ExecBro

Activate a Pro license using an activation token from your dashboard. Use this if you signed up on the website and need to link your account to this MCP installation.

Send a key event to an Android device/emulator. [PLATFORM-SPECIFIC — no cross-platform equivalent; use when sending Android key events (BACK, HOME, MENU, etc.)] Common keys: HOME, BACK, CALL, END_CALL, VOLUME_UP, VOLUME_DOWN, POWER, CAMERA, CLEAR, TAB, ENTER, DEL, MENU, SEARCH, MEDIA_PLAY_PAUSE, MEDIA_STOP, MEDIA_NEXT, MEDIA_PREVIOUS, MOVE_HOME, MOVE_END, APP_SWITCH, ESCAPE PURPOSE: Dispatch Android system keys (BACK, HOME, MENU, ENTER, DEL, etc.) that aren't reachable via on-screen tap. WHEN TO USE: Navigate back from a screen, submit a form with ENTER, dismiss the keyboard, or press hardware-style keys during a flow.

Launch an app on an Android device/emulator by package name [PLATFORM-SPECIFIC — no cross-platform equivalent; use when launching an Android app by package name] PURPOSE: Start an installed Android app by its package (and optional activity) so the next tool calls hit a running process. WHEN TO USE: After a force-stop or install, or when the app isn't foregrounded before interaction.

List installed packages on an Android device/emulator [PLATFORM-SPECIFIC — no cross-platform equivalent; use when listing installed Android packages] PURPOSE: Enumerate package names visible to adb so you can confirm installation or pick the right target for android_launch_app. WHEN TO USE: Before android_launch_app when you don't know the exact package name, or to verify an install succeeded.

Long press at specific coordinates on an Android device/emulator screen [PLATFORM FALLBACK — prefer `tap({ x, y, duration })` — it long-presses on both platforms and can resolve the target by testID/text/component unless you specifically need native-only behavior] PURPOSE: Emit a sustained touch at raw pixel coordinates to trigger long-press handlers (context menus, drag starts, multi-select). WHEN TO USE: Android-only coordinate holds with no React Native connection. Anything reachable through RN should use `tap({ duration })`, which also reports whether the element has an onLongPress handler.

Take a screenshot from an Android device/emulator. Returns the image plus a screen-state summary: active route (name + navigation stack), overlay-grouped tappable elements (pressables behind an open sheet/modal are excluded), component names as JSX tags, labels, testIDs, and frames — all in ready-to-tap pixel coordinates. Prefer tap(text="...") when text is exact and unique; otherwise use tap(x, y) with coordinates from the list — this is the most reliable way to tap icons or visually-identified elements. Use component names for inspect_component/find_components. PURPOSE: Snapshot what the user sees on Android AND get tap-ready pressables + a structured component map in one call. WHEN TO USE: Any visual verification, before/after comparison, or as the starting point for tapping UI by coordinates on Android. WORKFLOW: android_screenshot -> pick element from pressables -> tap(x, y) or tap(testID=...) -> android_screenshot to verify. LIMITATIONS: Requires adb in PATH and a running device/emulator. For non-RN surfaces (system dialogs, permission prompts), combine with tap(..., native=true). GOOD: android_screenshot() BAD: android_screenshot({ deviceId: "guess" }) with a made-up serial — run list_devices first. SOURCE: to jump from a pixel to the code that renders it, call inspect_at_point(x, y).

Issue an HTTP request from inside the running app, as the logged-in user. PURPOSE: Probe your backend through the app's real network stack, TLS trust and proxy config — without pasting credentials into the conversation. WHEN TO USE: reproduce a 4xx, check what an endpoint returns for an edge case, clean up test records the UI can't reach. WORKFLOW: app_request({ method: "GET", url: "https://api.example.com/me" }) -> inspect status + body. AUTH RESOLUTION (auth="auto", in order): explicit Authorization header -> redux (state.user.accessToken, state.auth.accessToken, state.auth.token) -> the Authorization header of the app's last captured request. That last step is source-agnostic, so it covers tokens kept outside redux — keychain, secure storage, an Apollo link — as long as the app has already made one authenticated call and the SDK captured it. Cookie auth needs none of this: the native cookie jar attaches cookies to any in-app request. LIMITATIONS: needs a connected app. Pass an explicit Authorization only when every step above misses — it puts the credential in the transcript. GOES THROUGH THE APP: same TLS trust, proxy, cookie jar and credentials, so an active network_mock rule intercepts it too. For a clean request from your own machine — to tell a server bug from a client one — use http_request. GOOD: app_request({ method: "DELETE", url: "https://api.example.com/address/17" }) BAD: embedding a bearer token in an execute_in_app expression — it lands in the transcript.

Clear the log buffer. PURPOSE: Empty the in-memory console buffer (and the SDK buffer if installed) so the next get_logs / search_logs only sees fresh entries. WHEN TO USE: Before reproducing a bug so the resulting logs are isolated; between test iterations to avoid noise from earlier runs. WORKFLOW: clear_logs -> reproduce the issue (tap / navigate / reload_app) -> get_logs or search_logs. GOOD: clear_logs() right before tap(text="Submit") BAD: clear_logs() AFTER the repro — you just deleted the evidence.

Clear the network request buffer. PURPOSE: Reset the captured request list to isolate new traffic from a specific user action. WHEN TO USE: Right before reproducing a bug so the buffer contains only the relevant requests. WORKFLOW: clear_network -> trigger action (tap, execute_in_app) -> get_network_requests / search_network. LIMITATIONS: Irreversible — cleared requests cannot be recovered. Also clears the SDK's in-app buffer when SDK is present. GOOD: clear_network() before a reproduction. BAD: Using clear_network as a workaround for stale connections — use scan_metro / ensure_connection instead.

Connect to a Metro server on a specific port — the only way to reach a port scan_metro does not probe. PURPOSE: Establish a CDP WebSocket connection to a Metro server on a known port. WHEN TO USE: Metro is on a port outside 8081-8090. For any port in that range, scan_metro is strictly better — it probes them all and attaches every Bridgeless target in one call, where this connects to one port only. SEE ALSO: scan_metro for auto-discovery; get_apps afterwards to confirm the device attached.

Permanently delete your account and reset this MCP installation. Removes your server-side data and local cache. You will get a new installation ID on next restart. Requires confirm: 'DELETE' to proceed.

Disconnect from Metro servers and stop auto-reconnection. Without device param: disconnects ALL devices. With device param: disconnects only the matching device. Use this to remove stale connections or free the CDP slot for the built-in debugger. Log and network buffers are preserved. Reconnect later with scan_metro. PURPOSE: Cleanly release CDP slots so another debugger (Flipper, React DevTools, Chrome) can attach, or nuke a stale connection the MCP keeps reviving. WHEN TO USE: Before launching a native debugger, when connections keep flapping, or after a simulator/device restart left zombie targets. WORKFLOW: disconnect_metro -> attach other debugger / restart app -> scan_metro to reconnect. LIMITATIONS: Suppresses auto-reconnect until scan_metro or connect_metro is called again; buffers persist but won't receive new events. GOOD: disconnect_metro(); disconnect_metro({ device: "iPhone" }) BAD: Using disconnect_metro to clear logs — use clear_logs instead; disconnect breaks capture.

Blur the currently focused TextInput, dismissing the on-screen keyboard. PURPOSE: Close the keyboard when it's blocking content beneath the input, or move focus off an input before a tap that would otherwise be intercepted. WHEN TO USE: After typing into a field and before tapping a button that is hidden by the keyboard. Or to verify a 'tap outside dismisses' UX is wired up. PREREQUISITE: A TextInput must already have React focus. Tap the field first (e.g. tap({ testID: 'search' })). LIMITATIONS: Requires Bridgeless/Fabric (RN new architecture). With nothing focused it reports the keyboard already down; if the keyboard is up anyway, a native field owns it and only a platform dismiss will close it.

Verify or establish a healthy connection to a React Native app. Use before running commands if connection may be stale, or after navigation/reload. This tool runs a health check and will auto-reconnect if needed. PURPOSE: Health-check the existing CDP connection and transparently reconnect if it has gone stale, without rescanning all Metro ports. WHEN TO USE: After a suspected disconnect (silent gaps, reload_app, app crash) or before long-running flows where a mid-flow drop would be costly. Cheaper than scan_metro when you already connected once this session. WORKFLOW: scan_metro (once) -> ensure_connection(healthCheck=true) -> resume tool calls. Use forceRefresh=true if the first probe still looks dead. GOOD: ensure_connection({ healthCheck: true }) BAD: ensure_connection() before scan_metro has ever run — call scan_metro first.

Execute JavaScript code in the connected React Native app and return the result. Use this for inspecting app state, calling methods on exposed global objects, or running diagnostic code. Hermes compatible: 'global' is automatically polyfilled to 'globalThis', so both global.__REDUX_STORE__ and globalThis.__REDUX_STORE__ work. RECOMMENDED WORKFLOW: 1) list_debug_globals to discover available objects, 2) inspect_global to see properties/methods, 3) execute_in_app to call methods or read values. LIMITATIONS (Hermes engine): - NO require() or import — only pre-existing globals are available - Async: use `Promise.resolve(foo()).then(function(r){ return r; })` (resolved for you when awaitPromise:true). `async`/`await` syntax is engine-dependent — many Hermes builds reject it. - Multi-statement input is auto-wrapped into an IIFE returning the last statement's value. If that can't yield a value (`if`/`for`/declaration), write the IIFE yourself with an explicit `return`. - Non-ASCII in string literals (emoji, Arabic, CJK) is auto-escaped server-side. Write it as-is. GOOD examples: `__DEV__`, `__APOLLO_CLIENT__.cache.extract()`, `__EXPO_ROUTER__.navigate('/settings')` BAD examples: `await fetch(...)` (bare top-level await), `require('react-native')` Pass timeoutMs (ms) for long-running expressions; capped at 120000. Auto-reconnect surfaces _meta.reconnected when a transport drop was self-healed.

Find components matching a name pattern. **TARGETED SEARCH**: Use after get_screen_layout or get_component_tree(structureOnly=true) to find specific components by pattern. Use includeLayout=true to get padding/margin/flex styles. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Fast regex search over the entire fiber tree — including off-screen and wrapper components — to locate every instance of a component by name. WHEN TO USE: You know roughly what the component is called (e.g., "Button", "Screen$") but not where it lives, or you need counts/paths before drilling in with inspect_component. WORKFLOW: get_screen_layout (orient) -> find_components(pattern="...") -> inspect_component(componentName="...", index=N). LIMITATIONS: Matches the React display name only; minified builds may return opaque names. Large result sets — use maxResults or a tighter pattern. GOOD: find_components({ pattern: "Button" }); find_components({ pattern: "Screen$" }) BAD: find_components({ pattern: ".*" }) — floods the response; narrow the regex. SOURCE: searching by name to find a file? If you can point at it on screen, inspect_at_point(x, y) returns the file and line directly.

List currently connected React Native apps and their connection status. If no apps are connected, run scan_metro first to establish a connection. PURPOSE: Enumerate active debug targets with device names, platforms, ports, and detected RN/Expo versions so you can target the right one. WHEN TO USE: After scan_metro to confirm what connected, or before passing a device="..." filter to another tool. WORKFLOW: scan_metro -> get_apps -> get_logs / ios_screenshot / tap (with device="..." if multiple). LIMITATIONS: Only lists devices the MCP has successfully connected to — stale targets don't appear here, use get_connection_status for health details. GOOD: get_apps() BAD: Calling get_apps in a tight loop — the list doesn't change without a scan_metro or disconnect_metro.

Retrieve captured Metro bundling/compilation errors. These are errors that occur during the bundle build process (import resolution, syntax errors, transform errors) that prevent the app from loading. If no errors are captured but Metro is running without connected apps, automatically falls back to screenshot+OCR to capture the error from the device screen. PURPOSE: Surface Metro's build-time failures (not runtime JS errors) that keep the app from booting or hot-reloading. WHEN TO USE: App shows the red error screen, refuses to connect, or Fast Refresh stops working after an edit. Also use when get_logs is silent but the app is clearly broken. WORKFLOW: get_bundle_status -> get_bundle_errors -> fix source -> get_bundle_errors({ clear: true }) -> reload_app. LIMITATIONS: Captures errors Metro emits via its WebSocket; the screenshot+OCR fallback requires a booted simulator and the platform param. GOOD: get_bundle_errors({ platform: "ios" }); get_bundle_errors({ clear: true }) after fixing, so the next read reflects only new errors. BAD: Using get_bundle_errors to look for runtime TypeErrors — those live in get_logs, not the bundler.

Get the current Metro bundler status including build state and any recent bundling errors. Use this to check if there are compilation/bundling errors that prevent the app from loading. PURPOSE: Snapshot Metro's current build state (idle / transforming / error) together with any captured errors — a fast "is the bundler healthy?" check. WHEN TO USE: Before diving into runtime debugging — rules out compile-time failures that would make get_logs and tap pointless. WORKFLOW: get_bundle_status -> if errors present: get_bundle_errors for detail -> fix -> get_bundle_errors({ clear: true }). LIMITATIONS: Relies on Metro's WebSocket event stream; if Metro isn't running or the connection dropped, status may be stale. GOOD: get_bundle_status() at the start of a debug session. BAD: Polling every second — Metro events are push-based; just call once and act on the result.

Get the React component tree from the running app — the fiber hierarchy including providers, navigation wrappers, and internal components. For a screen overview with positions and text, use get_screen_layout instead. Returns compact names-only structure by default; pass structureOnly=false for the full detailed tree. PURPOSE: Expose the entire fiber tree — including providers, navigators, and off-screen subtrees — when get_screen_layout's visible-only view isn't enough. WHEN TO USE: Debugging context propagation, navigation wrappers, hidden modals, or when you need to understand the full React architecture. WORKFLOW: get_component_tree() for overview -> find_components for targeted lookup -> inspect_component for props/state. LIMITATIONS: The detailed tree (structureOnly=false) is very large and routinely exceeds response-size limits on real apps — reach for inspect_component on a specific node instead. Ignores non-React native views. Minified builds return display names that may be opaque. GOOD: get_component_tree() BAD: get_component_tree({ structureOnly: false, includeProps: true, includeStyles: true }) on a large app — prefer inspect_component for specific nodes.

Get detailed connection health status including uptime, recent disconnects/reconnects, and connection gaps that may indicate missing data. PURPOSE: Diagnose flaky CDP sessions — quantify uptime, count reconnects, and expose gaps where logs/network data could be missing. WHEN TO USE: When logs look suspiciously empty, tools complain about disconnect/reconnect, or the app was suspended and resumed. WORKFLOW: get_connection_status -> if unhealthy: disconnect_metro -> scan_metro to rebuild a clean session. LIMITATIONS: Reports only MCP-side view; doesn't know why Metro dropped the socket (simulator sleep, app backgrounded, etc). GOOD: get_connection_status() after noticing stale data. BAD: Polling get_connection_status as a heartbeat — use ensure_connection(healthCheck=true) for a live probe. Pass events=true to include the recent connection event log (connect/close/reconnect lifecycle) — useful when a target drops mid-session and you need to see why reconnect didn't recover it.

Access the shared image buffer containing screenshots from all tools (ios_screenshot, android_screenshot, tap verification). Returns metadata only by default — use id or groupId+frameIndex to retrieve actual image data. Tap burst verification stores frame groups here when burst=true is used. PURPOSE: Retrieve prior screenshots — especially tap burst frames — without re-taking them, for visual diffing or reviewing transient UI states. WHEN TO USE: After tap(burst=true) reports transientChangeDetected, or to compare before/after frames without another screenshot round-trip. WORKFLOW: tap(burst=true) -> note verification.burstGroupId -> get_images(groupId, frameIndex=N) to inspect individual frames. LIMITATIONS: Circular buffer (50 entries) — old images are evicted. Metadata is cheap; fetching image data is not — request specific ids, not bulk. GOOD: get_images({ list: true }); get_images({ groupId: "burst-abc", frameIndex: 2 }) BAD: get_images() with no filter when buffer is full — floods context. Use list:true or last:N first.

Get your installation ID, license tier, and this month's usage against the free cap. Shows the Installation ID (needed to link Pro in the dashboard), current tier, cache validity, and calls used / remaining this month.

Get the full payload of a single log event — complete stack trace, backtrace, or oversized message. PURPOSE: Expand one row from get_logs into its full text. A crash row collapses a 60-line backtrace; this returns all of it. WHEN TO USE: After get_logs shows an event you need to read in full (a crash, an exception, a large payload). WORKFLOW: get_logs -> copy the id (e.g. "n7") -> get_log_details(id="n7"). LIMITATIONS: Ids are valid until that device's buffer rolls over or clear_logs runs, not for the whole server session — call get_logs again to get fresh ones. Reads the buffer — it does not re-query the device. GOOD: get_log_details({ id: "n7" }) BAD: Guessing ids — always take them from get_logs.

Retrieve console logs from connected React Native app. Tip: Use summary=true first for a quick overview (counts by level + last 5 messages), then fetch specific logs as needed. PURPOSE: Pull captured console output (log/warn/error/info/debug) from the in-memory buffer, and optionally native device logs (crashes, ANRs) via source="native". WHEN TO USE: Start of any log-driven investigation, verifying a code change picked up via Fast Refresh, or confirming a reported error actually fires. WORKFLOW: scan_metro -> get_logs(summary=true) -> narrow with search_logs(text="...") or get_logs(level="error") -> clear_logs between reproductions. LIMITATIONS: Circular buffer (~500 entries). Only captures logs emitted after the app connected; pre-connect logs are lost. GOOD: get_logs({ summary: true }) then get_logs({ level: "error", maxLogs: 20 }) BAD: get_logs({ maxLogs: 500, verbose: true }) as a first call — floods context; start with summary=true.

Retrieve captured network requests from connected React Native app. Shows URL, method, status, and timing. Note: On Bridgeless targets (Expo SDK 52+) without the SDK, capture may miss early startup requests. Install execbro-sdk for full capture with headers and response bodies. Tip: Use summary=true first for stats overview. PURPOSE: Inspect HTTP traffic the app made since connection — URLs, methods, status codes, and timings — to debug API, auth, and caching issues. WHEN TO USE: User reports a failed login/load, slow screen, or wrong data. Confirm a request fired, check its status, and pivot to get_request_details for headers/body. WORKFLOW: scan_metro -> reproduce action -> get_network_requests({ summary: true }) -> get_network_requests({ status: 500 }) or search_network -> get_request_details(id). LIMITATIONS: Bridgeless targets without the SDK may miss pre-connect requests and response bodies — install execbro-sdk for full fidelity. GOOD: get_network_requests({ summary: true }) then get_network_requests({ urlPattern: "/login", status: 401 }) BAD: get_network_requests({ maxRequests: 500 }) as the first call — start with summary=true.

Pull-style probe: did the JS runtime accept a Fast Refresh (HMR) update since `since`? Returns lastUpdateAt, updateCount, and recentUpdates from a 32-entry ring buffer fed by a recorder around __ReactRefresh.performReactRefresh (preferred) or \$RefreshReg\$ (fallback). PURPOSE: Confirm an edit landed in the running app without polling logs or screenshots. After editing TSX, wait ~2s then call with `since` = a Date.now() captured BEFORE the edit. updateCount > 0 means Fast Refresh accepted. WHEN TO USE: After editing .tsx/.ts files (prefer over reload_app). To distinguish runtime acceptance (this) from Metro build state (get_bundle_status). FILTER: `since` (epoch ms) keeps entries with at > since. `sincePath` (substring) matches modulePath — available on the \$RefreshReg\$ path but often omitted on performReactRefresh; if so the filter matches nothing — drop it. LIMITATIONS: A full reload resets the buffer (next call reports `recorder just installed`). Edits to non-React utility files still increment. Requires the React 18+ refresh runtime. SEE ALSO: get_bundle_status (did Metro compile?), get_bundle_errors (compile failures), reload_app (force full reload).

Get full details of one network request: headers, body, status, timing. PURPOSE: Drill into a single entry after get_network_requests or search_network returns a suspect id. WORKFLOW: get id -> read the shape -> get_request_details({ requestId, query }) for the subtree you need. SHAPE FIRST: a large JSON body returns as its structure — key paths kept, arrays and objects annotated with real sizes, leaves clipped. The first call already answers 'is there an errors array' and 'does this field exist'. QUERY: dot-path into the JSON body, returned in full. Supports a.b.c, [0], [-1], [*], ["key.with.dots"]. Targets the response body, or the request body when there is none. No match returns the shape plus what IS there — retry from that. SIDES: with a query, only the queried body is rendered (no headers, no other side) — include:"response"/"request"/"both" overrides. Credential headers are redacted to scheme + length; verbose:true prints them. LIMITATIONS: Bodies need the execbro-sdk; CDP-only targets have no response body. Non-JSON is clipped at maxBodyLength, not projected. GOOD: get_request_details({ requestId: "42", query: "data.approvals.single.basicInfo" }) | query: "errors[*].message" BAD: verbose:true to find one field — that is the 40KB dump this avoids. Or guessing requestIds.

Get a screen map showing visible components as an indented tree with actual screen positions. Uses measureInWindow for real coordinates and filters out off-screen components. Returns meaningful component names with text content and frame data (x,y width x height). Coordinates are delivered-screenshot pixels — the same space screenshots, get_screen_state and tap() use, so pass them through unchanged. Use extended=true to include layout styles (padding, margin, flex, backgroundColor, etc.). [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Quickest textual map of what is actually on screen right now — component names, positions, and text — so you can plan taps and inspections without guessing. WHEN TO USE: First step whenever the user asks "what's on screen", "why is X covering Y", or before tapping a visually ambiguous element. WORKFLOW: get_screen_layout -> find_components(pattern="...") or inspect_component(componentName="...") -> tap(testID=...) -> get_screen_layout again to confirm. LIMITATIONS: pass coordinates straight to tap(), which handles conversion — never multiply by devicePixelRatio yourself. GOOD: get_screen_layout({ extended: true }) BAD: get_screen_layout({ summary: true }) when you actually need to pick a specific element — summary hides the tree. SOURCE: file:line for an element? inspect_at_point(x, y).

Screenshot-free snapshot of the current screen: active route + params, blocking overlays (sheets, modals, alerts), and every on-screen element merged top-to-bottom within reachability groups. Call after any tap or navigation to orient before the next action. Each line carries an (x, y) center + frame bounds (so anything is a tap(x, y) target), typed by a leading marker: 🔘 pressable (with component JSX tag, label, testID, onPress hint), 📝 text, 🖼 image (with src/alt). Elements covered by an open overlay are grouped under 🚫 Blocked — visible for context, but taps will NOT reach them until the overlay closes. WHEN TO USE: After every tap/swipe that may navigate, and to read screen content (prices, labels, which image loaded) without a screenshot+OCR round-trip. COORDINATES: delivered-screenshot pixels — the same space as ios_screenshot/android_screenshot, get_screen_layout, inspect_at_point, measure and tap(). Pass them through unchanged; never scale by devicePixelRatio yourself. LIMITATIONS: route is null without React Navigation / Expo Router. Requires a live Metro connection. HISTORY: includeHistory=true appends the route trail (dwell + origin per screen). PARAMS: route params listed by key; fullParams=true adds values. SOURCE: this lists what is on screen, not where it lives in code — for the file:line that renders an element, call inspect_at_point(x, y). SEE ALSO: get_screen_layout for the full component tree; this is a flat, tap-ready content list.

Get recommended workflows and best practices for using the debugging tools. Call without parameters to see all available topics with short descriptions. Call with a topic parameter to get the full guide for that topic.

Issue an HTTP request FROM THE HOST (Node), not through the app, carrying a credential you cannot read. PURPOSE: Isolate server behaviour from client behaviour. This is what curl was for, minus the part where the token and the whole response landed in the transcript. HOW IT DIFFERS FROM app_request: app_request runs inside the app, so it carries the app's TLS trust, proxy, native cookie jar and credentials, and an active network_mock intercepts it. http_request is a clean request from your machine. Pick app_request when the app's real conditions matter, when the session is cookie-authenticated, or when the backend enforces attestation (Firebase App Check cannot be satisfied from Node). Pick http_request to tell a server bug from a client one. CREDENTIALS: pass auth:{secret:"<origin or handle>"} — names come from list_secrets. The value is substituted here and never rendered, and is bound to the origin it was observed on: any other host is refused. Default placement is Authorization: Bearer; set header for a key header (X-API-Key) or scheme for another (Basic). READING THE RESULT: a 401 here where app_request succeeds is itself an answer — the backend is enforcing attestation. GOOD: http_request({ method: "GET", url: "https://api.acme.io/v1/me", auth: { secret: "api.acme.io" } }) BAD: pasting a credential into headers to cover a shape auth does not — that is the transcript leak the vault exists to prevent. Report the gap instead.

Write text into a React Native TextInput, or the OS's currently focused field, and verify it landed. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Set a field's text and confirm, by reading the value back, that it holds exactly what you sent. WHEN TO USE: Any text entry in a React Native app. Pass testID (or component/textMatch) and this focuses the field itself — no separate tap needed. WORKFLOW: get_screen_state -> input_text({ testID, text }) -> read `verified`. VERIFICATION: the write is read back and compared EXACTLY. A mismatch retries once, then fails with `sent` vs `landed`. AMBIGUITY: several matching inputs -> the tool refuses and returns a numbered candidate list; pick one with `index`. NATIVE SCREENS: with no React fiber tree at all (system dialog, native onboarding, non-RN app) this falls back automatically to typing into whatever the OS reports as focused — tap it first. native:true forces that path, and ignores testID/component/textMatch: it cannot target, only type into what already has focus. LIMITATIONS: fields with no onChangeText fall back to the platform driver, which is US-keyboard only — non-ASCII fails there. The native path shares that limit. GOOD: input_text({ testID: "new-topic-title", text: "Q3 budget", replace: true }) GOOD: input_text({ text: "1234", native: true }) — a system PIN prompt, no RN screen behind it. BAD: input_text({ text: "..." }) with nothing focused — pass a target instead.

Inspect layout AND props at (x, y). Returns FRAME PER ANCESTOR (position/size in delivered-screenshot pixels, the same space as screenshots/get_screen_state/tap, for every ancestor that hit-tested the point) + the innermost component's PROPS (handlers as [Function], refs, custom props like onPress/data/testID). Pure JS hit-test via fiber + measureInWindow — no overlay toggled, zero visual side effect. Works on Paper and Fabric. PURPOSE: Layout/props diagnosis — "where is each ancestor positioned, and what props does the touched component expose?" WHEN TO USE: A button is clipped, hit area is wrong, animated frame is unexpected — or you need handler/ref/non-style props. Also preferred for tight loops (no overlay flicker). WORKFLOW: screenshot or get_screen_state → take the coordinate as-is → inspect_at_point(x, y). LIMITATIONS: Style is the node's own style object, not the merged cascade. `frame` is the element's own box; `hitFrame` (when present) is the innermost node actually under the point. SOURCE: also returns `source: {file, line, column}` for the component at the point, plus the owner chain as `Source ancestors` (set source=false to skip in tight loops).

Inspect a specific React component by name. **DRILL-DOWN TOOL**: Use after get_screen_layout or find_components to identify which component to inspect. Returns props, style, state (hooks), and optionally children tree. Use childrenDepth to control how deep nested children go. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Reveal a mounted component's live props, hook state, and (optionally) child subtree so you can reason about why it renders the way it does. WHEN TO USE: User asks "why is this button disabled", "what props does X receive", or you need to confirm state changed after a tap. WORKFLOW: get_screen_layout or find_components -> inspect_component(componentName="Foo") -> tap or execute_in_app to change state -> inspect_component again. LIMITATIONS: Requires the component to be currently mounted in the fiber tree. Name matching is exact; use find_components for fuzzy/regex lookup. GOOD: inspect_component({ componentName: "SneakerCard", index: 0 }) BAD: inspect_component({ componentName: "Card" }) when many Card instances exist — pass index or narrow via find_components.

Inspect a global object (or a dotted path into one) to see its properties, types, and whether they are callable functions. Use this BEFORE calling methods on unfamiliar objects to avoid errors. PURPOSE: Surface the shape of a global (Apollo client, Redux store, Expo Router, SDK-registered store, etc.) — keys, types, and which members are callable — without executing arbitrary code. WHEN TO USE: After list_debug_globals identifies a promising global and before you try execute_in_app on it. WORKFLOW: list_debug_globals -> inspect_global(objectName="__APOLLO_CLIENT__") -> execute_in_app("__APOLLO_CLIENT__.cache.extract()"). DOTTED PATHS: Pass dotted paths to drill into the SDK surface, e.g. inspect_global({ objectName: "__RN_AI_DEVTOOLS__.stores.redux" }) or "__RN_AI_DEVTOOLS__.custom.mmkv". Only identifier paths are accepted — for arbitrary expressions, use execute_in_app. LIMITATIONS: Only reads one level deep; nested objects show as a 100-char JSON preview — re-inspect the child path. Returns an error object (not a throw) when the path doesn't resolve. WIDE OBJECTS: a global with hundreds of keys is bounded structurally rather than dumped; use query to pull one entry in full. GOOD: inspect_global({ objectName: "__APOLLO_CLIENT__" }) | inspect_global({ objectName: "__RN_AI_DEVTOOLS__.stores.redux", query: "cache" }) BAD: inspect_global({ objectName: "store.getState()" }) — call expressions aren't supported; use execute_in_app.

Boot an iOS simulator by UDID. PURPOSE: Bring a specific simulator online so you can install/launch an app in it. WHEN TO USE: At session start when no simulator is running, or after switching between device models. [PLATFORM-SPECIFIC — no cross-platform equivalent; use when booting an iOS simulator] Use list_devices to find available simulators.

Press a hardware button on an iOS simulator. [PLATFORM-SPECIFIC — no cross-platform equivalent; use when pressing iOS hardware buttons (HOME, LOCK, SIRI, APPLE_PAY)] Requires an iOS UI driver: AXe (recommended: brew install cameroncooke/axe/axe) or IDB (brew install idb-companion). PURPOSE: Trigger iOS hardware buttons (HOME, LOCK, SIDE_BUTTON, SIRI, APPLE_PAY) that aren't reachable via on-screen tap. WHEN TO USE: Send the app to background (HOME), lock the simulator (LOCK), or exercise Siri/Apple Pay flows.

Launch an app on an iOS simulator by bundle ID [PLATFORM-SPECIFIC — no cross-platform equivalent; use when launching an iOS app by bundle ID] PURPOSE: Start an installed iOS app by its bundle ID so the next tool calls hit a running process. WHEN TO USE: After ios_terminate_app or an install, or when the app isn't foregrounded before interaction.

Open a URL in the iOS simulator (opens in default handler or Safari). PURPOSE: Drive an iOS simulator into a deep link or universal link entry point so you can exercise routing from an external entry. WHEN TO USE: Testing deep-link handlers, universal link routing, OAuth/SSO callback URLs, or any flow that enters the app via a URL. WORKFLOW: ios_boot_simulator -> ios_launch_app (or have the app running) -> ios_open_url -> ios_screenshot / get_screen_layout to verify the target screen rendered. GOOD: ios_open_url(url="myapp://product/42") to land directly on a product screen. BAD: ios_open_url(url="...") used as a substitute for in-app navigation when the user would normally tap — prefer `tap` for normal interaction flows. [PLATFORM-SPECIFIC — no cross-platform equivalent; use when testing iOS deep links or universal links]

Take a screenshot from an iOS simulator. Returns the image plus a screen-state summary: active route (name + navigation stack), overlay-grouped tappable elements (pressables behind an open sheet/modal are excluded), component names as JSX tags, labels, testIDs, and frames — all in ready-to-tap pixel coordinates. Prefer tap(text="...") when text is exact and unique; otherwise use tap(x, y) with coordinates from the list — this is the most reliable way to tap icons or visually-identified elements. Use component names for inspect_component/find_components. PURPOSE: Snapshot what the user sees on iOS AND get tap-ready pressables + a structured component map in one call. WHEN TO USE: Any visual verification, before/after comparison, or as the starting point for tapping UI by coordinates. WORKFLOW: ios_screenshot -> pick element from pressables -> tap(x, y) or tap(testID=...) -> ios_screenshot to verify. PHYSICAL DEVICES: a USB-attached iPhone/iPad works too (pass its UDID or name from list_devices) — capture only, via pymobiledevice3. No pressables, no tap/swipe/input_text: iOS has no touch injection below 17. LIMITATIONS: Otherwise requires a booted iOS simulator (simctl). For system dialogs without RN, combine with tap(..., native=true). GOOD: ios_screenshot() BAD: ios_screenshot({ udid: "guess" }) with a made-up UDID — run list_devices first. SOURCE: to jump from a pixel to the code that renders it, call inspect_at_point(x, y) — it returns the absolute file and line.

Terminate a running app on an iOS simulator [PLATFORM-SPECIFIC — no cross-platform equivalent; use when force-terminating an iOS app] PURPOSE: Force-kill an iOS app process so the next launch starts from a cold state. WHEN TO USE: To reset app state fully (beyond what reload_app does), or before reinstalling a new build.

List globally available debugging objects in the connected app (Apollo, Redux, React DevTools, etc.). PURPOSE: Enumerate the app's globalThis.* surface so you know which stores, clients, and debug hooks you can drill into. WHEN TO USE: Start of a state-debugging session, or when you don't know whether the app exposes a Redux/Apollo/Zustand handle. WORKFLOW: list_debug_globals -> inspect_global(objectName="...") -> execute_in_app for reads/mutations. SDK INTEGRATION: When init({ stores, navigation, custom }) from execbro-sdk (formerly react-native-ai-devtools-sdk) was called, the response includes an sdk.paths array of dotted paths (e.g. __RN_AI_DEVTOOLS__.stores.redux). Pass them to inspect_global or execute_in_app. RN NAMESPACE: The rn field reports globalThis.__rn__ — a curated set of seven RN modules (I18nManager, PixelRatio, Platform, StyleSheet, AppRegistry, NativeModules, Dimensions) populated by SDK exposeRnGlobals() or the executor's fallback bootstrap. Use paths like __rn__.Platform.OS. rn=null → bootstrap not yet run; keys=[] → ran but no match. OUTPUT: { sdk: {...}|null, rn: {keys, hint}|null, categories: {...} } LIMITATIONS: Only sees variables explicitly assigned to a global. Module-scoped state is invisible — expose it first or use the SDK.

List every iOS simulator, Android emulator, and connected physical device on the host machine, in one structured response. PURPOSE: Single discovery entry point. Returns booted+shutdown iOS sims (from simctl), running+stopped Android emulators (from `emulator -list-avds` cross-referenced with `adb devices`), and attached physical devices. Each row is enriched with `rnConnected` when an RN app from get_apps matches the same identifier. WHEN TO USE: Before tap/swipe to pick a device, when a tool reports an ambiguous-device error, or to check whether a simulator is booted before targeting it. WORKS WITHOUT RN: No Metro connection required. Safe to call before scan_metro. WORKFLOW: list_devices -> tap({ device: '<udid-or-serial-or-name>', ... }) SEE ALSO: get_apps for RN-specific connection details (RN version, JS engine, network capture mode).

List the credentials this session has captured, by handle. Values are never shown. PURPOSE: Find the name to pass to http_request({ auth: { secret } }), and see at a glance which entries have expired. WHAT YOU GET: handle, kind, the origin it was seen on, age, and JWT expiry where the token carries one. Nothing derived from the token's claims — a JWT's issuer and subject are self-asserted, so they are not reported. LIMITATIONS: memory only. A server restart empties the vault, and a handle from an older transcript resolves to nothing. GOOD: list_secrets() -> http_request({ url: "https://api.acme.io/v1/me", method: "GET", auth: { secret: "api.acme.io" } })

Interact with React Native's LogBox overlay (dev mode only). Actions: "dismiss" clears all entries and returns their content. "push" displays a message in the LogBox error banner (visible to the developer watching the device). "ignore" adds patterns to suppress future LogBox entries for this session. "detect" reads current LogBox state without modifying it. Only works in __DEV__ mode — LogBox does not exist in production builds. PURPOSE: Control RN's on-device red/yellow overlay — clear it when it blocks UI, suppress noisy repeats, or push a message back to the developer. WHEN TO USE: Screenshot/tap reports LogBox is obstructing the screen, an error banner prevents interaction, or you want to surface info to the dev watching the simulator. WORKFLOW: logbox(action="detect") -> if present: logbox(action="dismiss") to read + clear -> continue UI work. Use action="ignore" with patterns to stop repeat noise. LIMITATIONS: Dev-only — no effect in production builds. "push" at level="warning" won't show a banner unless LogBox is already open. GOOD: logbox({ action: "dismiss" }); logbox({ action: "ignore", patterns: ["[APOLLO]"] }) BAD: Spamming logbox(action="push") for every tool step — annoys the developer.

Get on-screen geometry {x, y, width, height} for a named React component instance. Calls measureInWindow on the matched fiber (or its nearest host descendant for composite components). Coordinates are delivered-screenshot pixels, the same space as screenshots, get_screen_layout, get_screen_state, inspect_at_point and tap(). PURPOSE: One-shot, name-based component measurement — avoids hand-rolling fiber walks and Promise-wrapping measureInWindow callbacks in execute_in_app. WHEN TO USE: You already know the component's display name (from get_screen_layout or find_components) and just need its current bounds — e.g. to verify a layout change, compute a tap target, or compare against design specs. WORKFLOW: find_components(pattern="...") -> measure(componentName="...", index=N) -> tap(x, y) at the center, or inspect_at_point at the center to verify identity. LIMITATIONS: Returns post-layout on-screen geometry only — for static style use find_components({ includeLayout: true }). For point-based lookup use inspect_at_point. Off-screen fibers may return zeros; that's the truth, not an error. Composites with multiple host descendants return the first host descendant's bounds. GOOD: measure({ componentName: "SneakerCard", index: 0 }) BAD: measure({ componentName: "View" }) — too generic; narrow with find_components first. SEE ALSO: inspect_at_point for point-based variant; find_components({ includeLayout: true }) for static style.

Navigate the app's router directly, and verify it actually moved. PURPOSE: Jump to a screen without tapping through the UI, with a settled before/after route check. WHY THIS EXISTS: hand-written router calls report success whenever nothing throws. A path sent to a React Navigation ref changes nothing and warns only in LogBox, so a no-op reads as a success. DESTINATIONS ARE NOT INTERCHANGEABLE: Expo Router takes paths ("/event-details?id=1"); React Navigation takes route names ("TarotNav"). The response reports which router resolved. Unknown React Navigation names are rejected before dispatch, with nearest-match suggestions. WORKFLOW: navigate({ to: "/settings" }) -> check changed -> get_screen_state. LIMITATIONS: push/replace are unavailable on a React Navigation root ref (stack-scoped). changed=false means it settled without moving; indeterminate=true means no settled reading. DISCOVERY: navigate({ routeTable: true }) with no destination just LISTS the registered route names — call it first when you do not know them. GOOD: navigate({ to: "TarotNav" }); navigate({ action: "back" }); navigate({ routeTable: true }) BAD: navigate({ to: "/TarotNav" }) on React Navigation — that is a path, not a route name.

Simulate offline or slow network for the running app. PURPOSE: Reach the offline / timeout branches through the app's real code. WHEN TO USE: 'what does this screen do with no network', 'is there a loading state', 'does the retry banner appear'. WORKFLOW: network_condition({mode:"offline"}) -> reproduce -> network_condition({mode:"normal"}). OFFLINE also patches NetInfo when installed, because many apps gate their offline UI on useNetInfo() rather than on a failed request. The result reports netInfo as patched / reads-patched-only / not-installed. Request failure works regardless. LIMITATIONS: JS-originated HTTP only. Does not change the device's real connectivity. Leaves network_mock rules untouched. GOOD: network_condition({mode:"slow", latencyMs:3000}) BAD: forgetting network_condition({mode:"normal"}) afterwards — it survives reload_app.

Intercept the app's HTTP requests and replace or modify the response. PURPOSE: Drive the app down an error path through its REAL code — the request builder, the error branch, the retry, the toast. redux_dispatch writes the post-failure state directly and skips all of it. WHEN TO USE: 'what does this screen do on a 500', 'what if this field is null', 'does the retry work'. WORKFLOW: network_mock({action:"add", url:"/orders", status:500}) -> reproduce -> get_network_requests (rows show [MOCK m1]) -> network_mock({action:"clear"}). MODES: replace returns a canned response; tamper fetches the real one and mutates it (set/remove take dotted paths). MATCHING: url is a substring by default; wrap it in slashes for a regex ("/\\/orders\\/\\d+$/"). First matching rule wins, so add specific rules before broad ones. LIMITATIONS: JS-originated HTTP only — native-module traffic (native SDKs, <Image> loading) is not intercepted. Rules are per-device and survive reload_app; clear them when done. GOOD: network_mock({action:"add", url:"/orders", mode:"tamper", remove:["data.email"]}) BAD: leaving a rule active and then debugging why the app 'always fails' — check network_mock({action:"list"}) hit counts first.