re-frida

MCP server wrapping the Frida dynamic-instrumentation toolkit. Frida injects a JavaScript engine (V8) into a target process and lets the analyst hook arbitrary functions, walk the type graph, and call into the target at runtime.

The MCP layer adds:

• a stable session identifier — multiple scripts and hooks can be installed under one session, sharing state.
• a strict allowlist of binary-operation shapes — Frida exposes the full V8 JS API to scripts but the MCP wrappers only call the canonical, well-understood primitives (attach, spawn, enumerate, hook, RPC).
• soft-skip behaviour — when the frida Python module or the native libfrida are missing, every tool returns WARN with an install hint and the plugin keeps working.

Tools

Install

Frida is a heavy install (the Python module pulls in frida + frida-tools; the underlying libfrida is a native shared library shipped via PyPI wheels). To install standalone:

pip install -e ./servers/re-frida

On the target device (the phone or VM Frida is talking to), the matching frida-server binary must be running. See https://frida.re/docs/.

Run

re-frida                            # stdio transport (default for MCP)
python -m re_frida                  # equivalent

Deferred to a future run

The original Explore findings called for a Frida server; this plugin-internal scaffolding lands it so the deep-dive agents can pick it up. The Windows targets in the Live Fire stress test still use re-winedbg as the primary dynamic tool; the Android target future run is where re-frida becomes the workhorse.