MobHunt

MobHunt

MobHunt is an agentic mobile security research system, built as a Claude Code project. An
orchestrator agent runs a fixed pipeline over an iOS or Android app and spawns focused sub-agents
along the way. Each sub-agent gets one narrow objective, one vulnerability class or one attack
surface, instead of one agent being asked to look at a whole app and report back with whatever it
finds.

That single decision drives most of the design. A hunter told to "check whether the
myapp-auth:// URL scheme carries an OAuth callback that a competing app can register" produces
evidence. A hunter told to "find vulnerabilities in this app" produces a list of configuration
observations that a triager will close as informational. The rest of the repo exists to keep the
first thing happening and the second thing from reaching a submission.

Almost all of the intelligence here lives in markdown prompts, not in imperative code. The Python
and shell under tools/ is a set of thin, deterministic wrappers around real analysis tooling. The
agents, commands, skills, and rules under .claude/ and rules/ are where the actual method is
written down.

Status and disclaimer

This is research tooling. It is built for authorized security testing only.

- Use it only against applications you own or are explicitly authorized to test.
- Follow the scope and the rules of the bug bounty program you are working under. If binary
  analysis or client-side findings are out of scope, they are out of scope; the validator checks
  for this, but you are responsible for it.
- No warranty of any kind. You are responsible for what you run and what you submit.

I make no claims here about bugs found, bounties earned, or program outcomes. Judge the project on
its design and read the prompts.

How it works

Green…