Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.hypothesi/mcp-server-tauri

NPM · @HYPOTHESI/TAURI-MCP-SERVER · SCANNED AUG 3

A Model Context Protocol server for use with Tauri v2 applications

+21 this week 71 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security71
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.6.1, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (44 of 45), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to hypothesi/mcp-server-tauri). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 28 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4077 tokens (~203/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 94% of tool parameters carry a description.Partial
Capabilities20
  • Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @hypothesi/tauri-mcp-server

# add to Claude Code
claude mcp add hypothesi-mcp-server-tauri -- npx -y @hypothesi/tauri-mcp-server
# add to Codex CLI
codex mcp add hypothesi-mcp-server-tauri -- npx -y @hypothesi/tauri-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hypothesi-mcp-server-tauri": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@hypothesi/tauri-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add hypothesi-mcp-server-tauri --command npx --arg -y --arg @hypothesi/tauri-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  hypothesi-mcp-server-tauri:
    command: "npx"
    args: ["-y", "@hypothesi/tauri-mcp-server"]
// mcp.json
{
  "mcpServers": {
    "hypothesi-mcp-server-tauri": {
      "command": "npx",
      "args": [
        "-y",
        "@hypothesi/tauri-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Aug 26 +7
    • Known CVEs: fail → unverified security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Schema quality: 100 → unverified functional
    • Dependency health: partial → unverified functional
    • Tool coverage: 100 → unverified functional
    • Capabilities: fail → unverified functional
    • Schema quality: unverified → excellent functional
    • Stability: unverified → 0.23 functional
  • 1 Aug 26 +31
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 −18
    • Malware scan: pass → unverified security
  • 27 Jul 26 50

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@hypothesi/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
hypothesi/mcp-server-tauri
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/hypothesi/mcp-server-tauri/.github/workflows/release.yml@refs/tags/v0.12.0
Rekor log index:
2083298335
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:05e25bf63d4360c614c6aa790b45ffdb564f6d9c254af5a407bd9d4096755d7f4295851cb05564c4789b18cf94b60b3c0e34e92b16cbf8d016edddc40
Discovery method:
attestation_endpoint
Vulnerabilities 3 findings
ID CVE Severity Vector Fix available
GHSA-w48q-cv73-mx4w CVE-2025-66414 high yes
GHSA-58qx-3vcg-4xpx CVE-2026-45736 medium CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N yes
GHSA-96hv-2xvq-fx4p CVE-2026-48779 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
Dependencies 44 packages

44 packages in the resolved dependency tree · 41 deprecated · 22 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 20 exposed · ~4,077 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
driver_session ~293

[Tauri Apps Only] Start/stop automation session to connect to a RUNNING Tauri app. Supports multiple concurrent app connections - each app runs on a unique port. The most recently connected app becomes the "default" app used when no appIdentifier is specified. Use action "status" to check connection state: returns single app format when 1 app connected, or array format with "isDefault" indicator when multiple apps connected. Action "stop" without appIdentifier stops ALL sessions; with appIdentifier stops only that app. The identifier field (e.g., "com.example.myapp") uniquely identifies each app. REQUIRED before using other webview_* or ipc_* tools. Connects via WebSocket to the MCP Bridge plugin in the Tauri app. For browser automation, use Chrome DevTools MCP instead. For Electron apps, this tool will NOT work.

NameTypeReqDescription
actionstringyesAction to perform: start or stop the session, or check status
appIdentifierstring|numberApp identifier (port number or bundle ID) to stop. Only used with action "stop". If omitted, stops all sessions.
hoststringHost address to connect to (e.g., 192.168.1.100). Falls back to MCP_BRIDGE_HOST or TAURI_DEV_HOST env vars
portnumberPort to connect to (default: 9223)

No output schema declared.

No examples provided.

get_setup_instructions ~101

Get instructions for setting up or updating the MCP Bridge plugin in a Tauri project. Call this tool when: (1) driver_session fails to connect, (2) you detect the plugin is not installed or outdated, or (3) the user asks about setup. Returns step-by-step guidance that you should follow to help the user configure their project. IMPORTANT: The instructions require you to examine the project first and ask for permission before making any changes.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

ipc_emit_event ~97

[Tauri Apps Only] Emit a Tauri event to test event handlers. Requires active driver_session. Events are Tauri-specific (not DOM events). For browser DOM events, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
eventNamestringyes
payload

No output schema declared.

No examples provided.

ipc_execute_command ~100

[Tauri Apps Only] Execute Tauri IPC commands (invoke Rust backend functions). Requires active driver_session. This is Tauri-specific IPC, not browser APIs. For Electron IPC or browser APIs, use appropriate tools for those frameworks.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
args
commandstringyes

No output schema declared.

No examples provided.

ipc_get_backend_state ~83

[Tauri Apps Only] Get Tauri backend state: app metadata, Tauri version, environment. Requires active driver_session. Use to verify you're connected to a Tauri app and get app info.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.

No output schema declared.

No examples provided.

ipc_get_captured ~98

[Tauri Apps Only] Get captured Tauri IPC traffic (requires ipc_monitor started). Shows captured commands (invoke calls) and events with arguments and responses. For browser network requests, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
filterstringFilter events by command name

No output schema declared.

No examples provided.

ipc_monitor ~103

[Tauri Apps Only] Monitor Tauri IPC calls between frontend and Rust backend. Requires active driver_session. Captures invoke() calls and responses. This is Tauri-specific; for browser network monitoring, use Chrome DevTools MCP.

NameTypeReqDescription
actionstringyesAction to perform: start or stop IPC monitoring
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.

No output schema declared.

No examples provided.

list_devices ~56

[Tauri Mobile Apps Only] List Android emulators/devices and iOS simulators. Use for Tauri mobile development (tauri android dev, tauri ios dev). Not needed for desktop-only Tauri apps or web projects.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

manage_window ~241

[Tauri Apps Only] Manage Tauri windows. Actions: "list" - List all windows with labels, titles, URLs, and state. "info" - Get detailed info for a window (size, position, title, focus, visibility). "resize" - Resize a window (requires width/height, uses logical pixels by default). Requires active driver_session. For browser windows, use Chrome DevTools MCP instead.

NameTypeReqDescription
actionstringyesAction: "list" all windows, get "info" for one window, or "resize" a window
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
heightintegerHeight in pixels (required for "resize" action)
logicalbooleanUse logical pixels (true, default) or physical pixels (false). Only for "resize"
widthintegerWidth in pixels (required for "resize" action)
windowIdstringWindow label to target (defaults to "main"). Required for "info", optional for "resize"

No output schema declared.

No examples provided.

read_logs ~208

[Tauri Apps Only] Read logs from various sources: "console" for webview JS logs, "android" for logcat, "ios" for simulator logs, "system" for desktop logs. Requires active driver_session for console logs. Use for debugging Tauri app issues at any level.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID for console logs. Defaults to the only connected app or the default app if multiple are connected.
filterstringRegex or keyword to filter logs
linesnumber
sincestringISO timestamp to filter logs since (e.g. 2023-10-27T10:00:00Z)
sourcestringyesLog source: "console" for webview JS logs, "android" for logcat, "ios" for simulator, "system" for desktop
windowIdstringWindow label for console logs (defaults to "main")

No output schema declared.

No examples provided.

webview_dom_snapshot ~357

[Tauri Apps Only] Get a structured DOM snapshot of a Tauri app's webview. Supports different snapshot types for AI consumption. The "accessibility" type returns a YAML representation of the accessibility tree similar to Playwright's aria snapshots, including roles, names, states, and element refs. Use this for understanding UI semantics, finding interactive elements, or accessibility testing. The "structure" type returns a YAML representation of the DOM hierarchy with element tag names, IDs, CSS classes, and data-testid attributes (if present). Use this for understanding page layout, debugging CSS selectors, or locating elements by class/ID. Use the optional selector parameter to scope the snapshot to a subtree. The selector supports CSS (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
selectorstringSelector to scope the snapshot: CSS selector (default), XPath, text content, or ref ID. If omitted, snapshots entire document.
strategystringSelector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (…
typestringyesSnapshot type
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_execute_js ~251

[Tauri Apps Only] Execute JavaScript in a Tauri app's webview context. Requires active driver_session. Has access to window.__TAURI__. If you need a return value, it must be JSON-serializable. For functions that return values, use an IIFE: "(() => { return 5; })()" not "() => { return 5; }". Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser JS execution, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
argsarrayArguments to pass to the script
scriptstringyesJavaScript code to execute in the webview context. If returning a value, it must be JSON-serializable. For functions that return values, use IIFE syntax: "(() => { return value; })()" not "() => { re…
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_find_element ~278

[Tauri Apps Only] Find DOM elements in a running Tauri app's webview. Supports CSS selectors (default), XPath expressions, and text content matching via the strategy parameter. The "text" strategy first searches element text content, then falls back to placeholder, aria-label, and title attributes. Returns the element's HTML. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser pages or documentation sites, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
selectorstringyesThe selector to find: CSS selector (default), XPath expression, text content, or ref ID (e.g., "ref=e3"). Interpretation depends on strategy.
strategystringSelector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (…
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_get_pointed_element ~179

[Tauri Apps Only] Retrieves element metadata for an element the user previously pointed at via Alt+Shift+Click in the Tauri app. Returns the same rich metadata as webview_select_element (tag, id, classes, attributes, text, bounding rect, CSS selector, computed styles, parent chain) plus an annotated screenshot. The user must Alt+Shift+Click an element first before calling this tool. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_get_styles ~273

[Tauri Apps Only] Get computed CSS styles from elements in a Tauri app. Supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser style inspection, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
multiplebooleanWhether to get styles for all matching elements (true) or just the first (false)
propertiesarraySpecific CSS properties to retrieve. If omitted, returns all computed styles
selectorstringyesElement selector: CSS selector (default), XPath expression, text content, or ref ID
strategystringSelector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (…
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_interact ~387

[Tauri Apps Only] Click, scroll, swipe, focus, or perform gestures in a Tauri app webview. Supported actions: click, double-click, long-press, scroll, swipe, focus. Supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. For browser interaction, use Chrome DevTools MCP instead.

NameTypeReqDescription
actionstringyesType of interaction to perform
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
durationnumberDuration in ms for long-press or swipe (default: 500ms for long-press, 300ms for swipe)
fromXnumberStarting X coordinate for swipe
fromYnumberStarting Y coordinate for swipe
scrollXnumberHorizontal scroll amount in pixels (positive = right)
scrollYnumberVertical scroll amount in pixels (positive = down)
selectorstringElement selector: CSS selector (default), XPath expression, text content, or ref ID (e.g., "ref=e3")
strategystringSelector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (…
toXnumberEnding X coordinate for swipe
toYnumberEnding Y coordinate for swipe
windowIdstringWindow label to target (defaults to "main")
xnumberX coordinate for direct coordinate interaction
ynumberY coordinate for direct coordinate interaction

No output schema declared.

No examples provided.

webview_keyboard ~337

[Tauri Apps Only] Type text or send keyboard events in a Tauri app. The selector parameter (for "type" action) supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser keyboard input, use Chrome DevTools MCP instead.

NameTypeReqDescription
actionstringyesKeyboard action type: "type" for typing text into an element, "press/down/up" for key events
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
keystringKey to press (required for "press/down/up" actions, e.g., "Enter", "a", "Escape")
modifiersarrayModifier keys to hold
selectorstringElement selector for element to type into (required for "type" action): CSS selector (default), XPath, text content, or ref ID
strategystringSelector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (…
textstringText to type (required for "type" action)
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_screenshot ~223

[Tauri Apps Only] Screenshot a running Tauri app's webview. Requires active driver_session. Captures only visible viewport. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser screenshots, use Chrome DevTools MCP instead. For Electron apps, this will NOT work.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
filePathstringFile path to save the screenshot to instead of returning as base64
formatstringImage format
maxWidthintegerMaximum width in pixels. Images wider than this will be scaled down proportionally. Can also be set via TAURI_MCP_SCREENSHOT_MAX_WIDTH environment variable.
qualitynumberJPEG quality (0-100, only for jpeg format)
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_select_element ~188

[Tauri Apps Only] Activates an element picker overlay in the Tauri app. The user visually selects an element by clicking it, and the tool returns rich element metadata (tag, id, classes, attributes, text, bounding rect, CSS selector, computed styles, parent chain) plus an annotated screenshot with the element highlighted. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
timeoutnumberTimeout in ms for user to pick an element (5000-120000, default 60000)
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.

webview_wait_for ~224

[Tauri Apps Only] Wait for elements, text, or IPC events in a Tauri app. When type is "selector", supports CSS (default), XPath, and text strategies via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser waits, use Chrome DevTools MCP instead.

NameTypeReqDescription
appIdentifierstring|numberApp port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected.
strategystringSelector strategy (applies when type is "selector"): "css" (default), "xpath", or "text".
timeoutnumberTimeout in milliseconds (default: 5000ms)
typestringyesWhat to wait for
valuestringyesSelector, text content, or IPC event name to wait for
windowIdstringWindow label to target (defaults to "main")

No output schema declared.

No examples provided.