# io.github.hoainho/podium-mcp (npm · podium-mcp)

Mobile E2E MCP (51 tools): iOS + Android, native UI + canvas/WebGL, no-vision, RN debug

- Trust score: 67/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `podium-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp.md), [page](https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp)

## Channel facts

- Registry: `npm`
- Package: `podium-mcp`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 20 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 7562 tokens (~148/item across 51 items; 51 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 96% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add hoainho-podium-mcp -- npx -y podium-mcp
```

### Codex

```bash
codex mcp add hoainho-podium-mcp -- npx -y podium-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hoainho-podium-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "podium-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add hoainho-podium-mcp --command npx --arg -y --arg podium-mcp
```

### Hermes

```yaml
mcp_servers:
  hoainho-podium-mcp:
    command: "npx"
    args: ["-y", "podium-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "hoainho-podium-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "podium-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 63, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 19, +14)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −39)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 44, +20)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (51)

### `podium_health` (~80 tokens)

Returns health status of the podium-mcp server and toolchain availability. Scope: iOS (simulator + real device), Android (emulator + real via adb), game-engine (Unity/GL via AltTester), and no-vision canvas/WebGL automation. macOS + Xcode required; adb for Android, an instrumented build for engine tools.

### `device_list` (~77 tokens)

Returns a merged inventory of available iOS simulators (udid, name, state, runtime) plus any adb-detected Android devices. If adb is absent, the android section reports availability: false instead of failing. NOTE: Android entries are detection-only — podium's automation tools (tap/inspect/etc.) currently target iOS simulators.

### `device_boot` (~66 tokens)

Boots an iOS simulator by UDID. Waits up to 30 seconds for the boot command to complete. Idempotent: booting an already-booted device returns ok with alreadyBooted:true.

Input parameters:

- `udid` (string, required): Simulator UDID (from device_list)

### `app_install` (~63 tokens)

Installs an app on an iOS simulator. Accepts a path to a .app directory or a .zip archive.

Input parameters:

- `path` (string, required): Path to the .app directory or .zip file to install
- `udid` (string, required): Simulator UDID

### `app_launch` (~51 tokens)

Launches an app on an iOS simulator by bundle ID.

Input parameters:

- `bundleId` (string, required): App bundle identifier (e.g. com.example.MyApp)
- `udid` (string, required): Simulator UDID

### `app_terminate` (~45 tokens)

Terminates a running app on an iOS simulator by bundle ID.

Input parameters:

- `bundleId` (string, required): App bundle identifier
- `udid` (string, required): Simulator UDID

### `screenshot` (~84 tokens)

Takes a screenshot of an iOS simulator. Returns the saved file path and byte size. Does NOT return base64 to keep payload small. saveTo defaults to a .png file in os.tmpdir().

Input parameters:

- `saveTo` (string): Destination file path (must end .png or .jpg). Defaults to a tmp file.
- `udid` (string, required): Simulator UDID

### `open_url` (~48 tokens)

Opens a URL on an iOS simulator (deep-links, https:// etc.).

Input parameters:

- `udid` (string, required): Simulator UDID
- `url` (string, required): URL to open on the simulator

### `set_location` (~78 tokens)

Sets the simulated GPS location on a running iOS simulator. Codifies the QA geo-spinner fix: use this to unblock location-gated features during QA testing without moving the physical device.

Input parameters:

- `latitude` (number, required): Latitude in decimal degrees
- `longitude` (number, required): Longitude in decimal degrees
- `udid` (string, required): Simulator UDID

### `app_list` (~51 tokens)

Returns the list of installed apps on a booted iOS simulator. Includes bundle ID, display name, and application type (User/System).

Input parameters:

- `udid` (string, required): Simulator UDID (from device_list)

### `app_uninstall` (~55 tokens)

Uninstalls an app from an iOS simulator by bundle ID.

Input parameters:

- `bundleId` (string, required): App bundle identifier to uninstall (e.g. com.example.MyApp)
- `udid` (string, required): Simulator UDID

### `screen_size` (~45 tokens)

Returns the pixel dimensions of a booted iOS simulator screen by taking a temp screenshot and reading its pixel dimensions with sips.

Input parameters:

- `udid` (string, required): Simulator UDID

### `orientation_get` (~55 tokens)

Returns the current orientation of a booted iOS simulator. Queries the native backend (mobilecli) when available for an exact answer; otherwise derives it from the screenshot aspect ratio.

Input parameters:

- `udid` (string, required): Simulator UDID

### `record_start` (~73 tokens)

Starts a screen recording on a booted iOS simulator. The recording runs in a detached background process. Call record_stop to finalize and retrieve the file.

Input parameters:

- `saveTo` (string): Destination file path (must end .mp4). Defaults to a tmp file.
- `udid` (string, required): Simulator UDID

### `record_stop` (~54 tokens)

Stops the active screen recording for an iOS simulator. Sends SIGINT to flush the video file, waits for the file size to stabilize, and returns the path and size.

Input parameters:

- `udid` (string, required): Simulator UDID

### `inspect_screen` (~205 tokens)

Returns the current view hierarchy for a booted iOS simulator (podium's target platform). Uses idb's flat accessibility tree when idb is installed (fast), else maestro hierarchy. Defaults to compact:true — a flattened list of only the nodes that carry text / accessibility labels / resource-ids (dramatically smaller than the raw tree). Pass compact:false for the full nested hierarchy. LIMITATION: WebView (WKWebView/WebView) content is opaque — the hierarchy shows a single WebView node with no children. Web-rendered buttons, inputs, and labels are invisible to this tool. For WebView apps, identify elements visually via screenshot then calculate logical-point coordinates (screenshot pixels ÷ device scale factor, typically ÷3 on 3× Retina).

Input parameters:

- `compact` (boolean): Return a flattened list of meaningful nodes only (default true). false = full nested tree.
- `udid` (string, required): Simulator / device UDID (from device_list)

### `tap_on` (~341 tokens)

Tap, double-tap, or long-press an element on screen via an ephemeral Maestro flow. Target by text (regex), accessibility id, or absolute x/y coordinates. bundleId is REQUIRED — Maestro needs it for the appId flow header. WebView caution: text/id selectors only resolve native accessibility nodes. Web-rendered elements inside WKWebView are invisible — tap_on will report COMPLETED but nothing is tapped. Use x+y coordinates instead for WebView content.

Input parameters:

- `bundleId` (string, required): App bundle identifier (e.g. com.example.MyApp). Required by Maestro.
- `double` (boolean): Use doubleTapOn instead of tapOn
- `id` (string): Accessibility ID of the element
- `index` (integer): Zero-based index when multiple elements match
- `long` (boolean): Use longPressOn instead of tapOn
- `longDurationMs` (integer): Hold duration for long press in ms (max 10 000)
- `noLaunch` (boolean): Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
- `text` (string): Element text or regex. Matches the FULL label/value case-insensitively (anchored ^…$); an invalid regex falls back to a substring match.
- `timeoutMs` (integer): Flow timeout in ms (default 30 000)
- `udid` (string, required): Simulator / device UDID
- `x` (number): X coordinate in logical points (numeric only; percent strings are not supported)
- `y` (number): Y coordinate — required when x is provided

### `input_text` (~177 tokens)

Types text into the currently-focused element via an ephemeral Maestro flow. Set submit:true to press Enter after typing. Note: Android does not support Unicode via inputText. WebView caveat: inputText injects at the native buffer level — React onChange/onChangeText never fires. For WebView forms use mobile-mcp mobile_type_keys (real keystroke simulation) instead.

Input parameters:

- `bundleId` (string, required): App bundle identifier
- `noLaunch` (boolean): Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
- `submit` (boolean): Press Enter after typing (default false)
- `text` (string, required): Text to type
- `timeoutMs` (integer): Flow timeout in ms
- `udid` (string, required): Simulator / device UDID

### `swipe` (~183 tokens)

Swipes in a direction or between two coordinates via an ephemeral Maestro flow. direction is always required; startX/startY/endX/endY are optional overrides expressed as percentage strings (e.g. '10%,50%') or pixel values.

Input parameters:

- `bundleId` (string, required): App bundle identifier
- `direction` (string, required): Swipe direction
- `endX` (string): End X
- `endY` (string): End Y
- `noLaunch` (boolean): Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
- `startX` (string): Start X (e.g. '10%' or '120')
- `startY` (string): Start Y
- `timeoutMs` (integer): Flow timeout in ms
- `udid` (string, required): Simulator / device UDID

### `press_key` (~157 tokens)

Presses a hardware or system key via an ephemeral Maestro flow on the iOS simulator. Note: back/power/tab are Android key events and have no effect on iOS — they remain in the enum for a future Android backend. Valid keys: enter, home, lock, backspace, volume up, volume down, back, power, tab

Input parameters:

- `bundleId` (string, required): App bundle identifier
- `key` (string, required): Key to press
- `noLaunch` (boolean): Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
- `timeoutMs` (integer): Flow timeout in ms
- `udid` (string, required): Simulator / device UDID

### `orientation_set` (~155 tokens)

Sets the screen orientation on an iOS simulator via an ephemeral Maestro flow. bundleId is required (Maestro needs it for the appId flow header). Valid values: PORTRAIT, LANDSCAPE_LEFT, LANDSCAPE_RIGHT, UPSIDE_DOWN

Input parameters:

- `bundleId` (string, required): App bundle identifier
- `noLaunch` (boolean): Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
- `timeoutMs` (integer): Flow timeout in ms
- `udid` (string, required): Simulator / device UDID
- `value` (string, required): Target orientation: PORTRAIT | LANDSCAPE_LEFT | LANDSCAPE_RIGHT | UPSIDE_DOWN

### `tap_with_fallback` (~319 tokens)

Sends a raw coordinate tap via the native backend (idb if installed, else a Maestro tapOn-point fallback). Useful for WKWebView game overlays where visual position differs from the DOM hit-test position. The Maestro fallback needs an app context: pass bundleId, or the foreground app is auto-detected. VERIFICATION: 'ok' is decided primarily by a change in the native accessibility element set before/after the tap (stable under animation/video). When no native backend is present it falls back to a screenshot byte-size delta (weak — animation can flip it). The result's `oracle` field reports which was used ('a11y-change' | 'screenshot-bytesize' | 'unverified'). For WebView-rendered targets the a11y tree won't change → oracle:'unverified'; confirm via webview_inspect. offsetStep defaults to 0 (tap the exact point); set it >0 only to deliberately probe nearby y-offsets on retry.

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (ignored when idb is present). Auto-detected if omitted.
- `maxRetries` (integer): Maximum tap attempts (default 3)
- `offsetStep` (number): Opt-in Y offset step in px applied per retry (default 0 = always tap the exact point; no blind walk).
- `udid` (string, required): Simulator / device UDID
- `x` (number, required): X coordinate in logical points
- `y` (number, required): Y coordinate in logical points

### `notification_bar_clear` (~153 tokens)

Attempts to dismiss the React Native debug notification bar that sometimes appears at the bottom of the screen and intercepts taps. Taps the debug icons area at (50, 850) via the native backend (idb, else Maestro) and takes a before/after screenshot. NOTE: the (50,850) tap point is a device-specific heuristic, and 'cleared' is decided by a screenshot byte-size delta — a best-effort signal, not a guarantee (see tap_with_fallback caveat).

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (ignored when idb is present). Auto-detected if omitted.
- `udid` (string, required): Simulator / device UDID

### `run_steps` (~346 tokens)

Execute an ordered batch of UI actions in ONE call via the native backend (idb/mobilecli, sub-second; Maestro fallback per step). Eliminates per-gesture MCP round-trips for fast continuous flows (login, navigation, form fill). Step actions: tap {x,y} · tapText {text|id} · type {text,submit} · key · swipe · waitFor {text,timeoutMs} · assertVisible {text} · waitMs · screenshot. Prefer `waitFor` over `waitMs` to act the instant the UI is ready instead of sleeping. WebView note: web-rendered text is invisible to tapText — use tap {x,y} for it; `type` uses real keystrokes so React onChange fires. Stops at the first failed step unless stopOnError:false. bundleId is only needed for the Maestro fallback (auto-detected otherwise). When to use: pick run_steps for >2 known sequential gestures (login, navigation, form fill); use run_flow for Maestro assertions/conditionals/loops/retries; use the individual gesture tools (tap_on, swipe, …) for a single exploratory action.

Input parameters:

- `bundleId` (string): App bundle id for Maestro fallbacks (auto-detected from the foreground app if omitted).
- `stepDelayMs` (integer): Optional fixed delay inserted after every step (default 0).
- `steps` (array, required): Ordered list of actions to perform.
- `stopOnError` (boolean): Stop at the first failed step (default true). false = run all and report each.
- `udid` (string, required): Simulator / device UDID (from device_list)

### `run_flow` (~262 tokens)

Execute one or more Maestro flows on a device. Provide exactly one of: yaml (inline YAML string), files (array of flow file paths), or dir (directory path). includeTags and excludeTags are only applicable when using dir. When to use: run_flow gives the full Maestro vocabulary (assertions, conditionals, loops, retries); for a simple sequence of taps/types prefer run_steps, and for one gesture use the individual tools. TRUST BOUNDARY: Maestro flows can run arbitrary JS (evalScript) and local files (runScript/files/dir), so treat run_flow input as locally-executable code.

Input parameters:

- `dir` (string): Directory containing .yaml flow files
- `env` (object): Environment variables passed to the flow
- `excludeTags` (array): Exclude flows tagged with these tags (dir mode only)
- `files` (array): Array of .yaml flow file paths
- `includeTags` (array): Only run flows tagged with these tags (dir mode only)
- `timeoutMs` (integer): Flow timeout in milliseconds (default 120 000)
- `udid` (string, required): Simulator / device UDID (from device_list)
- `yaml` (string): Inline Maestro YAML flow string (preferred for exploration)

### `export_flow` (~141 tokens)

Exports a run_steps action sequence to a reusable Maestro flow (the engineer→QA bridge). Selector-based steps (tapText by id/text, key, swipe-by-direction, waitFor, assertVisible, screenshot) transpile cleanly. The lossy steps — coordinate tap/swipe, focused-field type, regex tapText — are emitted as commented '# TODO[unstable]' lines plus a warnings[] list, never as silently divergent YAML. Fix the TODOs to make the flow durable regression.

Input parameters:

- `bundleId` (string, required): App bundle id for the flow's appId header
- `steps` (array, required): The run_steps action array to transpile

### `cheat_sheet` (~43 tokens)

Returns the bundled Maestro flow script cheat sheet (offline copy). Consult this before authoring unfamiliar Maestro commands, required args, nested properties, conditionals, or multi-screen flows.

### `metro_apps` (~66 tokens)

Lists React Native apps currently connected to a Metro bundler inspector. Returns CDP-style targets (id, title, webSocketDebuggerUrl). Returns a structured error if Metro is not running on the given port.

Input parameters:

- `port` (integer): Metro dev server port (default 8081)

### `metro_logs` (~189 tokens)

Reads console logs from a React Native app via the Metro CDP debugger. If webSocketDebuggerUrl is omitted, auto-discovers via metro_apps and uses the first connected app. Reports which app was chosen. Pass saveTo to also write the console timeline to a file for evidence (e.g. attach to a bug).

Input parameters:

- `durationMs` (integer): How long to collect logs in milliseconds (default 3000)
- `maxLogs` (integer): Maximum number of log entries to return (default 100, keeps most recent)
- `port` (integer): Metro port for auto-discovery (default 8081)
- `saveTo` (string): Optional file path; writes the console timeline (one line per entry: [level ts] text) for evidence.
- `webSocketDebuggerUrl` (string): CDP WebSocket URL from metro_apps. Omit to auto-discover.

### `metro_network` (~306 tokens)

Captures network requests from a React Native app via the Metro CDP debugger (Network domain). If webSocketDebuggerUrl is omitted, auto-discovers via metro_apps and uses the first connected app. Pairs requestWillBeSent with responseReceived by requestId (method, url, status, headers, timing). format:'har' emits a valid HAR 1.2 log (HAR-lite — no response bodies yet) you can open in Chrome DevTools → Import HAR; pass saveTo to write the .har file. Sensitive headers (authorization/cookie/…) are REDACTED by default — set redact:false to keep them (don't commit unredacted HAR: it leaks tokens).

Input parameters:

- `durationMs` (integer): How long to capture network activity in milliseconds (default 3000)
- `format` (string): Output format: 'json' (default, structured entries) or 'har' (HAR 1.2 log).
- `maxEntries` (integer): Maximum request entries to return (default 100, keeps most recent)
- `port` (integer): Metro port for auto-discovery (default 8081)
- `redact` (boolean): Mask sensitive headers (authorization/cookie/set-cookie/…). Default true.
- `saveTo` (string): Optional file path to write the output (a .har file when format:'har').
- `webSocketDebuggerUrl` (string): CDP WebSocket URL from metro_apps. Omit to auto-discover.

### `metro_state` (~186 tokens)

Reads app state from a React Native app by evaluating a JS expression in its runtime via the Metro CDP debugger (Runtime.evaluate, returnByValue). Default expression reads a globally-exposed Redux store; override `expression` to read any in-app value. The app must expose the value on a global the runtime can reach. Auto-discovers the ws via metro_apps when omitted.

Input parameters:

- `expression` (string): JS expression to evaluate (default: a globally-exposed Redux store's getState()). e.g. "store.getState().user" or "globalThis.__APP_STATE__".
- `port` (integer): Metro port for auto-discovery (default 8081)
- `timeoutMs` (integer): Evaluation timeout in ms (default 5000)
- `webSocketDebuggerUrl` (string): CDP WebSocket URL from metro_apps. Omit to auto-discover.

### `crash_list` (~112 tokens)

Lists crash reports (.ips/.crash) from ~/Library/Logs/DiagnosticReports — plus the simulator's own container DiagnosticReports when udid is given — sorted newest first. Filter by processName (case-insensitive substring) and/or sinceHours.

Input parameters:

- `processName` (string): Case-insensitive substring to filter by process name
- `sinceHours` (number): Only include crashes from the last N hours
- `udid` (string): Simulator UDID — also scans that sim's container DiagnosticReports

### `crash_get` (~105 tokens)

Reads a crash report by its id (filename from crash_list). For .ips files returns a parsed JSON header and the report body (first ~8000 chars, truncated flag set if longer). Pass the same udid used for crash_list to also resolve sim-container reports. Path-traversal-safe.

Input parameters:

- `id` (string, required): Crash report filename (id from crash_list)
- `udid` (string): Simulator UDID — also looks in that sim's container DiagnosticReports

### `app_state` (~91 tokens)

Checks whether an app is installed and/or running on an iOS simulator. installed: exact bundle-id match against the parsed simctl listapps output; running: matches the launchctl UIKitApplication:<bundleId> label on a token boundary (no prefix false positives).

Input parameters:

- `bundleId` (string, required): App bundle identifier (e.g. com.example.MyApp)
- `udid` (string, required): Simulator UDID

### `webview_inspect` (~220 tokens)

Lists embedded WebViews (WKWebView) on a booted simulator and, for the selected one, resolves a CSS selector to DOM elements WITH absolute on-screen tap coordinates. This is the answer to the 'WebView content is opaque' limitation of the coordinate tools: instead of eyeballing a screenshot, get tapX/tapY for a real DOM element and feed it straight into tap_on. Defaults to interactive elements when no selector is given. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

Input parameters:

- `max` (integer): Maximum elements to return (default 100)
- `selector` (string): CSS selector (default: 'button, a, input, textarea, [role=button]')
- `udid` (string, required): Simulator / device UDID (from device_list)
- `webviewId` (string): Target WebView id (from a prior call). Omit to auto-select the first visible WebView.

### `webview_eval` (~158 tokens)

Evaluates a JavaScript expression in a WebView's page context and returns the result. Use it to read web-app state (location.href, store values, feature flags, on-screen balances) or to assert conditions against the live DOM. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

Input parameters:

- `expression` (string, required): JavaScript expression to evaluate, e.g. "location.href" or "document.querySelectorAll('button').length"
- `udid` (string, required): Simulator / device UDID
- `webviewId` (string): Target WebView id. Omit to auto-select the first visible WebView.

### `webview_navigate` (~130 tokens)

Drives a WebView's navigation: goto a URL, or back / forward / reload. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

Input parameters:

- `action` (string, required): Navigation action. 'goto' requires url.
- `udid` (string, required): Simulator / device UDID
- `url` (string): Destination URL (required when action is 'goto')
- `webviewId` (string): Target WebView id. Omit to auto-select the first visible WebView.

### `webview_network` (~447 tokens)

Captures HTTP traffic made INSIDE a WebView (fetch + XMLHttpRequest) and exports it as JSON or a redacted HAR 1.2 log. This is the network-debugging path for WebView-based apps — RN shells that host their UI in a WKWebView, where the API calls run in the web layer so metro_network (CDP Network domain) captures nothing. It injects a fetch/XHR recorder into the page, captures for durationMs while you drive the app, then returns request/response metadata (url, method, status, headers, timing). Only requests made AFTER capture starts are recorded. format:'har' emits a valid HAR 1.2 log (HAR-lite — no response bodies) openable in Chrome DevTools → Import HAR; pass saveTo to write the .har file. Sensitive headers (authorization/cookie/…) and request bodies are REDACTED by default — set redact:false to keep them (don't commit unredacted HAR: it leaks tokens). Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

Input parameters:

- `durationMs` (integer): How long to capture (ms) while you drive the app (default 5000)
- `format` (string): Output format: 'json' (default, structured entries) or 'har' (HAR 1.2 log).
- `includeResources` (boolean): Also include the browser's retroactive Performance Resource Timing list — EVERY request the document made since navigation, including ones that fired before capture started (URL + timing + size, but…
- `redact` (boolean): Mask sensitive headers (authorization/cookie/…) and request bodies. Default true.
- `saveTo` (string): Optional file path to write the output (a .har file when format:'har').
- `udid` (string, required): Simulator / device UDID
- `webviewId` (string): Target WebView id. Omit to auto-select the first visible WebView.

### `assert_visible` (~197 tokens)

Asserts an element/text is visible, via the oracle ladder (WebView-DOM > native a11y > Maestro). Passes only when a capable oracle confirms presence; if the surface is a WebView whose DOM can't be read (isInspectable=false), returns an 'unverifiable' error instead of a false pass. Provide text (any surface) or selector (WebView).

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (native surface)
- `contains` (boolean): Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
- `selector` (string): CSS selector — WebView surfaces only
- `text` (string): Visible text to match (native a11y / WebView innerText)
- `timeoutMs` (integer): Poll budget (default 3000)
- `udid` (string, required): Simulator UDID

### `assert_text` (~113 tokens)

Asserts the given text is visible on screen (by-text shorthand for assert_visible). Same oracle ladder + unverifiable handling.

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (native surface)
- `contains` (boolean): Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
- `text` (string, required): Visible text to assert
- `timeoutMs` (integer)
- `udid` (string, required): Simulator UDID

### `assert_not_visible` (~185 tokens)

Asserts an element/text is ABSENT. FAILS CLOSED: if absence cannot be verified (e.g. a WebView whose DOM is unreadable — native a11y is blind to web content), returns an 'unverifiable' error rather than a false pass. Passes only when a capable oracle confirms absence.

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (native surface)
- `contains` (boolean): Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
- `selector` (string): CSS selector — WebView surfaces only
- `text` (string): Visible text to match (native a11y / WebView innerText)
- `timeoutMs` (integer): Confirmation budget (default 1500)
- `udid` (string, required): Simulator UDID

### `wait_for_element` (~154 tokens)

Polls until an element/text is visible (via the oracle ladder), or fails on timeout. Use to act the instant the UI is ready instead of a blind sleep.

Input parameters:

- `bundleId` (string): App bundle id for the Maestro fallback (native surface)
- `contains` (boolean): Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
- `selector` (string): CSS selector — WebView surfaces only
- `text` (string): Visible text to match (native a11y / WebView innerText)
- `timeoutMs` (integer): Wait budget (default 10000)
- `udid` (string, required): Simulator UDID

### `validate_flow` (~247 tokens)

Returns a trustworthy, evidenced verdict on whether a just-implemented flow works. Runs your visibility assertions through the oracle ladder (WebView-DOM > native a11y > Maestro; fail-closed on unverifiable) AND auto-checks app health: no recent crash, no error-level Metro logs, no failed (≥400) network requests. ok=true only when ALL assertions pass AND all applicable auto-checks are clean — never a bare 'looks ok'. State the expected outcome as assertions; this tool makes the AI's 'it works' auditable.

Input parameters:

- `assertions` (array): Expected-outcome assertions (≥1 recommended)
- `bundleId` (string): App bundle id (Maestro fallback)
- `checkCrashes` (boolean): Auto-check recent crashes (default true)
- `checkLogs` (boolean): Auto-check error-level console logs (default true)
- `checkNetwork` (boolean): Auto-check failed network requests (default true)
- `metroPort` (integer): Metro port for log/network checks (default 8081)
- `sinceSeconds` (integer): Crash-recency window in seconds (default 120)
- `udid` (string, required): Simulator UDID

### `engine_inspect` (~119 tokens)

Lists game-engine (Unity/GL) objects matching a selector, each with absolute screen coordinates for tapping — DOM-like addressing with NO vision. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

Input parameters:

- `by` (string): Selector kind (default: name)
- `udid` (string, required): Device UDID / Android serial
- `value` (string, required): Selector value (object name, hierarchy path, component, or text)

### `engine_tap` (~98 tokens)

Taps a game-engine object resolved by selector (engine-reported screen coords, no vision). Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

Input parameters:

- `by` (string)
- `udid` (string, required): Device UDID / Android serial
- `value` (string, required): Selector value identifying the object to tap

### `engine_swipe` (~118 tokens)

Swipes between two screen coordinates inside a game-engine view. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

Input parameters:

- `durationMs` (integer): Swipe duration in ms (default 300)
- `fromX` (number, required)
- `fromY` (number, required)
- `toX` (number, required)
- `toY` (number, required)
- `udid` (string, required): Device UDID / Android serial

### `engine_call` (~142 tokens)

Invokes a C# component method on a game-engine object by reflection — the engine analog of firing a DOM event handler. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

Input parameters:

- `by` (string)
- `component` (string, required): Component (script) name, e.g. ScoreController
- `method` (string, required): Method name to invoke
- `parameters` (array): Method parameters (default none)
- `udid` (string, required): Device UDID / Android serial
- `value` (string, required): Selector value identifying the object

### `canvas_inspect` (~199 tokens)

Lists canvas/WebGL objects (Pixi/Konva/Fabric/Phaser/Three/Babylon) as DOM-like elements with tap-ready coordinates — NO screenshot/vision. Optionally filter by selector (name/id/text/type/role). Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

Input parameters:

- `by` (string): Selector kind to filter by (omit to list all)
- `udid` (string, required): Simulator / device UDID (from device_list)
- `value` (string): Selector value (required when 'by' is given)
- `webviewId` (string): Target WebView id. Omit to auto-select the first visible one.

### `canvas_resolve` (~198 tokens)

Resolves a fuzzy intent (e.g. "close", "settings", "✕") to a ranked, EVIDENCED canvas target without tapping — the 'close brain'. Returns the best match, all candidates with reasons, and a fail-closed confidentEnough flag (false when two targets tie). NO vision. Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

Input parameters:

- `intent` (string, required): What you want to act on, e.g. "close", "play", "settings"
- `udid` (string, required): Simulator / device UDID
- `webviewId` (string): Target WebView id. Omit to auto-select.

### `canvas_tap` (~213 tokens)

Resolves an intent to a single canvas target and TAPS it at absolute screen coordinates — the native-like 'close this' for canvas UIs. Fail-closed: if no confident, unambiguous match exists it does NOT tap and returns the candidates so you can disambiguate. NO vision. Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

Input parameters:

- `bundleId` (string): App bundle id (only used for the Maestro tap fallback)
- `intent` (string, required): What to tap, e.g. "close", "play", or an exact object name
- `udid` (string, required): Simulator / device UDID
- `webviewId` (string): Target WebView id. Omit to auto-select.

### `podium_token_report` (~162 tokens)

Quantifies Podium's token savings: for an N-step flow, computes input tokens for Podium's no-vision structured flow vs a screenshot/vision loop, the savings ratio, and the fixed per-request tool-definition overhead. Heuristic estimates (~4 chars/token text, ~750 px/token image) — deterministic, no network.

Input parameters:

- `elementsPerStep` (integer): Structured elements returned per step (default 20)
- `screenshotHeight` (integer): Vision-loop screenshot height px (default 2556)
- `screenshotWidth` (integer): Vision-loop screenshot width px (default 1179)
- `steps` (integer): Flow length (default 8)
- `toolCount` (integer): Registered tool count for the overhead estimate (default 51)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 63
- 2026-08-01: 19
- 2026-07-31: 5
- 2026-07-30: 44
- 2026-07-28: 24
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/podium-mcp
- Socket report: https://socket.dev/npm/package/podium-mcp
- Repository: https://github.com/hoainho/podium-mcp
- Changelog RSS feed: https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/hoainho-podium-mcp/podium-mcp