io.github.monkeywave/frida-mobile-mcp

What it mainly works on, as our AI model read its tool descriptions: files and code on the machine it runs on; a web browser or desktop applications.

26 of 55 tools are described as changing something (creating, editing, deleting, sending or running). For 1 the reading was uncertain, so no mark is shown.

• get_statuson 93 other serversreads or searches

  “Get an overview of connected devices, active sessions (with platform, script count and last activity), hooks, traces, and the most recent session detaches / process crashes (recent_detaches).”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  1 input

  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• frida_helpreads or searches

  “Get help on how to use frida-mobile-mcp tools.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs

  • topicstring“Help topic: overview, hooking, tracing, memory, scripts, native, tls, mobile, examples, advanced, script_catalog, script_api, recipes.”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• explore_appdescribed as changing data

  “Launch a mobile app and gather comprehensive initial context including loaded classes, modules, and libraries.”

  Publisher declares: read-only no · destructive no · idempotent no · open-world yes

  4 inputs, 1 required

  • targetstringrequired“App bundle ID (e.g., "com.example.app") or process name”
  • devicestring“Device ID.”
  • class_filterstring“Regex filter for class enumeration (e.g., "com\.example\..*").”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• hook_methoddescribed as changing data

  “Hook a method to intercept calls with auto device/session management.”

  Publisher declares: read-only no · destructive no · idempotent no · open-world yes

  11 inputs

  • targetstring“App bundle ID, process name, or PID (as string).”
  • session_idstring“Attach the hook to this existing session (from explore_app/hook_method/get_status) instead of looking the app up by target.”
  • methodstring“Method to hook (required unless evidence is given).”
  • devicestring“Device ID.”
  • log_argsboolean“Log method arguments (default: true)”
  • log_retvalboolean“Log return value (default: true)”
  • log_backtraceboolean“Log call backtrace (default: false)”
  • spawnboolean“Spawn the app fresh instead of attaching to running process (default: false)”
  • evidenceobject“Static-analysis evidence instead of a method spec.”
  • interceptor_optionsobject“Frida 17.10+ Interceptor instrumentation options for native hooks, passed as Interceptor.attach({ target, ...options }, callbacks).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• trace_methodon 1 other serverdescribed as changing data

  “Trace function calls matching a pattern for a specified duration.”

  Publisher declares: read-only no · destructive no · idempotent no · open-world yes

  9 inputs, 1 required

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Trace inside this existing session (from explore_app/hook_method/get_status) instead of looking the app up by target.”
  • methodstringrequired“Method pattern to trace.”
  • devicestring“Device ID”
  • duration_secondsnumber“How long to trace (default: 10 seconds)”
  • log_argsboolean“Log arguments”
  • log_retvalboolean“Log return values”
  • interceptor_optionsobject“Frida 17.10+ Interceptor instrumentation options for native hooks, passed as Interceptor.attach({ target, ...options }, callbacks).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• execute_scripton 4 other serversruns code or commandsdescribed as changing data

  “Execute a custom Frida JavaScript/TypeScript script in a target process (Frida 17 agent).”

  Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

  11 inputs, 1 required

  • targetstringrequired“App bundle ID, process name, or PID”
  • sourcestring“Inline JavaScript/TypeScript source code”
  • file_pathstring“Path to a .js/.ts Frida script file”
  • devicestring“Device ID”
  • session_idstring“Reuse an existing session”
  • persistentboolean“Keep script loaded (default: true).”
  • bridgesarray“Classic scripts only: bridges to inject, overriding the platform default (android: ["java"], ios/macos: ["objc"]).”
  • source_kindstring“How to treat the source: "auto" (default) detects a 📦 bundle, then import/export syntax (esm), else classic; "esm" compiles with the Frida Compiler; "bundle" …”
  • skip_validationboolean“Skip the pre-load syntax + Frida 17 removed-API check.”
  • timeout_msinteger“Max time for the script's initial run in ms.”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• run_prebuilt_scriptruns code or commandsdescribed as changing data

  “Run a pre-built Frida script from the built-in library.”

  Publisher declares: read-only no · destructive no · idempotent no · open-world yes

  5 inputs

  • script_namestring“Script name.”
  • targetstring“App bundle ID, process name, or PID (required when running a script)”
  • devicestring“Device ID”
  • optionsobject“Script-specific options”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• search_classes_and_methodsreads or searches

  “Search for classes and their methods by pattern in a running app.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  7 inputs, 1 required

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Reuse an existing session (from explore_app/get_status) instead of re-attaching by target.”
  • patternstringrequired“Regex pattern to match class names”
  • devicestring“Device ID”
  • include_methodsboolean“Also enumerate methods of matched classes (default: false)”
  • limitnumber“Max classes to return (default: 50)”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• describe_classreads or searches

  “Return the full shape of ONE loaded app class so you can pick an exact method overload before hooking.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  6 inputs, 1 required

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Reuse an existing session (from explore_app/get_status) instead of re-attaching by target.”
  • devicestring“Device ID”
  • class_namestringrequired“Fully-qualified class name, e.g.”
  • include_inheritedboolean“Also list methods/fields declared by superclasses (Java: up to, not including, java.lang.Object; ObjC: $methods instead of $ownMethods).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• discover_cryptoreads or searches

  “Find where an app actually performs cryptography (or any API family), without assuming javax.crypto.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  7 inputs

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Reuse an existing session (from explore_app/get_status) instead of re-attaching by target.”
  • devicestring“Device ID”
  • patternstring“Regex matched (case-insensitive) against class names and native symbols.”
  • include_methodsboolean“Include method names for matched Java/ObjC classes (default: true).”
  • limitnumber“Max hits per category (Java classes, native symbols).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• find_secrets_in_memoryreads or searches

  “Scan live process memory for the STRUCTURE of secrets, not just names or byte patterns.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

  10 inputs

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Reuse an existing session (from explore_app/get_status) instead of re-attaching by target.”
  • devicestring“Device ID”
  • recognizersarray“Which recognizers to run (default: all).”
  • scopestring“"heap" (writable rw- ranges, default — where live keys sit), "all" (every readable range, slower), or a module name (e.g.”
  • max_bytesnumber“Stop after scanning this many bytes (default: 16777216).”
  • min_entropynumber“Shannon entropy (bits/byte) threshold for high_entropy_key windows (default: 3.5).”
  • max_entropy_hitsnumber“Cap on noisy high_entropy_key candidates so they don't crowd out precise recognizers (default: 15).”
  • limitnumber“Max candidates to return (default: 100).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”
• trace_coveragedescribed as changing data

  “Arm a broad set of cheap entry-hooks over a target set and track which have been REACHED (covered) vs which are still COLD — the reachability signal for a drive loop.”

  Publisher declares: read-only no · destructive no · idempotent no · open-world yes

  8 inputs

  • targetstring“App bundle ID, process name, or PID.”
  • session_idstring“Reuse an existing session (from explore_app/get_status).”
  • devicestring“Device ID”
  • scopestring“What to cover: a class ("com.example.Crypto"), a class/package glob ("com.example.*"), a native module glob ("libfoo.so!*"), or an ObjC pattern ("-[MyClass *]"…”
  • max_targetsnumber“Cap the number of hooked targets (default: 300).”
  • report_onlyboolean“Do not arm anything; just read the covered/cold map of an existing coverage run (the latest for this session, or coverage_id).”
  • coverage_idstring“Which coverage run to report on (defaults to the most recent for the session).”
  • response_formatstring“Output format: "toon" (default, ~40% fewer tokens — recommended), "markdown" for human-readable, "json" for raw structured data”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.