Open-source mobile security testing suite for iOS and Android. Previously Passionfruit
Grapefruit is an open-source suite for testing the security of iOS and Android mobile applications by instrumenting running apps and exposing their behavior through a web interface. Security researchers use it to inspect, intercept, and modify app functions, files, and cryptographic operations. Catalogue add-ons extend workflows for operating Grapefruit.
This repository also configures its own agents. See what grapefruit tells them →
Skill Claude CodeCodex
Use Grapefruit's CLI for platform-specific mobile app inspection and managed captures. Query persisted evidence through the REST API. Use Frida directly for custom scripts and generic runtime primitives.
Skill Claude CodeCodex
Autonomous mobile security audit aligned with OWASP MASTG v2. Performs checklist-driven analysis across MASVS categories: storage, crypto, network, platform, code, resilience, privacy. Exports structured markdown report with MASTG test references.