# pullkitsan/mobsf-mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pullkitsan/mobsf-mcp-server  
**GitHub Stars:** 24  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/pullkitsan-mobsf-mcp-server

## Description
A MCP server for MobSF which can be used for static and dynamic analysis of Android and iOS application.

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/pullkitsan/mobsf-mcp-server), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
git clone https://github.com/pullkitsan/mobsf-mcp-server.git
```

2. Install:

```sh
npm install
```

## Documentation

## What pullkitsan/mobsf-mcp-server MCP server does

pullkitsan/mobsf-mcp-server MCP server exposes MobSF scanning through the Model Context Protocol. It is designed for Android APK and iOS IPA files, giving an MCP-compatible client a way to submit a mobile application and inspect the resulting analysis.

The repository exposes a `scanFile` tool. A client can use a prompt such as `scan <FILE>.apk` or `scan <FILE>.ipa`; the server sends the file to MobSF, requests analysis, and processes the returned report. The integration is intended for environments where MobSF is already installed and running.

## How it works

The server communicates with MobSF through its REST API rather than performing the security analysis itself. A scan request uploads the selected file, triggers the corresponding MobSF scan, and retrieves an analysis summary for the MCP client. The response is filtered to avoid returning especially large values, including raw strings and source-code dumps. This keeps responses smaller and avoids overwhelming client message limits.

The MCP interface is implemented by `server.ts`. The provided examples run it with `npx tsx`, allowing an MCP client to start the server as a local process. MobSF remains a separate prerequisite and must be reachable at the configured URL.

## Setup and configuration

Install MobSF and start it before using the integration. The repository also requires Node.js with npm. Its instructions reference the MCP TypeScript SDK in a local folder named `sdk`; the SDK should be downloaded and renamed accordingly if it is not already present.

Clone the repository, enter its directory, and install dependencies with `npm install`. Copy `.env.example` to `.env`, then set the MobSF connection details:

- `MOBSF_API_KEY`: the API key used to authenticate with MobSF.
- `MOBSF_URL`: the MobSF base URL, shown in the example as `http://localhost:8000`.

The example Claude Desktop configuration starts the server with `npx tsx` and an absolute path to `server.ts`. The README also includes a 5ire configuration example using the same command pattern on Windows. If startup fails, the repository suggests running `npx tsx server.ts` from the MobSF server directory and installing any missing npm dependency.

## Tools and capabilities

The main capability in the pullkitsan/mobsf-mcp-server MCP server is the `scanFile` tool. It supports:

- Uploading APK and IPA files to MobSF.
- Starting MobSF analysis jobs.
- Fetching an analysis summary.
- Filtering oversized report fields before returning results.
- Exposing the workflow through an MCP-compatible interface.

## Limitations and notes

Only `.apk` and `.ipa` files are supported. MobSF must be installed, running, and accessible at the URL configured in `MOBSF_URL`; this server does not replace the MobSF service. Large report sections, including raw strings and source-code dumps, are intentionally excluded from responses. The pullkitsan/mobsf-mcp-server MCP server therefore returns a constrained analysis view rather than every field MobSF may produce.

_Full upstream README: https://allmcps.com/mcp/pullkitsan-mobsf-mcp-server/readme_