shape of one loaded class: every method overload with parameter/return types and a hook-ready signature, constructors, fields, superclass/interfaces (ObjC: selectors with type encodings). Feed a signature to hook_method evidence: {class, signature}. |
discover_crypto | Find where an app does crypto (or any API family) without assuming javax.crypto: ranked candidate hook targets across Java/ObjC classes and native symbols. |
find_secrets_in_memory | Content-aware memory scan for the *structure* of secrets: RC4 S-box (byte[] or Java int[256]), AES key schedule (aeskeyfind — encryption and decryption, mode-independent), ChaCha20/Salsa20 keys (sigma constant), high-entropy 16/24/32-byte keys, PEM/DER private keys, JWTs. Finds keys without reaching the code that uses them. |
generate_memory_pattern | Turn a located secret into a reusable anchor pattern (stable byte signature near the key + offset): re-locate it with scan_memory, or hand it to friTap via capture_tls (patterns/offsets). |
monitor_crypto | Crypto-oracle wide net: discover and hook all likely crypto sinks at once (app-owned classes + javax.crypto/Mac/MessageDigest, iOS CommonCrypto, native OpenSSL/BoringSSL) and dump every key, input and output as hex. |
trace_coverage | Reachability map: arm cheap persistent entry-hooks over a class/package/module scope and track covered vs cold targets across trigger_and_wait drives, so you know what code you have not yet exercised. |
drive_coverage | Autonomously drive an instrumented session's UI toward uncovered code — taps on-screen elements breadth-first and stops the instant a crypto/secret signal fires (or coverage stalls / max_steps). Pair with monitor_crypto / trace_coverage. |
watch_loads | Watch for late-loaded .so libraries and Java classes, plus anti-Frida probes; emits watch_event messages as the app runs. |
trigger_and_wait | Perform a UI action and block until the resulting hook/message output arrives, so you learn which hook a tap fired (or that none did). |
hook_method | Hook Java (com.example.Class.method), ObjC (-[Class sel:]) or native targets (libssl.so!SSL_read, libfoo.so+0x1234, 0x7f..., !open) with auto session management; backtraces as module+0xoff (symbol). |
trace_method | frida-trace style tracing of glob patterns (com.example.net.*, -[NSURL*], libssl.so!SSL_*) for a duration. |
execute_script | Run a custom script: classic JS (bridges injected), ES module JS/TS (compiled with the Frida Compiler) or a frida-compile bundle. timeout_ms bounds the initial run. Requires allowCustomScripts. |
validate_script | Syntax, type and Frida 17 removed-API check without a device. Use before execute_script. |
run_prebuilt_script | Run one of the 9 prebuilt scripts below; call without script_name to list them. |
bypass_ssl_pinning | One-click pinning bypass (Android: TrustManager, OkHttp CertificatePinner, Conscrypt; iOS: SecTrust, ATS, BoringSSL). |
capture_tls | friTap: TLS session keys (NSS key log) and optional decrypted plaintext / synthetic pcap for OpenSSL/BoringSSL, Conscrypt, NSS, GnuTLS, wolfSSL, mbedTLS, Secure Transport and more. Accepts friTap patterns/offsets (e.g. from generate_memory_pattern or BoringSecretHunter) for stripped libraries. |
read_memory | Read up to 4 MB at any address notation; returns hex plus absolute address and module+offset. |
write_memory | Write hex bytes to memory. Disabled unless memoryWriteEnabled. |
scan_memory | Byte-pattern scan (48 89 5c 24 ?? 57), optionally limited to a module. |
get_messages | Buffered hook invocations, trace hits, send() output and errors; since paginates. |
get_evidence | Re-read a persisted tool result (params, status, structured result) by evidence_id. |
export_evidence_bundle | Export persisted results as a JSON or Markdown bundle, inline or to a file. |
stop_instrumentation | Remove all hooks, scripts and traces on a target and detach. |
unload_script | Unload a single script (hook, trace or custom) from a session while keeping it attached. |
mobile_action | Gateway to mobile-mcp UI automation (screenshot, elements, tap, swipe, type, launch app, list apps). |
search_recipes | Search the purpose-indexed library of ready-to-run classic-JS recipes (custom crypto-key capture, native/JNI hooks, classloader/intent/WebView, iOS Keychain); returns ranked recipes with source to adapt and run via execute_script. |
save_script | Save a script under ~/.config/frida-mobile-mcp/scripts for reuse. Requires allowCustomScripts. |
list_saved_scripts | List scripts saved with save_script. |
run_saved_script | Run a saved script by name against a target. Requires allowCustomScripts. |
export_script | Export a script as a standalone classic .js that runs under the plain frida -U -f -l file.js CLI (preamble + source; bridges provided by the frida-tools CLI, not bundled). |
| Tool | Description |
|---|
| list_devices | Local, U