Agent-ready workflow · mobile
Mobile API and Deep-Link Intake
Normalize approved mobile traffic, deep links, app links, identity bindings, and API operations with build provenance.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- Android app
- iOS app
- deep link
- mobile-only API
- embedded client ID
Prerequisites
- owned device or emulator
- approved build
- controlled accounts
- mobile testing in scope
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Record the build and platform
Capture package, version, signing identity, install source, platform, device, and configuration artifacts.
Inputs
- approved app build
Outputs
- build manifest
- Evidence gate
- Every observation is tied to one app and platform build.
- Negative control
- Platform behavior is separated from app behavior.
- Stop condition
- No bypass of device or account ownership controls.
Normalize mobile traffic
Map API operations, WebSockets, certificate behavior, tokens, client IDs, and device identifiers.
Inputs
- controlled mobile traffic
Outputs
- operation inventory
- identity binding map
- Evidence gate
- Sensitive values are redacted while references remain reproducible.
- Negative control
- Background OS and third-party SDK traffic is excluded.
- Stop condition
- Do not weaken other apps or device security.
Map deep-link routing
Record schemes, app or universal links, route parameters, authentication requirements, and fallback behavior.
Inputs
- manifest and observed links
Outputs
- deep-link matrix
- Evidence gate
- Each route is tested on the correct build and auth state.
- Negative control
- Unknown schemes and unauthorized states fail safely.
- Stop condition
- No links delivered to uncontrolled users.
Validate server enforcement
Test one mobile API or identity boundary with paired controlled accounts or devices.
Inputs
- known-good mobile request
Outputs
- paired server evidence
- Evidence gate
- The finding exists at the server or app trust boundary, not just in client UI.
- Negative control
- The legitimate device or owner path still succeeds.
- Stop condition
- Use controlled records and reversible state.
Related methods
Continue with the right depth.
Sources