Skip to content
Conduit

mcp server

CongniDroid

TheVantaDev/CongniDroidcommunitylistedunreviewed
Use tool

Set up

Runs on your computer. Pick your agent and operating system.

This project does not publish an install method we can turn into a config. Follow the README instead.

README

synced Oct 22, 2026

CogniDroid 🚀

Advanced AI-Powered Android & Multi-Platform Malware Analysis, ML Classification & Dynamic Threat Intelligence Framework

📋 Table of Contents

🌟 Executive Overview

CogniDroid is a state-of-the-art, automated malware analysis, dynamic instrumentation, and threat intelligence framework. Engineered to handle complex modern malware strains—with a primary focus on Android banking trojans, spyware, and ransomware, as well as multi-platform binaries (Windows, Linux, macOS, Office documents, scripts)—CogniDroid bridges the gap between traditional static triage, dynamic behavioral instrumentation, machine learning classification, and AI security synthesis.

CogniDroid integrates:

  1. Automated Static Inspection: Full JADX Android decompilation, Android Manifest parsing, permission threat risk categorization (Dangerous, Special, Info), YARA rule scanning, and MITRE ATT&CK technique extraction.
  2. Dynamic Instrumentation Pipeline: Real-time Frida hook injection (sc0pe_android_enumeration.js), automated ADB emulator management (emulator-5554), intent trigger generation, system call capture, and network socket monitoring.
  3. Dual ML Classification Engine: Simultaneous inference using pre-trained CatBoost (catboost_malware_model.cbm) and XGBoost (xgb_qu1cksc0pe_model.json) classifiers evaluated across a 104-feature behavioral feature matrix, combined with RiskInDroid risk scoring algorithms.
  4. CogniDroid Modern Web UI: Asynchronous job queue manager (Modules/web_app.py, Port 5055), providing real-time visual progress, interactive risk score gauges, permission breakdown badges, IoC extractors, and report downloads.
  5. Model Context Protocol (MCP) Server: Full implementation of the Anthropic MCP specification (Modules/mcp_server.py), allowing AI agents (Claude Code, Cursor, Windsurf) to execute local static and dynamic triage tools natively.
  6. Multi-Provider AI Security Analyst: LLM-assisted report synthesis leveraging local models via Ollama or cloud models via Anthropic Claude, OpenAI, DeepSeek, Kimi (Moonshot), and Zhipu GLM.

📊 Supported File Types & Analysis Capabilities

File CategoryExtensions / FormatsSupported Analysis ModesKey Intelligence Extracted
Android Applications.apk, .dex, .jarStatic, Dynamic (Frida+ADB), ML ScoringPermissions, Intent Filters, JADX Source Patterns, Crypto Hooks, API Call Matrix, Risk Score
Windows Executables.exe, .dll, .msi, .binStatic, Dynamic (Process Watch), YARAImport/Export APIs, PE Sections, Embedded Payloads, Packers, MITRE ATT&CK Mapping
Linux Executables.elf, .binStatic, Dynamic (Emulation/PID Watch)Syscalls, ELF Headers, Mirai/Satori YARA rules, Dynamic Traces
macOS BinariesMach-OStaticMach-O Headers, Load Commands, Persistence Hooks, Symbol Table
Document Files.doc, .docx, .xls, .xlsx, .pdf, .one, .rtfStatic (--docs)Embedded VBA/XLM Macros, Malicious URLs, Exploit Payloads, AutoOpen Hooks
Scripts & Code.vbs, .vbe, .vba, .bat, .cmd, .ps1, .js, .hta, .htmlStatic (--analyze)Obfuscated Strings, PowerShell B64 Payloads, Command Injection, Network Endpoints
Archive Files.zip, .rar, .aceStatic (--archive)Archive Traversal, Encrypted Files Detection, High-Entropy File Extraction
Network Captures.pcapStaticDNS Queries, HTTP Request Headers, IP Connections, Protocol Distribution
Email Files.emlStaticHeader Analysis, DNSBL Blacklist Checking, Attachment Extraction

🔬 Core Feature Deep Dive

1. Android & Multi-Platform Static Analysis

  • Manifest & Permission Breakdown: Analyzes AndroidManifest.xml to parse declared permissions, classifying each into:
    • 🛑 Dangerous: READ_SMS, SEND_SMS, RECORD_AUDIO, CAMERA, ACCESS_FINE_LOCATION, READ_CONTACTS.
    • ⚠️ Special: SYSTEM_ALERT_WINDOW (overlay attack vector), BIND_ACCESSIBILITY_SERVICE (keylogging & UI hijacking), REQUEST_INSTALL_PACKAGES.
    • ℹ️ Info: Standard internet and network state permissions.
  • Component Tracing: Enumerates exported and private Activities, Services, Broadcast Receivers, and Content Providers.
  • Decompilation & Pattern Matching: Leverages JADX to decompile DEX bytecode into Java source, scanning for:
    • Banking overlay patterns (fake login screens, accessibility hijacking).
    • Command & Control (C2) communications (WebSocket, HTTP REST, Telegram bot APIs).
    • Obfuscated string array decoders and reflection invocations.
  • YARA Signature Scanning: Built-in YARA rule engine scanning for known malware families:
    • Android: Anubis, Joker, Marcher, Cerberus, Alien, Hydra, ERMAC, Crave, SaveMe, SMS-Thief.
    • Windows/Linux: AgentTesla, AsyncRAT, Cobalt Strike, Emotet, Mirai, XMRig miners.

2. Automated Frida Dynamic Instrumentation & ADB Automation

  • Frida Hook Engine: Inject custom JavaScript hooks (Systems/Android/FridaScripts/sc0pe_android_enumeration.js) into target application runtimes to intercept:
    • Cryptographic operations (javax.crypto.Cipher, MessageDigest, AES/RSA keys and IVs).
    • File system reads/writes and shared preference access (SharedPreferences.Editor).
    • Dynamic class loading (dalvik.system.DexClassLoader, PathClassLoader).
    • HTTP/HTTPS traffic payloads (java.net.HttpURLConnection, OkHttp3 clients).
    • Telephony and SMS API calls (SmsManager.sendTextMessage, TelephonyManager.getDeviceId).
  • ADB Emulator Automation: Communicates directly with connected Android emulators (emulator-5554 / 127.0.0.1:5555):
    • Automatically installs target APKs.
    • Grants required runtime permissions via adb shell pm grant.
    • Launches main activity and simulates user interaction (monkey event generation).
    • Captures logcat buffer logs and extracts generated dynamic files from /data/data/<package_name>/.

3. Dual Machine Learning Malware Classification Engine

CogniDroid incorporates a dual ML classification architecture operating on a standardized 104-feature vector extracted from combined static and dynamic analysis artifacts:

                  ┌──────────────────────────────────────────┐
                  │ 104-Feature Extraction Vector Building   │
                  │ (Permissions, APIs, Source Patterns, etc)│
                  └────────────────────┬─────────────────────┘
                                       │
                    ┌──────────────────┴──────────────────┐
                    │                                     │
                    ▼                                     ▼
      ┌───────────────────────────┐         ┌───────────────────────────┐
      │  CatBoost Classifier      │         │   XGBoost Classifier      │
      │ (catboost_malware_model)  │         │ (xgb_qu1cksc0pe_model)    │
      └─────────────┬─────────────┘         └─────────────┬─────────────┘
                    │                                     │
                    └──────────────────┬──────────────────┘
                                       │
                                       ▼
                       ┌───────────────────────────────┐
                       │  Aggregate RiskInDroid Score  │
                       │  Malware Probability (%)     │
                       └───────────────────────────────┘
  • CatBoost Model (catboost_malware_model.cbm): Evaluates categorical permissions, activity class names, and source pattern occurrences to output a high-precision malware probability score.
  • XGBoost Model (xgb_qu1cksc0pe_model.json): Evaluates dense numerical feature matrices generated from static API matches and YARA hits.
  • Feature Name Registry (qu1cksc0pe_feature_names.json): Maintained feature mapping ensuring reproducible feature ordering across python environments.

4. CogniDroid Interactive Web UI (webui)

  • Asynchronous Architecture: Built on Flask and multi-threaded worker pools (Modules/web_app.py), listening on port 5055 by default.
  • Queue Manager: Monitors background analysis jobs with full lifecycle states (queued -> running -> completed / failed).
  • Visual Dashboard:
    • Radial risk gauges displaying ML probability percentages.
    • Interactive permission cards with filter badges.
    • Tabbed source code viewer for JADX decompiled files.
    • Downloadable JSON analysis reports and PDF/AI summaries.

5. Model Context Protocol (MCP) Server

  • Server File: Modules/mcp_server.py
  • Supported Tools:
    • analyze_file: Performs full static & ML analysis on executables/APKs.
    • analyze_document: Deep inspection of Office/PDF documents.
    • analyze_archive: Traverses and inspects ZIP/RAR/ACE archives.
    • detect_packer: Checks PE/ELF/APK files for packing/obfuscation.
    • detect_language: Identifies binary compiler/language provenance.
    • extract_iocs: Extracts domains, IPs, URLs, hashes, and emails.
    • check_resources: Analyzes binary resources and embedded assets.
    • check_signatures: Inspects digital signatures and file carving headers.
    • scan_hash: Queries built-in malware hash database.
    • scan_virustotal: Performs VirusTotal hash lookup.
    • configure_virustotal_api_key: Sets VT API key.
    • configure_ai_api_key: Configures cloud AI provider credentials.
    • update_hash_database: Syncs local hash database.
    • list_supported_file_types: Returns supported formats registry.

6. Multi-Provider AI Security Analyst

Analyzes raw JSON report data and crafts executive security summaries.

ProviderFlag / Env SelectionRequired ConfigurationDefault Model
Ollama (Default)--ai / SC0PE_AI_PROVIDER=ollamaLocal Ollama running on 11434Configured in multiple.conf
Anthropic Claude--ai_provider claudeANTHROPIC_API_KEYclaude-haiku-4-5-20251001
OpenAI--ai_provider openaiOPENAI_API_KEYgpt-4o-mini
DeepSeek--ai_provider deepseekDEEPSEEK_API_KEYdeepseek-chat
Kimi (Moonshot)--ai_provider kimiMOONSHOT_API_KEYmoonshot-v1-8k
Zhipu GLM--ai_provider glmZHIPUAI_API_KEYglm-4-flash

7. RAG Knowledge Base & Threat Intel

Located in knowledge_base/, containing curated security intelligence ingested during AI analysis:

  • MITRE ATT&CK Mobile: Comprehensive technique files (t1412_capture_sms.txt, t1417_input_capture_accessibility.txt, t1461_lockscreen_bypass.txt, t1476_malicious_app_delivery.txt, t1638_adversary_in_the_middle.txt).
  • CAPEC Patterns: Attack pattern descriptions (capec_151_identity_spoofing.txt, capec_98_164_phishing.txt, mobile_banking_attack_patterns.txt).
  • CERT-In Advisories: Threat advisories on Android banking malware campaigns operating in South Asia.
  • Malware Intel: Profiles on major banking trojan families (SOVA, Hydra, Godfather, Xenomorph, Anubis).

🏗️ System Architecture

                                  ┌───────────────────────────┐
                                  │   User Interface Layer    │
                                  │ (Web UI 5055 / CLI / MCP) │
                                  └─────────────┬─────────────┘
                                                │
                                                ▼
                                  ┌───────────────────────────┐
                                  │     qu1cksc0pe Core       │
                                  │    Orchestration Engine   │
                                  └─────────────┬─────────────┘
                                                │
                 ┌──────────────────────────────┼──────────────────────────────┐
                 │                              │                              │
                 ▼                              ▼                              ▼
   ┌──────────────────────────┐   ┌──────────────────────────┐   ┌──────────────────────────┐
   │ Static Analysis Pipeline │   │ Dynamic Analysis Pipeline│   │   Knowledge Base RAG     │
   │  • JADX Bytecode Parser  │   │  • ADB Device Controller │   │  • MITRE ATT&CK Mobile   │
   │  • Manifest Risk Engine  │   │  • Frida Hook Injector   │   │  • CAPEC Threat Patterns │
   │  • YARA Signature Engine │   │  • API / Crypto Tracing  │   │  • CERT-In Advisories    │
   └─────────────┬────────────┘   └─────────────┬────────────┘   └─────────────┬────────────┘
                 │                              │                              │
                 └──────────────────────────────┼──────────────────────────────┘
                                                │
                                                ▼
                                  ┌───────────────────────────┐
                                  │ ML Malware Classification │
                                  │  • CatBoost Classifier    │
                                  │  • XGBoost Classifier     │
                                  │  • RiskInDroid Calculator │
                                  └─────────────┬─────────────┘
                                                │
                                                ▼
                                  ┌───────────────────────────┐
                                  │   AI Security Analyst     │
                                  │ (Ollama / Claude / VT)    │
                                  └───────────────────────────┘

🛠️ Complete Setup and Installation

Linux / macOS Installation

# 1. Clone the repository
git clone https://github.com/CogniDroid/CogniDroid.git
cd CogniDroid

# 2. Create Python virtual environment
python3 -m venv sc0pe_venv
source sc0pe_venv/bin/activate

# 3. Upgrade pip and set up dependencies
pip install --upgrade pip
bash setup.sh

# 4. (Optional) Install global binary link
python3 qu1cksc0pe.py --install

Windows Setup (PowerShell)

Execute in PowerShell (Run as Administrator):

# Navigate to directory
cd C:\Path\To\CogniDroid

# Create virtual environment
python -m venv sc0pe_venv
.\sc0pe_venv\Scripts\Activate.ps1

# Run Windows setup script
.\setup.ps1

setup.ps1 automatically installs required system binaries via Winget fallback (Python, 7-Zip, Sysinternals Strings EULA acceptance, JADX).

Docker Deployment

# Build Docker image
docker build -t cognidroid .

# Run static analysis container
docker run -it --rm -v $(pwd):/data cognidroid:latest --file /data/sample.apk --analyze --report

# Run Web UI in container
docker run -d -p 5055:5055 -v $(pwd):/data cognidroid:latest --ui

🚀 Usage & CLI Command Reference

Launching Web UI

python3 Modules/web_app.py
# Or via entrypoint:
python3 qu1cksc0pe.py --ui

Access dashboard at http://127.0.0.1:5055.

Static Triage & Analysis

# Perform standard static triage on executable or APK
python3 qu1cksc0pe.py --file sample.apk --analyze

# Perform analysis and generate JSON report
python3 qu1cksc0pe.py --file sample.apk --analyze --report

# Detailed report mode (preserves large resource fields)
SC0PE_ANDROID_REPORT_DETAILED=1 python3 qu1cksc0pe.py --file sample.apk --analyze --report

Dynamic Analysis Execution

Ensure ADB device/emulator is connected:

# Verify ADB connection
adb devices
# Output: emulator-5554 device

# Launch interactive dynamic watcher
python3 qu1cksc0pe.py --watch

Document & Macro Inspection

# Analyze Word, Excel, PDF, or OneNote documents
python3 qu1cksc0pe.py --file malicious_doc.docx --docs

# Analyze document with AI macro summary
python3 qu1cksc0pe.py --file malicious_doc.docm --docs --ai

Archive Analysis

# Analyze contents of ZIP, RAR, or ACE archive
python3 qu1cksc0pe.py --file suspicious_archive.zip --archive --report

File Carving & Signature Checking

# Check embedded PE/ELF signatures and extract carved payloads
python3 qu1cksc0pe.py --file sample_with_dropped_payload --sigcheck

Interactive Shell

python3 qu1cksc0pe.py --console

🔌 MCP Server Setup & IDE Integration

The MCP server exposes CogniDroid tools directly to AI coding assistants (Claude Code, Cursor, Windsurf).

Running Streamable HTTP Server (Persistent)

python3 qu1cksc0pe.py --mcp

Endpoint available at http://127.0.0.1:8765/mcp.

Stdio Configuration (.mcp.json)

CogniDroid includes .mcp.json at the root directory:

{
  "mcpServers": {
    "cognidroid": {
      "command": "python3",
      "args": ["qu1cksc0pe.py", "--mcp"],
      "env": { "SC0PE_MCP_TRANSPORT": "stdio" }
    }
  }
}

🔑 Key Initialization & API Management

Configure cloud API keys for VirusTotal and AI analysis providers:

# Launch interactive key manager
python3 qu1cksc0pe.py --key_init

Prompt selection menu:

  1. VirusTotal API Key
  2. Claude (Anthropic) API Key
  3. OpenAI API Key
  4. DeepSeek API Key
  5. Kimi (Moonshot AI) API Key
  6. GLM (Zhipu AI) API Key

Single-provider command line override:

python3 qu1cksc0pe.py --key_init --key_provider claude

⚙️ Complete Environment Variables Reference

Environment VariableDefaultFunction & Purpose
SC0PE_ANDROID_REPORT_DETAILED0Set 1 to enable verbose JSON report output (retains full resource dumps and duplicate source pattern matches).
SC0PE_WINDOWS_REPORT_DETAILED0Set 1 to store detailed per-category Windows API calls instead of unique API names.
SC0PE_AI_PROVIDERautoSelects default AI backend (auto/ollama, claude, openai, deepseek, kimi, glm).
ANTHROPIC_API_KEYunsetAnthropic Claude API key for report generation.
OPENAI_API_KEYunsetOpenAI API key.
DEEPSEEK_API_KEYunsetDeepSeek API key.
MOONSHOT_API_KEYunsetKimi (Moonshot AI) API key.
ZHIPUAI_API_KEYunsetZhipu GLM API key.
OLLAMA_HOSThttp://127.0.0.1:11434Ollama service endpoint URL.
SC0PE_AI_CLAUDE_MODELclaude-haiku-4-5-20251001Model name used when SC0PE_AI_PROVIDER=claude.
SC0PE_AI_DEEPSEEK_MODELdeepseek-chatModel name for DeepSeek AI calls.
SC0PE_AI_OPENAI_MODELgpt-4o-miniModel name for OpenAI calls.
SC0PE_AI_MAX_REPORT_CHARS180000Max character count before raw JSON reports are auto-compacted for LLM prompts.
SC0PE_AI_DISABLE_THINK1Disables internal chain-of-thought outputs (think=false) in LLM response displays.
SC0PE_MCP_TRANSPORTstreamable-httpMCP server transport mode (streamable-http, stdio, sse).
SC0PE_MCP_PORT8765Bind port for MCP HTTP server.
JAVA_HOMEunsetCustom path to JDK installation (used by JADX decompiler).

📜 References & Credits

  • Original Project: Built upon Qu1cksc0pe by CYB3RMX.
  • Decompiler: JADX by skylot.
  • Dynamic Instrumentation: Frida by Ole André Vadla Ravnås.
  • ML Frameworks: CatBoost, XGBoost.
  • Risk Assessment: Inspired by RiskInDroid.
  • License: Distributed under the GNU General Public License v3.0 (LICENSE).
↑↓ navigate openesc close