About Mira
Mira is an MCP server published by vw2x in the Science category: mobile runtime detection workbench for AI (iOS and Android).
The repository has 106 stars and 37 forks, with the last commit 5 days ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/vw2x/MiraThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Mira
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository 3 hours ago. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- ✓License declaredUsable under a stated license.
- ✓Tests presentA test suite exists in the repository.
- ✓Dependencies pinnedA lockfile pins dependency versions.
- !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
1 check has not been run yet.
Releases
README
Mira
Mobile runtime detection workbench for iOS and Android.
Why follow Mira
Mira turns real runtime cases into reusable workflows, tools, and detection notes.
Research Updates
- [260520] Article: Detecting root, emulators, and scrcpy-like projection through the audit logcat side channel
- [260520] Case: Android high-PID shell proc audit side-channel hints at scrcpy projection
- [260520] Case: Android emulator proc audit side-channel exposes qemu SELinux context
- [260519] Case: Android proc audit side-channel detects Magisk SELinux context
Features
- App sandbox tools: Use shell, PTY, screen capture, and file tools inside the Mira host app sandbox on Android and iOS.
- Frida tasks: Run Java and native hooks with RPC for one-time runtime analysis.
- Relay and MCP: Connect devices through Relay and let AI work in the same sessions through MCP.
Getting Started
- Relay:
PYTHONPATH=. python3 -m mira.relay.server --host 0.0.0.0 --port 8765 --advertise-url http://<your-lan-ip>:8765 - Browser: Open
http://127.0.0.1:8765on your desktop. - Android: Download the latest APK, install it, then enter
http://<your-lan-ip>:8765in the app. - iOS: Verified on a real device running iOS 16.7.10. See
docs/GETTING-STARTED.md. - AI:
PYTHONPATH=. python3 -m mira.mcp.server --relay http://127.0.0.1:8765. MCP config:docs/MCP.md.
The APK's offline Python/Frida runtime requires arm64-v8a and supports Android 10 through 15. Android 16 Java hooks are not supported, and no confirmed official Frida fix is available. See the compatibility notes.
Architecture
- Android application architecture and Java/C boundaries
- Shared native PTY architecture
- Repository layout
Contributing
Mira welcomes issues and pull requests from mobile security researchers, reverse engineers, Frida users, MCP users, and device testers.
- Read
CONTRIBUTING.mdbefore opening a focused pull request. - Use the issue templates for bugs, security hardening, detection ideas, and device compatibility reports.
- For security reports, read
SECURITY.mdfirst. - Scanner-generated hardening PRs are welcome when they include repository-specific reachability reasoning and verification.
Good starting points include native memory-safety review, Android and iOS device testing, Frida workflow examples, MCP client setup notes, and new reusable detection cases.
Live Discovery Examples
Public Relay Access

With Relay, you can temporarily expose an authorized session beyond the local network for cloud devices, expert review handoff, and fast evidence sharing.
Research Boundaries
- Mira observes and interacts with the Mira host app sandbox.
- Mira does not control unrelated third-party apps.
- Mira does not provide system-wide remote control.
- Mira does not provide root or jailbreak bypass capabilities.
- Mira is not a production SDK or a silent background control channel.
Acknowledgements
- lamda: inspiration for the web workbench interaction model.
- Termux: Android terminal UX and extensible shell ecosystem.
- iSH: iOS-side Linux shell compatibility and syscall translation path.
License
GPL-3.0-only.
README fetched from the repository 3 hours ago. The original is authoritative.