Agent-ready workflow · mobile

Mobile API and Deep-Link Intake

Normalize approved mobile traffic, deep links, app links, identity bindings, and API operations with build provenance.

mobileapideep-linkoauthclient-config
Stable IDworkflow:mobile-api-deep-linkSource record dateHuman reviewNot recordedProvenanceCurated workflow graph

Enter with artifacts, leave with evidence.

Use when
  • Android app
  • iOS app
  • deep link
  • mobile-only API
  • embedded client ID
Prerequisites
  • owned device or emulator
  • approved build
  • controlled accounts
  • mobile testing in scope
MCP retrieval

Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.

01

Record the build and platform

Capture package, version, signing identity, install source, platform, device, and configuration artifacts.

Inputs
  • approved app build
Outputs
  • build manifest
Evidence gate
Every observation is tied to one app and platform build.
Negative control
Platform behavior is separated from app behavior.
Stop condition
No bypass of device or account ownership controls.
02

Normalize mobile traffic

Map API operations, WebSockets, certificate behavior, tokens, client IDs, and device identifiers.

Inputs
  • controlled mobile traffic
Outputs
  • operation inventory
  • identity binding map
Evidence gate
Sensitive values are redacted while references remain reproducible.
Negative control
Background OS and third-party SDK traffic is excluded.
Stop condition
Do not weaken other apps or device security.
04

Validate server enforcement

Test one mobile API or identity boundary with paired controlled accounts or devices.

Inputs
  • known-good mobile request
Outputs
  • paired server evidence
Evidence gate
The finding exists at the server or app trust boundary, not just in client UI.
Negative control
The legitimate device or owner path still succeeds.
Stop condition
Use controlled records and reversible state.

Continue with the right depth.

References