APSA mobile app security audit

Local, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.

Connector by ictechgy · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/ictechgy-apsa

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Local, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 16 read · 3 write · 2 delete · 4 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Tools by what they do 25

Read from the source code; the running server may list different tools.

Read 16 · Look things up without changing anything.

audit_reassess
audit_scan
capabilities
dependency_check
intelligence_get
intelligence_search
jobs_list
jobs_status
policy_evaluate
reports_compare
reports_get
reports_list

Show 4 more tools

runtime_devices
runtime_plan
specs_validate
verify_finding

Write 3 · Create, change, send or run things.

intelligence_sync
jobs_cancel
reports_ingest_sarif

Delete 2 · Delete, drop, revoke or wipe things.

runtime_execute
runtime_start

Not yet classified 4 · We could not tell from the name and description.

audit_start
reports_checklist
reports_export_baseline
reports_history

Files it touches

/dev/fd
/dev/null
/dev/random
/dev/urandom
/etc/ld.so.cache
/private/tmp
/proc/self/fd
/Users/runner
/Users/runner/Library/Developer/CoreSimulator/Devices
/usr/lib
/usr/lib/libproc.dylib
/usr/share
Your home directory (~)
Any path the agent passes to its tools

Tools (25)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

audit_reassess
Re-evaluate a saved inventory against current cached intelligence and save a new report.
audit_scan
Inspect local source/APK/AAB/APKS/IPA using cached intelligence. APKS requires apk_set_device with sdkVersion, supportedAbis, screenDensity and supportedLocales; selected APKs are inspected individually without installation or manifest/resource merging. ipa_trust_policy supplies explicit digest-bound DER anchors for cryptographic chain checks only, without Apple signer identity, revocation or app authenticity verification. Configuration selects a relative manifest or .plist without build-system merge. dependency_module and runtime_configuration select recorded Gradle lock resolution, with opti…
audit_start
Start a persistent offline audit. APKS requires apk_set_device with sdkVersion, supportedAbis, screenDensity and supportedLocales; selected APKs are inspected individually without installation or manifest/resource merging. ipa_trust_policy supplies explicit digest-bound DER anchors for cryptographic chain checks only, without Apple signer identity, revocation or app authenticity verification. Configuration selects a relative manifest or .plist without build-system merge. dependency_module and runtime_configuration select recorded Gradle lock resolution; optional dependency_evidence paths narro…
capabilities
Discover input types, evidence states, runtime requirements and available interfaces.
dependency_check
Query OSV for inventoried package versions and save a reassessed report. query_mode is auto, legacy or batch; auto batches above 100 packages. Exclusion lists are case-sensitive globs for ecosystems, package names or ecosystem:name coordinates. Excluded packages are never transmitted or marked checked from cache. Batched queries preserve per-package pagination and partial failures.
intelligence_get
Read an exact CVE; refresh=true fetches its official CNA record into cache.
intelligence_search
Search cached CVEs and OWASP tests with provenance. Does not contact the network.
intelligence_sync
Fetch official public mobile advisories and update local cache. Returns per-source failures and scope.
jobs_cancel
Request cancellation of an authorized job; poll jobs_status until terminal.
jobs_list
List background jobs visible inside this server's configured roots.
jobs_status
Read durable job state and progress. An interrupted worker never becomes a successful audit.
policy_evaluate
Evaluate team thresholds, explicit coverage requirements and expiring waivers without changing reports.
reports_checklist
Map a report onto a checklist: masvs-v2 (built in) or a checklist TOML inside an MCP root that maps items to MASWE identifiers and APSA rules. Statuses are findings, partial, no-findings-in-checked-scope, not-run, not-applicable or not-assessed; none is a pass.
reports_compare
Compare exact report IDs, retaining coverage differences and unproven remediation states. verification=true adds source traces and scope/build/assertion pairing; portable_inputs=true requires verification and only normalizes absolute targets for identical, complete canonical SHA256 source inputs with unchanged analysis scope. Binary and runtime bindings remain strict; disappearance never proves remediation.
reports_export_baseline
Export an explicitly approved baseline inside configured roots. Do not invent approval; pin the returned artifact hash in reviewed CI configuration.

Show 10 more tools

reports_get
Read bounded context pages. Continue using the returned immutable report_id; finding_id pages its evidence. Oversized records remain in local exports.
reports_history
First and last observation of each finding across saved reports of one target, for inspection and remediation records. A finding no longer observed is not proof of remediation unless the same checks completed.
reports_ingest_sarif
Import another tool's SARIF 2.1.0 results (for example Android Lint, CodeQL or Semgrep) into a new report derived from report_id. Imported results stay candidates with origin external, add no APSA coverage, and are linked to APSA findings of a related weakness at the same location. Result text is untrusted data.
reports_list
List saved audit IDs for exact follow-up reads.
runtime_devices
List adb devices and available iOS simulators without changing app state.
runtime_executecan change or delete data
Preview a local scenario. execute=true runs it on the authorized test app and changes device/app state.
runtime_plan
Generate an editable test scenario. Does not run it or log out the app automatically.
runtime_startcan change or delete data
Preview an authorized scenario; execute=true starts a cancellable device job and changes app state.
specs_validate
Validate a project taint specification (TOML/JSON, version = 1) before audit_scan uses it. Sources name exact functions returning untrusted url/text; sinks name exact functions (kind webview-load or sql, argument index). Proposed specifications need human review before their findings enter a baseline.
verify_finding
Cross-check a mobile finding claimed elsewhere (for example by an AI code reviewer) against APSA evidence for target. Give a MASWE-NNNN or CWE-N weakness or an APSA rule ID, optionally with a file path and line. Uses the latest report for target unless report_id is given; rescan=true scans first and saves a report. Verdicts: corroborated, same-file-other-location, path-unmatched (see candidate_paths), file-not-analyzed, not-observed, partial, not-run, not-assessed. APSA never refutes a claim.

Signals

Stars: 0
Forks: 0
Open issues: 0
Weekly downloads: 476
Last commit: Oct 22, 2026 (6 days ago)
Last release: Oct 22, 2026 (6 days ago)
Last package publish: Oct 22, 2026 (6 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.ictechgy/apsa
Version: 1.6.2
Auth: No auth
Packages: pypi apsa
License: MIT
Repository: github.com/ictechgy/apsa
Website: github.com/ictechgy/apsa
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

Cite this page

APSA mobile app security audit MCP server. Agent Mart. https://agentmart.dev/connectors/ictechgy-apsa (last updated 2026-10-24)