Mobile Security MCP

Features · Installation · Tools · Usage · Contributing · Security

______________________________________________________________________

移动安全mcp 是一个 MCP（模型上下文协议） 服务器，使Claude和任何兼容MCP的AI客户端能够通过自然语言对话分析Android APK和iOS IPA文件的安全问题。

安全研究人员、移动前端和应用程序开发人员现在只需询问Claude就可以审核权限、提取API端点、检测硬编码机密、检查Firebase配置并枚举第三方SDK，无需编写脚本。

______________________________________________________________________

特性

安卓

iOS

共享模式注册表

所有秘密和谷歌服务检测模式都存在于一个单一的 patterns.ts --易于扩展，适用于Android和iOS扫描仪。

______________________________________________________________________

安装

npm install -g mobile-security-mcp

配置Claude桌面

添加到您的 claude_desktop_config.json:

{
  "mcpServers": {
    "mobile-security-mcp": {
      "command": "npx",
      "args": ["mobile-security-mcp"]
    }
  }
}

配置文件位置：

• macOS： ~/Library/Application Support/Claude/claude_desktop_config.json
• 窗户： %APPDATA%\Claude\claude_desktop_config.json

从源代码运行

git clone https://github.com/Serhatcck/mobile-security-mcp.git
cd mobile-security-mcp
npm install && npm run build

{
  "mcpServers": {
    "mobile-security-mcp": {
      "command": "node",
      "args": ["/absolute/path/to/mobile-security-mcp/dist/index.js"]
    }
  }
}

______________________________________________________________________

用法

配置后，重新启动Claude Desktop并开始对话：

*“分析/path/to/app.apk中的权限”*

*“检查此IPA中的硬编码API密钥：/path/to/app.IPA”*

*“此APK使用哪些Firebase服务？”*

*“此APK中是否有任何导出的组件可能是攻击面？”*

*“显示此iOS应用程序中的所有第三方SDK，并标记任何隐私风险”*

先决条件

安卓：

• apktool --需要 android_api_extractor (brew install apktool)
• aapt （可选）--加速清单解析，这是Android SDK构建工具的一部分

iOS（仅限macOS）：

• codesign, plutil, strings --全部内置于macOS中，无需安装

______________________________________________________________________

工具

apk_manifest_analyzer

Input:  apk_path (string)
Output: Package info, security flags, components, intent filters, warnings

apk_permissions_checker

Input:  apk_path (string)
Output: Dangerous permissions (highlighted) + normal permissions + risk summary

android_api_extractor

Input:  apk_path OR smali_folder (string), output_format (txt|postman)
Output: Retrofit HTTP endpoints or Postman collection JSON

android_google_services

Input:  apk_path (string), smali_folder (optional)
Output: Firebase project ID, API keys, database URL, storage bucket, OAuth clients

android_secrets_scanner

Input:  apk_path (string), smali_folder (optional), min_length (default 8)
Output: Hardcoded credentials found in DEX + resources.arsc + assets

ios_manifest_analyzer

Input:  ipa_path (string)
Output: Bundle info, ATS settings, URL schemes, background modes, warnings

ios_permissions_checker

Input:  ipa_path (string)
Output: Privacy permissions grouped by HIGH/MEDIUM/LOW risk with usage descriptions

ios_entitlements_checker

Input:  ipa_path (string)
Output: Entitlements extracted from binary, high-risk flags, simulator detection

ios_binary_strings

Input:  ipa_path (string), filter (all|url|key|email|ip), min_length (default 6)
Output: Filtered strings from Mach-O binary

ios_frameworks_detector

Input:  ipa_path (string)
Output: Bundled frameworks grouped by category with privacy risk annotations

ios_google_services

Input:  ipa_path (string)
Output: Full GoogleService-Info.plist contents + pattern scan of resource files

ios_secrets_scanner

Input:  ipa_path (string), min_length (default 8)
Output: Secrets found in resource files and binary, split by layer with severity

______________________________________________________________________

演示

demo

重新生成 家用录像系统: brew install charmbracelet/tap/vhs && vhs docs/demo.tape

______________________________________________________________________

贡献

看 贡献.md 开发设置、如何添加新工具以及PR指南。

安全

看 安全.md 如何私下报告漏洞。

更新日志

看 更改日志.md.

许可证