---
name: igf
description: >-
  CLI interface for igf (Grapefruit) dynamic instrumentation server.
  Use to enumerate Frida devices, list apps, run hooks, query logs,
  access device file systems, inspect classes, dump memory, and
  perform mobile app security analysis.
---

# IGF (Grapefruit) CLI Skill

You are a CLI tool for interacting with the igf (Grapefruit) dynamic instrumentation server. The server runs at `http://localhost:31337` by default (port configurable via `PORT` env or `--port` flag).

## Architecture

IGF has two communication layers:

1. **REST API** (stateless) — HTTP endpoints for device enumeration, history queries, file transfers
2. **Socket.IO RPC** (stateful) — WebSocket session for real-time agent control, requires an active Frida session

RPC calls go through Socket.IO: `emit("rpc", namespace, method, args, callback)`.
The agent organizes methods by namespace (e.g., `fs.ls`, `pins.start`, `classes.list`).

## How to Execute

Use the `igf` CLI directly. All commands follow the pattern:

```
igf <command> [subcommand] [args] [options]
```

### Global Options

- `-H, --host <host>` — Server host (default: localhost)
- `-p, --port <port>` — Server port (default: 31337)
- `-h, --help` — Show help

### Session Options (for `agent` commands)

- `-d, --device <id>` — Device ID (required)
- `--platform <name>` — Platform: `droid` or `fruity` (required)
- `-b, --bundle <id>` — Bundle ID (app mode)
- `--pid <pid>` — Process ID (daemon mode)
- `-n, --name <name>` — Process name (daemon mode)

---

## Commands

### Device & App Management

| Command | Description |
|---------|-------------|
| `igf device list` | List connected Frida devices |
| `igf device apps <device>` | List apps on device |
| `igf device ps <device>` | List running processes |
| `igf device info <device>` | Device system parameters |
| `igf device kill <device> <pid>` | Kill a process |
| `igf version` | Frida & IGF versions |

### Log Management

| Command | Description |
|---------|-------------|
| `igf log hooks <device> <id> [--limit N]` | Query hook logs |
| `igf log crypto <device> <id> [--limit N]` | Query crypto logs |
| `igf log syslog <device> <id>` | Read syslog |
| `igf log agent <device> <id>` | Read agent log |
| `igf log clear <device> <id>` | Clear all logs |

### History

| Command | Description |
|---------|-------------|
| `igf history http <device> <id>` | Android HTTP history |
| `igf history nsurl <device> <id>` | iOS NSURL history |
| `igf history jni <device> <id>` | JNI call history (droid) |
| `igf history flutter <device> <id>` | Flutter channel history |
| `igf history xpc <device> <id>` | XPC message history (fruity) |
| `igf history privacy <device> <id>` | Privacy API access logs |
| `igf history hermes <device> <id>` | Hermes JS captures |

### Agent Commands (requires session)

All `agent` commands require session options: `-d <device> --platform <droid|fruity> -b <bundle>` (app mode) or `-d <device> --platform <droid|fruity> --pid <pid>` (daemon mode).

#### File System (`fs`)

```
igf agent fs ls <path> [session opts]
igf agent fs cat <path> [session opts]
igf agent fs data <path> [session opts]
igf agent fs plist <path> [session opts]
igf agent fs preview <path> [session opts]
igf agent fs rm <path> [session opts]
igf agent fs cp <src> <dst> [session opts]
igf agent fs mv <src> <dst> [session opts]
igf agent fs mkdir <path> [session opts]
igf agent fs stat <path> [session opts]
igf agent fs access <path> [session opts]
igf agent fs roots [session opts]
igf agent fs write <path> <content> [session opts]
```

#### App Information (`app`)

```
igf agent app info [session opts]            # Android only
igf agent app manifest [session opts]        # Android only
igf agent app entitlements [session opts]    # iOS only
igf agent app urls [session opts]            # iOS only
igf agent app plist [session opts]           # iOS only
igf agent app process-info [session opts]
```

#### Binary Security (`checksec`)

```
igf agent checksec all [session opts]
igf agent checksec main [session opts]
igf agent checksec single <name> [session opts]
```

#### Class Introspection (`class`, Android Java)

```
igf agent class list [session opts]
igf agent class inspect <name> [session opts]
igf agent class constants <name> [session opts]
```

#### Class Dump (`classdump`, iOS Objective-C/Swift)

```
igf agent classdump list [session opts]
igf agent classdump module <module> [session opts]
igf agent classdump inheritance <name> [session opts]
igf agent classdump inspect <name> [session opts]
```

#### Hook Management (`hook`)

```
igf agent hook list [session opts]
igf agent hook status [session opts]
igf agent hook start <group> [session opts]
igf agent hook stop <group> [session opts]
igf agent hook user-hooks [session opts]
```

Hook groups are platform-specific. For built-in monitors that should be restored with the session, prefer the `pin` commands below.

#### Built-in Monitors / Pins (`pin`)

```
igf agent pin list [session opts]
igf agent pin active <id> [session opts]
igf agent pin available <id> [session opts]
igf agent pin start <id> [session opts]
igf agent pin stop <id> [session opts]
igf agent pin snapshot [session opts]
```

Common pin IDs:
- Both: `crypto`, `flutter`, `privacy`
- Android: `http`, `jni`, `classloader`, `clipboard`, `broadcast`, `intent`, `sharedpref`, `pendingintent`, `sslpinning`, `webview`
- iOS: `nsurl`, `xpc`, `sqlite`, `pasteboard`, `deviceid`, `biometric`, `fileops`

#### Module & Symbols (`symbol`)

```
igf agent symbol modules [session opts]
igf agent symbol exports <module> [session opts]
igf agent symbol imports <module> [session opts]
igf agent symbol imports-grouped <module> [session opts]
igf agent symbol strings <module> [session opts]
igf agent symbol symbols <module> [session opts]
igf agent symbol deps <module> [session opts]
igf agent symbol sections <module> [session opts]
igf agent symbol resolve <module> <name> [session opts]
igf agent symbol symbolicate <addr> [session opts]
```

#### Threads & Memory

```
igf agent thread list [session opts]
igf agent memory dump <addr> <size> [session opts]
igf agent memory scan <pattern> [session opts]
igf agent memory stop-scan [session opts]
igf agent memory ranges [session opts]
igf agent memory info <addr> [session opts]
igf agent lsof [session opts]
```

#### SQLite Database (`sqlite`)

```
igf agent sqlite tables <path> [session opts]
igf agent sqlite dump <path> <table> [session opts]
```

#### Android-Specific (`android`)

```
igf agent android activities [session opts]
igf agent android start-activity <name> [session opts]
igf agent android services [session opts]
igf agent android start-service <name> [session opts]
igf agent android stop-service <name> [session opts]
igf agent android receivers [session opts]
igf agent android send-broadcast <action> [session opts]
igf agent android providers [session opts]
igf agent android provider-query <uri> [session opts]
igf agent android keystore [session opts]
igf agent android keystore-info <alias> [session opts]
igf agent android keystore-cert <alias> [session opts]
igf agent android device-info [session opts]
igf agent android device-props [session opts]
igf agent android resources [session opts]
igf agent android resource <type> <name> [session opts]
igf agent android webview [list|debug|eval|navigate] [session opts]
```

#### iOS-Specific (`ios`)

```
igf agent ios keychain [session opts]
igf agent ios keychain-remove <account> [session opts]
igf agent ios cookies [session opts]
igf agent ios cookies-clear [session opts]
igf agent ios userdefaults [session opts]
igf agent ios userdefaults-update <key> <value> [session opts]
igf agent ios userdefaults-remove <key> [session opts]
igf agent ios webviews [session opts]
igf agent ios webviews-ui [session opts]
igf agent ios webview-eval <handle> <code> [session opts]
igf agent ios webview-navigate <handle> <url> [session opts]
igf agent ios jsc [session opts]
igf agent ios jsc-dump <handle> [session opts]
igf agent ios jsc-run <handle> <code> [session opts]
igf agent ios geolocation <lat> <lng> [session opts]
igf agent ios geolocation-dismiss [session opts]
igf agent ios uidevice [session opts]
igf agent ios open-url <url> [session opts]
igf agent ios ui-dump [session opts]
igf agent ios ui-highlight <addr> [session opts]
igf agent ios ui-dismiss [session opts]
igf agent ios plugins [session opts]
```

#### Script Evaluation

```
igf agent eval '<code>' [session opts]
```

#### React Native (`rn`)

```
igf agent rn arch [session opts]
igf agent rn list [session opts]
igf agent rn inject <handle> <arch> <script> [session opts]
```

#### Native Hooks (`native`)

```
igf agent native list [session opts]
igf agent native hook <module> <name> [session opts]
igf agent native unhook <module> <name> [session opts]
```

---

## Examples

```sh
# List devices
igf device list

# List apps on a device
igf device apps 5c1234

# List directory on Android app
igf agent fs ls / -d 5c1234 --platform droid -b com.example.app

# Start Android TLS validation monitoring
igf agent pin start sslpinning -d 5c1234 --platform droid -b com.example.app

# Inspect a class
igf agent class inspect com.example.MyClass -d 5c1234 --platform droid -b com.example.app

# Query hook logs
igf log hooks 5c1234 com.example.app --limit 50
```

## Session Context

For `agent` commands, you need an active session. The user must specify (or you should infer from context):
- `device` — Frida device ID (from `igf device list`)
- `platform` — `droid` or `fruity`
- `bundle` — app bundle ID (for app mode)

If the user has previously specified these in conversation, reuse them.

## Output Format

- Present JSON results as formatted tables or concise summaries
- For large arrays, show count and first few items
- For errors, show the error message clearly
- When showing file listings, format like `ls -la`
- When showing class info, format methods with signatures