Atlas / MCP servers / axhlzy / IL2CPP Frida

IL2CPP FridaBLOCK

Name: IL2CPP Frida
Author: axhlzy

mcp/axhlzy/il2cpp-frida

MCP server by axhlzy · Audited 2026-10-09

⚑ Report / re-scan Source ↗

il2cpp frida MCP Server

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

44 39r · 5w · 0d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) based IL2CPP reverse engineering tool that enables AI assistants (like Claude, Kiro) to directly analyze and manipulate Unity IL2CPP applications.

Features

🔌 Frida Integration - Support for USB, remote, and local device connections
📦 IL2CPP Analysis - List images, classes, methods with fuzzy search support
🔍 Disassembly - Method disassembly based on Frida Instruction API
🧠 GC Heap Analysis - Find runtime object instances
📤 Import/Export - Find module import and export functions
🛠️ JS Execution - Execute arbitrary JavaScript code to manipulate Frida API

Project Structure

.
├── mcp_server.py           # Entry point
├── mcp_server/             # MCP Server module
│   ├── __init__.py
│   ├── server.py           # MCP Server core
│   ├── state.py            # Frida state management
│   ├── tools.py            # MCP tool definitions
│   ├── transport.py        # Transport layer (stdio/sse/http)
│   ├── cli.py              # Command line interface
│   ├── agent_loader.py     # Agent loader
│   └── handlers/           # Tool handlers
│       ├── __init__.py
│       ├── frida_handlers.py
│       └── il2cpp_handlers.py
├── agent/                  # Frida Agent (TypeScript)
│   ├── index.ts            # Agent entry point
│   ├── core/               # Core modules
│   │   ├── il2cpp-helper.ts
│   │   ├── method-utils.ts
│   │   └── class-finder.ts
│   └── services/           # Service modules
│       ├── image-service.ts
│       ├── class-service.ts
│       ├── method-service.ts
│       ├── disasm-service.ts
│       ├── module-service.ts
│       ├── gc-service.ts
│       └── exec-service.ts
├── _agent.js               # Compiled Agent
├── package.json
├── tsconfig.json
└── requirements.txt

Installation

Option 1: pip install (Recommended)

# Install from source
pip install .

# Or install in development mode
pip inst

Read from source at commit 300b9066fe7cOBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add il2cpp-frida-mcp -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "il2cpp-frida-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (44)

39 read · 5 write · 0 destructive.

Tool	Risk	Description
`app_get_apk_info`	read	Get APK basic information (package name, version, signature, etc.)
`frida_connect`	read	Connect to Frida device and target process. Default: device_type=
`frida_disconnect`	read	Disconnect from Frida
`frida_list_devices`	read	List all available Frida devices (usually not needed unless user explicitly requests device list)
`frida_list_processes`	read	List processes on device
`frida_resume`	read	Resume suspended process (use after spawn mode)
`il2cpp_exec_js`	write	Execute arbitrary JavaScript code (advanced feature, can directly manipulate Frida API and IL2CPP objects)
`il2cpp_fields_to_string`	read	Get string representation of instance fields (lfss). Returns JSON format field name-value mapping
`il2cpp_find_classes`	read	Find classes (supports fuzzy matching)
`il2cpp_find_export`	read	Find exported functions
`il2cpp_find_import`	write	Find imported functions
`il2cpp_find_methods`	read	Find methods (supports fuzzy matching)
`il2cpp_gc_choose`	read	Find all instances of specified class in heap (for finding runtime objects)
`il2cpp_gc_info`	read	Get GC heap information (heap size, used size, etc.)
`il2cpp_get_field_offset`	read	Get field offset (lfo). Returns offset of specified field in instance
`il2cpp_get_field_type`	read	Get field type information (lft). Returns detailed type info for specified field
`il2cpp_get_field_value`	read	Get field value (lfv). Returns value pointer for specified field
`il2cpp_get_instance_type`	read	Get instance type information. Returns detailed info about the class the instance belongs to
`il2cpp_get_type_parents`	read	Get instance parent class chain. Returns inheritance chain from current class to root class
`il2cpp_list_classes`	read	List all classes in specified image
`il2cpp_list_fields`	read	Parse all fields of instance (lfs). Returns all field info including name, type, offset, value
`il2cpp_list_fields_with_parents`	read	Parse all fields of instance including parent classes (lfp). Returns field info for instance and all parent classes
`il2cpp_list_images`	read	List all IL2CPP images
`il2cpp_list_instance_methods`	read	List all methods of instance (lms). Returns all methods of the class the instance belongs to
`il2cpp_list_methods`	read	List all methods of specified class
`il2cpp_read_at_offset`	read	Read value at specified offset of instance. Can read memory value at any offset position
`il2cpp_set_field_value`	write	Set instance field value. Modify specified field value of instance
`il2cpp_show_asm`	read	Disassemble method. method_ptr should use virtual_address (second column from list_methods). resolve_functions defaults to false; if true, resolves jump target function names but requires preloading all functions (takes longer)
`il2cpp_show_method`	read	Show method details. Note: parameter must be Il2CppMethod pointer (first column handle from il2cpp_list_methods result)
`memory_alloc`	read	Allocate memory of specified size
`memory_alloc_cstring`	read	Allocate C string (UTF-8)
`memory_alloc_il2cpp_string`	read	Allocate IL2CPP string (System.String)
`memory_alloc_vector`	read	Allocate Vector (float array)
`memory_read`	read	Read memory value
`memory_scan`	read	Memory scan - unified interface. Uses Memory.scanSync and Process.enumerateRanges for memory scanning
`memory_write`	write	Write memory value
`unity_find_gameobject`	read	Find GameObject by path (using GameObject.Find)
`unity_get_children`	read	Get all children of Transform
`unity_get_gameobject`	read	Get GameObject from Transform or Component
`unity_get_hierarchy`	read	Get hierarchy path of Transform (from current object to root)
`unity_get_parent`	read	Get parent of Transform
`unity_get_scene_info`	read	Get current scene information including all GameObjects hierarchy and attached scripts with their pointers
`unity_get_transform`	read	Get Transform from GameObject or Component
`unity_send_message`	write	Call UnitySendMessage to send message to GameObject

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (9)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

agent/services/exec-service.ts:8

const result = eval(code);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

mcp_server/__pycache__/__init__.cpython-312.pyc

__init__.cpython-312.pyc

Why it matters. a compiled or binary member cannot be reviewed from source