1. Conduid
  2. Security
  3. pullkitsan/mobsf-mcp-server
MCP server · Security

pullkitsan/mobsf-mcp-server

by · github.com/pullkitsan/mobsf-mcp-server

This MCP server uses mobsf api's to scan and analyze the apk and ipa files.

Unclaimed MIT security
InstallView source
54Fair

Scored 5 days ago · breakdown

About pullkitsan/mobsf-mcp-server

pullkitsan/mobsf-mcp-server is an MCP server published by pullkitsan in the Security category: this MCP server uses mobsf api's to scan and analyze the apk and ipa files.

The repository has 23 stars and 8 forks, with the last commit a month ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/pullkitsan/mobsf-mcp-server

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about pullkitsan/mobsf-mcp-server

Powered by Claude · Grounded in docs

I know everything about pullkitsan/mobsf-mcp-server. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 4 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

🛡MobSF MCP Tool

This is an MCP (Model Context Protocol) compatible tool that allows MobSF (Mobile Security Framework) to scan APK and IPA files directly via Claude, 5ire, or any MCP-capable client.

Prerequisites

  • MobSF should be installed( and running ) on the system.
  • Download the MCP typescript sdk and rename the folder to sdk.
  • npm should be installed on the system

🚀 Features

  • Supports APK and IPA file scanning

  • Uses MobSF's REST API to:

🎞️ Installation

Clone the repo and install dependencies:

Troubleshooting

Go inside mobsf server directory and run 'npx tsx server.ts'. Install any missing npm dependency if any.

🔐 Setup

Copy the .env.example to .env:

cp .env.example .env

Edit .env to include your MobSF API key:

▶️ Run the Server

  • Add the configuration settings shown at the end for claude AI desktop app, it will automatically run the server.

  • Make sure your MobSF server is running locally at http://localhost:8000.

🧲 Example Input

  • The server exposes tool scanFile . So, use any MCP client to try the following prompt scan .apk or scan .ipa. It will scan the IPA or APK file and will analyze the report(json) for you.

📌 Notes

  • Only .apk and .ipa file types are supported.

  • This tool avoids fetching large fields like raw strings or source code dumps to keep responses fast and compliant with Claude/5ire message limits.

✅ Claude Config file (Example)

✅ 5ire Config file example ( Windows)

README fetched from the repository 4 days ago. The original is authoritative.

Questions

About pullkitsan/mobsf-mcp-server

How do I install pullkitsan/mobsf-mcp-server?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is pullkitsan/mobsf-mcp-server safe to use with an AI agent?

Its trust score is 54 out of 100 (fair). It passes 4 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is pullkitsan/mobsf-mcp-server still maintained?

Yes — the last commit was a month ago. The repository has 23 stars and 8 forks and 2 open issues.