移动端渗透测试平台

+-------------------+
|     AI Agent      |  Orchestrates all four MCPs simultaneously
|     (Cursor)      |
+--------+----------+
         |
    MCP Protocol
         |
+--------+----------+--------------------+------------------+------------------+
|                   |                    |                  |                  |
|  Corellium-MCP    | Device-Control-MCP |   Parley-MCP     |  Analysis-MCP    |
|  (72 tools)       |   (31 tools)       |   (23 tools)     |  (22 tools)      |
|                   |                    |                  |                  |
|  Virtual Device   |  Session state     |  TCP/TLS Proxy   |  Plist decode/   |
|  Management       |   (instance_id,    |  + Python Mods   |    encode        |
|  App Lifecycle    |    serviceIp)      |  + SQLite DB     |  Cookie parser   |
|  Filesystem I/O   |  Artifact dir      |  + HTTP Tools    |  JWT decoder     |
|  CoreTrace        |  Tap/swipe/type    |  + Auto-Cert CA  |  SQLite analyzer |
|  MATRIX Assess.   |  Screenshot+grid   |  + Cookie Jar    |  Provisioning    |
|  Hypervisor Hooks |  Session-aware     |  + HAR Export    |    profiles      |
|  Network Capture  |    SSH exec        |  + Replay/Scan   |  Keychain dumps  |
+--------+----------+---------+----------+--------+---------+------------------+
         |                    |                   |
         |   +----------------+                   |
         v   v                                    v
+------------------+                    +------------------+
| Corellium Cloud  |                    | Target Backend   |
| Virtual Device   |<------------------>| API Server       |
| (iOS / Android)  |                    |                  |
+------------------+                    +------------------+
  Mobile App Traffic ------> Parley Proxy ------> Backend
  (routed via proxy)        (intercept/rewrite)

# --- PHASE 1: Setup ---

# Parley-MCP: Stand up a TLS-decrypting proxy for the target backend
web_proxy_setup(target_domain="api.targetapp.com", listen_port=8080)

# Corellium-MCP: Create device, install app, baseline snapshot
corellium_connect()
corellium_create_instance(project_id="...", flavor="iphone16pm", os_version="18.0", name="pentest")
corellium_agent_ready(instance_id="...")
corellium_create_snapshot(instance_id="...", name="clean-state")

# Corellium-MCP: Install Parley's proxy CA cert on the device
corellium_install_profile(instance_id="...", base64_profile="<parley-ca-cert-base64>")

# Corellium-MCP: Upload and install the target app
corellium_upload_file(instance_id="...", device_path="/tmp/target.ipa", base64_content="...")
corellium_install_app(instance_id="...", file_path="/tmp/target.ipa")

# --- PHASE 2: Reconnaissance ---

# Corellium-MCP: Start syscall tracing + launch the app
corellium_start_core_trace(instance_id="...")
corellium_run_app(instance_id="...", bundle_id="com.target.app")

# Parley-MCP: Watch traffic flow in, get summary
traffic_summary(instance_id="...")
traffic_search(instance_id="...", pattern="password|token|api_key|Bearer")

# --- PHASE 3: Active Testing ---

# Parley-MCP: Deploy IDOR testing module
module_create(name="IDOR_Probe", direction="client",
    code="def module_function(n, si, sp, di, dp, data):\n    return data.replace(b'user_id=123', b'user_id=456')")

# Corellium-MCP: Check app's reaction
corellium_download_file(instance_id="...", device_path="/data/data/com.target.app/databases/app.db")
corellium_get_kernel_panics(instance_id="...")

# Parley-MCP: Compare original vs modified traffic
traffic_query(instance_id="...", show_modified=True)

# --- PHASE 4: Automated Assessment ---

# Corellium-MCP: Run MATRIX while Parley captures everything
corellium_create_assessment(instance_id="...", bundle_id="com.target.app")
corellium_start_monitoring(instance_id="...", assessment_id="...")
# ... interact with app ...
corellium_stop_monitoring(instance_id="...", assessment_id="...")
corellium_run_security_tests(instance_id="...", assessment_id="...")
corellium_download_security_report(instance_id="...", assessment_id="...")

# --- PHASE 5: Cleanup ---
corellium_restore_snapshot(instance_id="...", snapshot_id="...")
proxy_stop(instance_id="...")
corellium_disconnect()

Corellium-MCP/
├── README.md                        # This file
├── MCP_SETUP.md                     # Detailed setup instructions
├── requirements.txt                 # Corellium-MCP + Analysis-MCP dependencies
├── LICENSE                          # GNU General Public License v3
├── MCPs/
│   ├── corellium_mcp/               # Corellium MCP server (72 tools)
│   │   ├── __init__.py
│   │   ├── __main__.py
│   │   ├── client.py                #   REST API client (httpx)
│   │   └── server.py                #   MCP tool definitions
│   ├── device_control_mcp/          # Device Control MCP server (31 tools)
│   │   ├── __init__.py
│   │   ├── __main__.py
│   │   ├── server.py                #   MCP tool definitions
│   │   ├── session.py               #   Session & engagement management
│   │   ├── input_codec.py           #   Touch/swipe/text input encoding
│   │   ├── ios_tools.py             #   iOS SSH & bundle inspection
│   │   ├── android_tools.py         #   Android ADB & intent fuzzing
│   │   ├── frida_runner.py          #   Frida dynamic instrumentation
│   │   └── frida_scripts/           #   Frida JS snippets
│   ├── analysis_mcp/                # Analysis MCP server (22 tools)
│   │   ├── __init__.py
│   │   ├── __main__.py
│   │   └── server.py                #   Forensic decoding/encoding tools
│   └── parley_mcp/                  # Parley MCP server (23 tools)
│       ├── run_server.py            #   Entry point
│       ├── requirements.txt         #   Parley dependencies
│       ├── README.md                #   Full Parley documentation
│       └── parley_mcp/              #   Core package
│           ├── server.py            #     MCP tool definitions
│           ├── proxy_engine.py      #     Multi-threaded proxy engine
│           ├── database.py          #     SQLite3 data layer
│           ├── module_manager.py    #     Dynamic Python module system
│           └── module_libs/         #     Protocol libraries (JWT, HTTP, etc.)
├── .mcp.json                        # Claude Code MCP server config
├── .cursor/
│   ├── mcp.json                     # Cursor MCP server config
│   └── skills/
│       └── corellium-mcp/
│           ├── SKILL.md             # Pentesting methodology + tool guide
│           └── pentest-reference.md # Deep-dive reference (OWASP, paths, etc.)
└── .claude/
    ├── CLAUDE.md                    # Claude Code project context
    └── skills/
        └── corellium-mcp/           # Mirror of .cursor/skills/
            ├── SKILL.md
            └── pentest-reference.md

cd Corellium-MCP
pip install -r requirements.txt
pip install -r MCPs/parley_mcp/requirements.txt

{
  "mcpServers": {
    "corellium-mcp": {
      "command": "python",
      "args": ["-m", "corellium_mcp"],
      "env": {
        "PYTHONPATH": "MCPs",
        "CORELLIUM_API_ENDPOINT": "https://app.corellium.com/api",
        "CORELLIUM_API_TOKEN": "your-token-here"
      }
    },
    "device-control-mcp": {
      "command": "python",
      "args": ["-m", "device_control_mcp"],
      "env": {
        "PYTHONPATH": "MCPs",
        "CORELLIUM_API_ENDPOINT": "https://app.corellium.com/api",
        "CORELLIUM_API_TOKEN": "your-token-here",
        "DEVICE_CONTROL_ARTIFACTS_ROOT": "./artifacts"
      }
    },
    "parley-mcp": {
      "command": "python",
      "args": ["MCPs/parley_mcp/run_server.py"]
    },
    "analysis-mcp": {
      "command": "python",
      "args": ["-m", "analysis_mcp"],
      "env": {
        "PYTHONPATH": "MCPs"
      }
    }
  }
}