Deeplinkfuzz

pip install cognis-deeplinkfuzz

deeplinkfuzz scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ deeplinkfuzz-emit --version
deeplinkfuzz 0.1.0

$ deeplinkfuzz-emit --help
usage: deeplinkfuzz [-h] [--version] [--format {table,json}] {fuzz} ...

Enumerate deep links / intents from an Android manifest and replay mutated payloads to find injection bugs in exported entry points.

positional arguments:
  {fuzz}
    fuzz                fuzz a manifest for deep-link injection bugs

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --format {table,json}
                        output format (default: table)

examples:
  # Fuzz a manifest and print a table of findings (exit 1 if any found)
  deeplinkfuzz fuzz AndroidManifest.xml

  # JSON for CI pipelines / piping into jq
  deeplinkfuzz fuzz AndroidManifest.xml --format json | jq '.findings'

  # Only fail the build on high/critical issues
  deeplinkfuzz fuzz AndroidManifest.xml --min-severity high

  # Include components that are not exported (audit mode)
  deeplinkfuzz fuzz AndroidManifest.xml --include-unexported

Blocks above are real deeplinkfuzz output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"timestamp": "2023-02-15T14:30:00Z",
"platform": "stix",
"findings": [
    {
        "id": "1234567890abcdef",
        "title": "Suspicious Network Traffic",
        "description": "Unusual network traffic detected from IP 192.168.1.100",
        "objects": [
            {
                "id": "object-1",
                "type": "indicator",
                "name": "Malicious IP Address",
                "value": "192.168.1.100"
            }
        ]
    },
    {
        "id": "2345678901cdefg",
        "title": "Compromised User Account",
        "description": "User account 'john.doe' has been compromised",
        "objects": [
            {
                "id": "object-2",
                "type": "indicator",
                "name": "Compromised User Account",
                "value": "john.doe"
            }
        ]
    }
]
}

Usage — step by step

1. Install the CLI:

   pip install deeplinkfuzz
   

2. Fuzz an AndroidManifest.xml for deep-link injection and component-hijack bugs (use - to read from stdin):

   deeplinkfuzz fuzz AndroidManifest.xml
   

3. Widen or narrow the scan — include unexported components and set a severity floor:

   deeplinkfuzz fuzz AndroidManifest.xml --include-unexported --min-severity medium
   

4. Read the output. The global --format json flag emits a structured findings report:

   deeplinkfuzz --format json fuzz AndroidManifest.xml > findings.json
   

5. Wire it into CI to block merges on new deep-link findings:

   deeplinkfuzz fuzz app/src/main/AndroidManifest.xml --min-severity high || exit 1
   

Contents

• Why deeplinkfuzz? · Features · Quick start · Example · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why deeplinkfuzz?

Deep-link/intent vulns are a top mobile bug-bounty payout class with no dedicated fuzzer; deeplinkfuzz auto-enumerates exported entry points and replays mutated payloads in CI.

deeplinkfuzz is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Parse Manifest

• ✅ Enumerate Entry Points

• ✅ Build Deep Link

• ✅ Mutate

• ✅ Detect Vulnerabilities

• ✅ Fuzz Manifest

• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer

• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Quick start

pip install cognis-deeplinkfuzz

deeplinkfuzz --version

deeplinkfuzz scan .                       # scan current project

deeplinkfuzz scan . --format json         # machine-readable

deeplinkfuzz scan . --fail-on high        # CI gate (non-zero exit)

Example

$ deeplinkfuzz scan .

  [HIGH    ] DEE-001  example finding             (./src/app.py)

  [MEDIUM  ] DEE-002  another signal              (./config.yaml)



  2 findings · risk score 5 · 38ms

Architecture

flowchart LR
  IN[input] --> P[deeplinkfuzz<br/>analyze + score]
  P --> OUT[report]

Use it from any AI stack

deeplinkfuzz is interoperable with every popular way of using AI:

• MCP server — deeplinkfuzz mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)

• OpenAI-compatible / JSON — pipe deeplinkfuzz scan . --format json into any agent or LLM

• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line

• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

| | Cognis deeplinkfuzz | Drozer (Android attack surface) + scheme-fuzzing techniques from mobile pentest playbooks |

|---|:---:|:---:|

| Self-hostable, no account | ✅ | varies |

| Single command, zero config | ✅ | ⚠️ |

| JSON + SARIF for CI | ✅ | varies |

| MCP-native (AI agents) | ✅ | ❌ |

| Polyglot ports (JS/Go/Rust) | ✅ | ❌ |

| Open license | ✅ COCL | varies |

Built in the spirit of Drozer (Android attack surface) + scheme-fuzzing techniques from mobile pentest playbooks, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (deeplinkfuzz mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/deeplinkfuzz.git"    # pip (works today)

pipx install "git+https://github.com/cognis-digital/deeplinkfuzz.git"   # isolated CLI

uv tool install "git+https://github.com/cognis-digital/deeplinkfuzz.git" # uv

pip install cognis-deeplinkfuzz                                          # PyPI (when published)

docker run --rm ghcr.io/cognis-digital/deeplinkfuzz:latest --help        # Docker

brew install cognis-digital/tap/deeplinkfuzz                             # Homebrew tap

curl -fsSL https://raw.githubusercontent.com/cognis-digital/deeplinkfuzz/main/install.sh | sh

| Linux | macOS | Windows | Docker | Cloud |

|---|---|---|---|---|

| scripts/setup-linux.sh | scripts/setup-macos.sh | scripts/setup-windows.ps1 | docker run ghcr.io/cognis-digital/deeplinkfuzz | DEPLOY.md (AWS/Azure/GCP/k8s) |

Related Cognis tools

• apkpeek — One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.

• ipasnitch — Static scanner for iOS .ipa bundles that flags ATS exceptions, missing entitlements hardening, embedded URLs/secrets, and weak Info.plist transport settings.

• hookcraft — Generates ready-to-run Frida instrumentation scripts from a YAML intent (e.g. 'bypass SSL pinning', 'dump crypto keys') and verifies they attach to a target process.

• dastlite — A headless, config-as-code DAST runner that crawls an authenticated web/mobile-API surface and fires a curated active-scan ruleset, emitting deduplicated SARIF.

• semsift — Lightweight semantic-aware SAST that runs curated taint rules over diffs only, so PRs get fast incremental SAST instead of whole-repo scan fatigue.

• cheatsense — Anti-cheat telemetry analyzer that ingests game session logs and flags statistically anomalous input/aim/movement signatures with explainable per-flag scoring.

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If deeplinkfuzz saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---