MobSF-MCP

Architecture based on https://github.com/GH05TCREW/mobsf-mcp

📑 Overview

MobSF MCP is a Node.js-based Model Context Protocol implementation for Mobile Security Framework (MobSF). It provides a standardized interface for integrating MobSF's security analysis capabilities into automated workflows and third-party tools.

🛠️ Prerequisites

• Node.js (v14 or higher)
• npm (Node Package Manager)
• Running instance of MobSF with API access

---

⚙️ Installation And Usage

Clone the repository or navigate to the mobsf-mcp directory, and install dependencies:

npm install -g mobsf-mcp

Configure environment variables and start the MobSF MCP server by using the npx command:

📚 Open PowerShell as an administrator

$env:MOBSF_URL="http://localhost:8000"; 
$env:MOBSF_API_KEY="your_api_key_here"; 
npx mobsf-mcp

📂 API Reference

Available Endpoints

Endpoint	Description	Parameters
uploadFile	Upload a mobile application file (APK, IPA, or APPX) for security analysis	file: File path to upload
getScanLogs	Retrieve detailed scan logs for analyzed application	hash: MD5 hash of the scan
getJsonReport	Get full JSON security analysis report	hash: MD5 hash of the scan
getJsonReportSection	Get specific section of the report	hash: MD5 hash, section: Section name
getJsonReportSections	List all available report sections	hash: MD5 hash of the scan
getRecentScans	Retrieve list of recent security scans	page: Page number, pageSize: Results per page
searchScanResult	Search scan results by various criteria	query: Search term (hash/name/package)
deleteScan	Delete scan results	hash: MD5 hash of the scan
getScorecard	Get application security scorecard	hash: MD5 hash of the scan
generatePdfReport	Generate PDF security report	hash: MD5 hash of the scan
viewSource	View source files from analysis	hash: MD5 hash, file: File path, type: File type
getScanTasks	Get scan tasks queue (async scan queue)	None
compareApps	Compare two scan results	hash1: First scan hash, hash2: Second scan hash
suppressByRule	Suppress findings by rule ID	hash: MD5 hash, type: code/manifest, rule: Rule ID
suppressByFiles	Suppress findings by files	hash: MD5 hash, type: code, rule: Rule ID
listSuppressions	View scan suppressions	hash: MD5 hash of the scan
deleteSuppression	Delete suppressions	hash: MD5 hash, type: code/manifest, rule: Rule ID, kind: rule/file
listAllHashes	Get all report MD5 hash values	page: Page number, pageSize: Results per page

JSON Report Sections

The following sections are available when using getJsonReportSection:

Basic Information

• version: MobSF version
• title: Report title
• file_name: Analyzed file name
• app_name: Application name
• app_type: Application type
• size: File size
• md5, sha1, sha256: File hashes
• package_name: Application package name

Application Components

• main_activity: Main activity name
• exported_activities: List of exported activities
• browsable_activities: List of browsable activities
• activities: All activities
• receivers: Broadcast receivers
• providers: Content providers
• services: Services
• libraries: Native libraries

Security Analysis

• target_sdk, max_sdk, min_sdk: SDK versions
• version_name, version_code: App version info
• permissions: Declared permissions
• malware_permissions: Potentially dangerous permissions
• certificate_analysis: Certificate security analysis
• manifest_analysis: AndroidManifest.xml analysis
• network_security: Network security configuration
• binary_analysis: Binary file analysis
• code_analysis: Source code security analysis
• niap_analysis: NIAP compliance analysis

Additional Analysis

• permission_mapping: Permission usage mapping
• urls, domains, emails: Extracted strings
• firebase_urls: Firebase URL analysis
• exported_count: Count of exported components
• apkid: APK identifier information
• behaviour: Application behavior analysis
• trackers: Tracking libraries detection
• playstore_details: Google Play Store details
• secrets: Detected secrets/keys
• logs: Analysis logs
• sbom: Software Bill of Materials
• average_cvss: Average CVSS score
• appsec: Application security score
• virus_total: VirusTotal scan results

🖥️ VSCode Cline Extension Configuration

To use this project with the cline extension in VSCode, add the following configuration to your cline configuration file:

{
  "mcpServers": {
    "MobSF MCP Server": {
      "disabled": false,
      "timeout": 60,
      "command": "Nodejs\\node.exe",
      "args": [
        "index.js"
      ],
      "env": {
        "MOBSF_URL": "http://localhost:8000",
        "MOBSF_API_KEY": "your_api_key_here"
      },
      "transportType": "stdio"
    }
  }
}

⚠️ Path to your Node.js executable (adjust according to your system, e.g., C:\\Program Files\\nodejs\\node.exe). Make sure to fill in your actual MOBSF_API_KEY in the configuration.

⚠️ Disclaimer and Legal Notice

This tool is designed and provided for security researchers, penetration testers, and developers for LEGAL USE ONLY. The primary purpose is to assist in:

• Security assessment of your own applications
• Applications you have explicit permission to test
• Research and educational purposes

The following uses are strictly prohibited:

• Any malicious or harmful activities
• Unauthorized access to systems or data
• Testing applications without proper authorization
• Any illegal activities or violation of laws

By using this tool, you agree to:

1. Use it only for legal and authorized purposes
2. Take full responsibility for your actions
3. Comply with all applicable laws and regulations
4. Hold the developers and contributors harmless from any claims

📄 License

This project is licensed under the Apache 2.0 License - see the LICENSE file for details.

✨ Acknowledgments

• Mobile Security Framework (MobSF)
• gc-mobsf-mcp