Tool
Grapefruit
Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.
- Targets
- App
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Requires a Frida server running on the target device, set up through Frida's iOS or Android guides; the reviewed release works with Frida 16 or 17 (default 17).
- Reviewed release: v1.1.2 (npm package igf), published 2026-03-30. The npm package requires Node.js >=22.18.0 and is not compatible with bunx; prebuilt binaries cover macOS arm64/x64, Linux x64 and Windows x64. The server binds to localhost port 31337 by default; the default-branch README warns that it has no built-in authentication.
- Optional AI features, including hook-script generation, use an LLM configured through LLM_* environment variables: Anthropic, OpenAI, Gemini, OpenRouter or an OpenAI-compatible endpoint such as local Ollama. Prompts are sent to the configured endpoint.
- Upstream deliberately ships no Frida-detection, certificate-pinning or jailbreak/root-detection bypasses and suggests combining it with dedicated bypass tooling for authorized assessments. The default branch was 47 commits ahead of v1.1.2 and adds Dart AOT snapshot exploration that the release README does not list. MIT-licensed.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · ChiChou/grapefruit · Revision b7176b4
- package.json GitHub · ChiChou/grapefruit · Revision b7176b4
- src/lib/env.ts GitHub · ChiChou/grapefruit · Revision b7176b4
- docs/llm.md GitHub · ChiChou/grapefruit · Revision b7176b4
- LICENSE GitHub · ChiChou/grapefruit · Revision b7176b4
- https://github.com/ChiChou/grapefruit/releases/tag/v1.1.2
- README.md GitHub · ChiChou/grapefruit · Revision 05852a9