Skip to Content
Alpha — full Android pipeline + iOS toolkit + live dynamic loop. API still shifting; pin to commits in CI.
ReferenceCLI reference

CLI reference

Auto-generated from the live Click command tree at build time. If a flag isn’t listed here it doesn’t exist — either add it to the source or stop looking. To verify locally:

mnexus --help

mnexus

🔱 MEDUSA NEXUS — unified mobile threat analysis. Run with no args for the interactive REPL.

mnexus <subcommand>
flagtypedefaultdescription
--versionBOOLEANFalseShow the version and exit.

mnexus dev

Dev mode: install deps if needed, start server with reload, stream status.

mnexus dev
flagtypedefaultdescription
--hostTEXT127.0.0.1
--portINTEGER8765

mnexus doctor

Verify every engine is installed, reachable, and not lying about its version.

mnexus doctor

mnexus mcp-serve

Run as an MCP (Model Context Protocol) stdio server — wire MedusaNexus into Claude Desktop / Cursor / Zed.

mnexus mcp-serve
flagtypedefaultdescription
--api-baseTEXTOverride the local Nexus API base URL (default: http://127.0.0.1:8765  or $MNEXUS_API_BASE).

mnexus play-account

Manage stored Play identities (the account manager that backs play-scan).

mnexus play-account <subcommand>

mnexus play-account add

Register a Play identity. Pass —password to mint the AAS token from email+password.

mnexus play-account add
flagtypedefaultdescription
--name / -nTEXTSentinel.UNSETShort handle for this identity (alphanumeric / - / _ only).
--email / -eTEXTSentinel.UNSETGmail address tied to the account.
--aas / -aTEXTAAS master token. Omit to use —password mode.
--password / -pTEXTPassword / app password; minted to AAS via /auth and not stored.
--notesTEXTFree-form note (e.g. ‘qa rig’, ‘research-2026-q2’).
--defaultBOOLEANFalseMark this account as the default for /play-scan.

mnexus play-account delete

Remove a stored account by name.

mnexus play-account delete <name>

mnexus play-account list

Show stored Play identities (no token values are echoed).

mnexus play-account list

mnexus play-account show

Show one account’s metadata (token is redacted).

mnexus play-account show <name>

mnexus play-account use

Mark <name> as the default account for /play-scan.

mnexus play-account use <name>

mnexus play-scan

Stream an APK from Google Play and scan for Firebase / credential leaks.

mnexus play-scan <package>
flagtypedefaultdescription
--apkPATHLocal APK file to scan instead of fetching from Play.
--account / -ATEXTStored Play identity to scan as (default: the one flagged default).
--no-probesBOOLEANFalseSkip the active Firebase / Firestore / Storage probes (offline mode).

mnexus repl

Open the interactive REPL (default when run with no args).

mnexus repl

mnexus report

Generate a report — every template ships a Mitigation Playbook.

mnexus report
flagtypedefaultdescription
--projectTEXTSentinel.UNSET
--templateCHOICEtechnical
--formatCHOICEmarkdown
--outputPATHSentinel.UNSET

mnexus scan

Static scan: ingest an APK, run every static engine, build the attack surface.

mnexus scan <apk_path>
flagtypedefaultdescription
--packageTEXTTarget package name (auto-detected if omitted).
--versionTEXTVersion name (auto-detected if omitted).

mnexus serve

Start the FastAPI backend + serve the web UI. Local-first by default.

mnexus serve
flagtypedefaultdescription
--hostTEXT127.0.0.1
--portINTEGER8765
--reloadBOOLEANFalseAuto-reload on file changes (dev only).

mnexus vphone

super-tart-vphone control (research-only).

mnexus vphone <verb> <rest>