Mobsf MCP Server

What pullkitsan/mobsf-mcp-server MCP server does

pullkitsan/mobsf-mcp-server MCP server exposes MobSF scanning through the Model Context Protocol. It is designed for Android APK and iOS IPA files, giving an MCP-compatible client a way to submit a mobile application and inspect the resulting analysis.

The repository exposes a scanFile tool. A client can use a prompt such as scan <FILE>.apk or scan <FILE>.ipa; the server sends the file to MobSF, requests analysis, and processes the returned report. The integration is intended for environments where MobSF is already installed and running.

How it works

The server communicates with MobSF through its REST API rather than performing the security analysis itself. A scan request uploads the selected file, triggers the corresponding MobSF scan, and retrieves an analysis summary for the MCP client. The response is filtered to avoid returning especially large values, including raw strings and source-code dumps. This keeps responses smaller and avoids overwhelming client message limits.

The MCP interface is implemented by server.ts. The provided examples run it with npx tsx, allowing an MCP client to start the server as a local process. MobSF remains a separate prerequisite and must be reachable at the configured URL.

Setup and configuration

Install MobSF and start it before using the integration. The repository also requires Node.js with npm. Its instructions reference the MCP TypeScript SDK in a local folder named sdk; the SDK should be downloaded and renamed accordingly if it is not already present.

Clone the repository, enter its directory, and install dependencies with npm install. Copy .env.example to .env, then set the MobSF connection details:

• MOBSF_API_KEY: the API key used to authenticate with MobSF.
• MOBSF_URL: the MobSF base URL, shown in the example as http://localhost:8000.

The example Claude Desktop configuration starts the server with npx tsx and an absolute path to server.ts. The README also includes a 5ire configuration example using the same command pattern on Windows. If startup fails, the repository suggests running npx tsx server.ts from the MobSF server directory and installing any missing npm dependency.

Tools and capabilities

The main capability in the pullkitsan/mobsf-mcp-server MCP server is the scanFile tool. It supports:

• Uploading APK and IPA files to MobSF.
• Starting MobSF analysis jobs.
• Fetching an analysis summary.
• Filtering oversized report fields before returning results.
• Exposing the workflow through an MCP-compatible interface.

Limitations and notes

Only .apk and .ipa files are supported. MobSF must be installed, running, and accessible at the URL configured in MOBSF_URL; this server does not replace the MobSF service. Large report sections, including raw strings and source-code dumps, are intentionally excluded from responses. The pullkitsan/mobsf-mcp-server MCP server therefore returns a constrained analysis view rather than every field MobSF may produce.