MobSF-MCP

Architecture based on https://github.com/GH05TCREW/mobsf-mcp

📑 Overview

MobSF MCP is a Node.js-based Model Context Protocol implementation for Mobile Security Framework (MobSF). It provides a standardized interface for integrating MobSF's security analysis capabilities into automated workflows and third-party tools.

🛠️ Prerequisites

Node.js (v14 or higher)
npm (Node Package Manager)
Running instance of MobSF with API access

⚙️ Installation And Usage

Clone the repository or navigate to the mobsf-mcp directory, and install dependencies:

npm install -g mobsf-mcp

Configure environment variables and start the MobSF MCP server by using the npx command:

📚 Open PowerShell as an administrator

$env:MOBSF_URL="http://localhost:8000"; 
$env:MOBSF_API_KEY="your_api_key_here"; 
npx mobsf-mcp

📂 API Reference

Available Endpoints

| Endpoint | Description | Parameters | |----------|-------------|------------| | uploadFile | Upload a mobile application file (APK, IPA, or APPX) for security analysis | file: File path to upload | | getScanLogs | Retrieve detailed scan logs for analyzed application | hash: MD5 hash of the scan | | getJsonReport | Get full JSON security analysis report | hash: MD5 hash of the scan | | getJsonReportSection | Get specific section of the report | hash: MD5 hash, section: Section name | | getJsonReportSections | List all available report sections | hash: MD5 hash of the scan | | getRecentScans | Retrieve list of recent security scans | page: Page number, pageSize: Results per page | | searchScanResult | Search scan results by various criteria | query: Search term (hash/name/package) | | deleteScan | Delete scan results | hash: MD5 hash of the scan | | getScorecard | Get application security scorecard | hash: MD5 hash of the scan | | generatePdfReport | Generate PDF security report | hash: MD5 hash of the scan | | viewSource | View source files from analysis | hash: MD5 hash, file: File path, type: File type | | getScanTasks | Get scan tasks queue (async scan queue) | None | | compareApps | Compare two scan results | hash1: First scan hash, hash2: Second scan hash | | suppressByRule | Suppress findings by rule ID | hash: MD5 hash, type: code/manifest, rule: Rule ID | | suppressByFiles | Suppress findings by files | hash: MD5 hash, type: code, rule: Rule ID | | listSuppressions | View scan suppressions | hash: MD5 hash of the scan | | deleteSuppression | Delete suppressions | hash: MD5 hash, type: code/manifest, rule: Rule ID, kind: rule/file | | listAllHashes | Get all report MD5 hash values | page: Page number, pageSize: Results per page |

JSON Report Sections

The following sections are available when using getJsonReportSection:

Basic Information

version: MobSF version
title: Report title
file_name: Analyzed file name
app_name: Application name
app_type: Application type
size: File size
md5, sha1, sha256: File hashes
package_name: Application package name

Application Components

main_activity: Main activity name
exported_activities: List of exported activities
browsable_activities: List of browsable activities
activities: All activities
receivers: Broadcast receivers
providers: Content providers
services: Services
libraries: Native libraries

Security Analysis

target_sdk, max_sdk, min_sdk: SDK versions
version_name, version_code: App version info
permissions: Declared permissions
malware_permissions: Potentially dangerous permissions
certificate_analysis: Certificate security analysis
manifest_analysis: AndroidManifest.xml analysis
network_security: Network security configuration
binary_analysis: Binary file analysis
code_analysis: Source code security analysis
niap_analysis: NIAP compliance analysis

Additional Analysis

permission_mapping: Permission usage mapping
urls, domains, emails: Extracted strings
firebase_urls: Firebase URL analysis
exported_count: Count of exported components
apkid: APK identifier information
behaviour: Application behavior analysis
trackers: Tracking libraries detection
playstore_details: Google Play Store details
secrets: Detected secrets/keys
logs: Analysis logs
sbom: Software Bill of Materials
average_cvss: Average CVSS score
appsec: Application security score
virus_total: VirusTotal scan results

🖥️ VSCode Cline Extension Configuration

To use this project with the cline extension in VSCode, add the following configuration to your cline configuration file:

{
  "mcpServers": {
    "MobSF MCP Server": {
      "disabled": false,
      "timeout": 60,
      "command": "Nodejs\\node.exe",
      "args": [
        "index.js"
      ],
      "env": {
        "MOBSF_URL": "http://localhost:8000",
        "MOBSF_API_KEY": "your_api_key_here"
      },
      "transportType": "stdio"
    }
  }
}

⚠️ Path to your Node.js executable (adjust according to your system, e.g., C:\\Program Files\\nodejs\\node.exe). Make sure to fill in your actual MOBSF_API_KEY in the configuration.

⚠️ Disclaimer and Legal Notice

This tool is designed and provided for security researchers, penetration testers, and developers for LEGAL USE ONLY. The primary purpose is to assist in:

Security assessment of your own applications
Applications you have explicit permission to test
Research and educational purposes

The following uses are strictly prohibited:

Any malicious or harmful activities
Unauthorized access to systems or data
Testing applications without proper authorization
Any illegal activities or violation of laws

By using this tool, you agree to:

Use it only for legal and authorized purposes
Take full responsibility for your actions
Comply with all applicable laws and regulations
Hold the developers and contributors harmless from any claims

📄 License

This project is licensed under the Apache 2.0 License - see the LICENSE file for details.

MCP Servers