Frida Mobile MCP

frida-mobile-mcp

An MCP server that gives AI agents dynamic instrumentation of Android and iOS apps through Frida 17, and runs next to REA, ReVa (Ghidra) and IDA MCP servers. It exposes 71 tools: high-level ones that manage devices, sessions and scripts for you (explore an app, hook a Java/ObjC/native method, trace calls, map reachability coverage and autonomously drive the UI toward it, find secrets in memory and turn them into reusable friTap patterns, cast a wide net over crypto, bypass SSL pinning, capture TLS keys and plaintext with friTap, run prebuilt analysis scripts, validate custom scripts) and low-level primitives (spawn/attach, module and symbol enumeration, address resolution, control-flow analysis, memory dumps). Addresses use the same module+0xoffset notation as Ghidra/IDA so results move between static and dynamic tools without conversion, and every result carries an evidence envelope (evidence_id, limitations, coverage). Optional UI automation goes through mobile-mcp.

Quick start

npx frida-mobile-mcp                      # stdio MCP server (default `serve` command)
frida-mobile-mcp doctor                   # check Node, frida-node, adb, devices, frida-server, bridge bundles
frida-mobile-mcp setup --client cursor    # write the server into a client config (claude-code, claude-desktop, cursor, vscode, windsurf, codex)
frida-mobile-mcp gadget --platform android --print   # generate a frida-gadget config.json + APK/IPA repackaging guidance

The gadget command generates a frida-gadget config.json (--interaction listen or --interaction script) and prints the APK/IPA repackaging steps. Embedding the gadget is the only way to instrument native detection that runs in .init_array / JNI_OnLoad before an attach-time script can load, and it removes the frida-server :27042 port as a fingerprint — see frida_help({ topic: "evasion" }).

Claude Code:

claude mcp add frida -- npx -y frida-mobile-mcp

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "frida": {
      "command": "npx",
      "args": ["-y", "frida-mobile-mcp"],
      "env": { "FRIDA_DEVICE_ID": "emulator-5554" }
    }
  }
}

Per-client instructions, HTTP mode and remote frida-server setup are in docs/clients.md. A Claude Desktop extension manifest (manifest.json, MCPB) and an MCP registry entry (server.json) ship in the repo.

Requirements

• Node.js >= 22.12 (CI runs 22 and 24 on Linux, macOS and Windows). npm install runs the frida package's install script, which downloads the native frida-node prebuild.

• A device or emulator running frida-server 17.x. This package depends on frida-node ^17.24.3; frida-server on the device must have the same major version (17) and ideally the same minor version. frida-mobile-mcp doctor prints both versions and flags mismatches.

• Android: download the matching frida-server-17.x.y-android-<arch>.xz from https://github.com/frida/frida/releases, then

  bashCopy

  xz -d frida-server-17.24.3-android-arm64.xz
  adb push frida-server-17.24.3-android-arm64 /data/local/tmp/frida-server
  adb shell "chmod 755 /data/local/tmp/frida-server"
  adb shell "su -c '/data/local/tmp/frida-server &'"
  

• iOS: a jailbroken device with the matching Frida package from the Frida Cydia/Sileo repository. Non-jailbroken devices need the app repackaged with the Frida Gadget; the server then attaches to the gadget-enabled process like any other.

• Optional: pip install friTap for capture_tls (otherwise the pinned agent is downloaded on first use), and network access for npx -y @mobilenext/mobile-mcp@latest on first mobile_action.

What is new for Frida 17

• Bridges are bundled. Frida 17 no longer ships the Java/ObjC bridges in the GumJS runtime. npm run build:bridges bundles frida-java-bridge and frida-objc-bridge into dist/bridges/{java,objc}.js; the server injects the right one by platform (Java on Android, ObjC on iOS/macOS) ahead of every script.
• Legacy scripts still work. execute_script runs classic (non-module) scripts through Script.evaluate, so a Java.perform(...) script written for Frida 16 runs unchanged and keeps its own line numbers in errors. ES modules (import Java from "frida-java-bridge", JS or TS) are compiled on the host with the Frida Compiler; frida-compile bundles (starting with the 📦 marker) are loaded as-is.
• Removed APIs are linted. validate_script flags the static Module.findExportByName/findBaseAddress/enumerateExports, Memory.readX/writeX and *Sync enumerators that throw on Frida 17 and suggests the Module-instance / NativePointer replacements. Generated scripts get findExport(lib, name) and hookNative(lib, name, callbacks) helpers from the agent preamble, and template options as __FRIDA_MCP__.options.
• analyze_native_function uses Process.findFunctionRange and the Frida 17.12+ ControlFlowGraph (with a linear-disassembly fallback reported in limitations).

Tool reference

Tier 1: high-level tools