io.github.hypothesi/mcp-server-tauri
NPM · @HYPOTHESI/TAURI-MCP-SERVER · SCANNED AUG 3
A Model Context Protocol server for use with Tauri v2 applications
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security71
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.6.1, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (44 of 45), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to hypothesi/mcp-server-tauri). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 28 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4077 tokens (~203/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @hypothesi/tauri-mcp-server
claude mcp add hypothesi-mcp-server-tauri -- npx -y @hypothesi/tauri-mcp-server
codex mcp add hypothesi-mcp-server-tauri -- npx -y @hypothesi/tauri-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"hypothesi-mcp-server-tauri": {
"type": "local",
"command": [
"npx",
"-y",
"@hypothesi/tauri-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add hypothesi-mcp-server-tauri --command npx --arg -y --arg @hypothesi/tauri-mcp-server
mcp_servers:
hypothesi-mcp-server-tauri:
command: "npx"
args: ["-y", "@hypothesi/tauri-mcp-server"] {
"mcpServers": {
"hypothesi-mcp-server-tauri": {
"command": "npx",
"args": [
"-y",
"@hypothesi/tauri-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +7
- Known CVEs: fail → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Schema quality: 100 → unverified ▼ functional
- Dependency health: partial → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: fail → unverified ▼ functional
- Schema quality: unverified → excellent ▲ functional
- Stability: unverified → 0.23 ▲ functional
- 1 Aug 26 +31
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 50
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@hypothesi/[email protected]
Provenance verified
Ecosystem: npm · Outcome: verified
Reason: verified
- Source repo:
- hypothesi/mcp-server-tauri
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/hypothesi/mcp-server-tauri/.github/workflows/release.yml@refs/tags/v0.12.0
- Rekor log index:
- 2083298335
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:05e25bf63d4360c614c6aa790b45ffdb564f6d9c254af5a407bd9d4096755d7f4295851cb05564c4789b18cf94b60b3c0e34e92b16cbf8d016edddc40
- Discovery method:
- attestation_endpoint
Vulnerabilities 3 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-w48q-cv73-mx4w | CVE-2025-66414 | high | yes | |
| GHSA-58qx-3vcg-4xpx | CVE-2026-45736 | medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N | yes |
| GHSA-96hv-2xvq-fx4p | CVE-2026-48779 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Dependencies 44 packages
44 packages in the resolved dependency tree · 41 deprecated · 22 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
driver_session ~293
[Tauri Apps Only] Start/stop automation session to connect to a RUNNING Tauri app. Supports multiple concurrent app connections - each app runs on a unique port. The most recently connected app becomes the "default" app used when no appIdentifier is specified. Use action "status" to check connection state: returns single app format when 1 app connected, or array format with "isDefault" indicator when multiple apps connected. Action "stop" without appIdentifier stops ALL sessions; with appIdentifier stops only that app. The identifier field (e.g., "com.example.myapp") uniquely identifies each app. REQUIRED before using other webview_* or ipc_* tools. Connects via WebSocket to the MCP Bridge plugin in the Tauri app. For browser automation, use Chrome DevTools MCP instead. For Electron apps, this tool will NOT work.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: start or stop the session, or check status |
| appIdentifier | string|number | — | App identifier (port number or bundle ID) to stop. Only used with action "stop". If omitted, stops all sessions. |
| host | string | — | Host address to connect to (e.g., 192.168.1.100). Falls back to MCP_BRIDGE_HOST or TAURI_DEV_HOST env vars |
| port | number | — | Port to connect to (default: 9223) |
No output schema declared.
No examples provided.
get_setup_instructions ~101
Get instructions for setting up or updating the MCP Bridge plugin in a Tauri project. Call this tool when: (1) driver_session fails to connect, (2) you detect the plugin is not installed or outdated, or (3) the user asks about setup. Returns step-by-step guidance that you should follow to help the user configure their project. IMPORTANT: The instructions require you to examine the project first and ask for permission before making any changes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ipc_emit_event ~97
[Tauri Apps Only] Emit a Tauri event to test event handlers. Requires active driver_session. Events are Tauri-specific (not DOM events). For browser DOM events, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| eventName | string | yes | — |
| payload | — | — | — |
No output schema declared.
No examples provided.
ipc_execute_command ~100
[Tauri Apps Only] Execute Tauri IPC commands (invoke Rust backend functions). Requires active driver_session. This is Tauri-specific IPC, not browser APIs. For Electron IPC or browser APIs, use appropriate tools for those frameworks.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| args | — | — | — |
| command | string | yes | — |
No output schema declared.
No examples provided.
ipc_get_backend_state ~83
[Tauri Apps Only] Get Tauri backend state: app metadata, Tauri version, environment. Requires active driver_session. Use to verify you're connected to a Tauri app and get app info.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
No output schema declared.
No examples provided.
ipc_get_captured ~98
[Tauri Apps Only] Get captured Tauri IPC traffic (requires ipc_monitor started). Shows captured commands (invoke calls) and events with arguments and responses. For browser network requests, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| filter | string | — | Filter events by command name |
No output schema declared.
No examples provided.
ipc_monitor ~103
[Tauri Apps Only] Monitor Tauri IPC calls between frontend and Rust backend. Requires active driver_session. Captures invoke() calls and responses. This is Tauri-specific; for browser network monitoring, use Chrome DevTools MCP.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: start or stop IPC monitoring |
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
No output schema declared.
No examples provided.
list_devices ~56
[Tauri Mobile Apps Only] List Android emulators/devices and iOS simulators. Use for Tauri mobile development (tauri android dev, tauri ios dev). Not needed for desktop-only Tauri apps or web projects.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
manage_window ~241
[Tauri Apps Only] Manage Tauri windows. Actions: "list" - List all windows with labels, titles, URLs, and state. "info" - Get detailed info for a window (size, position, title, focus, visibility). "resize" - Resize a window (requires width/height, uses logical pixels by default). Requires active driver_session. For browser windows, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action: "list" all windows, get "info" for one window, or "resize" a window |
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| height | integer | — | Height in pixels (required for "resize" action) |
| logical | boolean | — | Use logical pixels (true, default) or physical pixels (false). Only for "resize" |
| width | integer | — | Width in pixels (required for "resize" action) |
| windowId | string | — | Window label to target (defaults to "main"). Required for "info", optional for "resize" |
No output schema declared.
No examples provided.
read_logs ~208
[Tauri Apps Only] Read logs from various sources: "console" for webview JS logs, "android" for logcat, "ios" for simulator logs, "system" for desktop logs. Requires active driver_session for console logs. Use for debugging Tauri app issues at any level.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID for console logs. Defaults to the only connected app or the default app if multiple are connected. |
| filter | string | — | Regex or keyword to filter logs |
| lines | number | — | — |
| since | string | — | ISO timestamp to filter logs since (e.g. 2023-10-27T10:00:00Z) |
| source | string | yes | Log source: "console" for webview JS logs, "android" for logcat, "ios" for simulator, "system" for desktop |
| windowId | string | — | Window label for console logs (defaults to "main") |
No output schema declared.
No examples provided.
webview_dom_snapshot ~357
[Tauri Apps Only] Get a structured DOM snapshot of a Tauri app's webview. Supports different snapshot types for AI consumption. The "accessibility" type returns a YAML representation of the accessibility tree similar to Playwright's aria snapshots, including roles, names, states, and element refs. Use this for understanding UI semantics, finding interactive elements, or accessibility testing. The "structure" type returns a YAML representation of the DOM hierarchy with element tag names, IDs, CSS classes, and data-testid attributes (if present). Use this for understanding page layout, debugging CSS selectors, or locating elements by class/ID. Use the optional selector parameter to scope the snapshot to a subtree. The selector supports CSS (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| selector | string | — | Selector to scope the snapshot: CSS selector (default), XPath, text content, or ref ID. If omitted, snapshots entire document. |
| strategy | string | — | Selector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (… |
| type | string | yes | Snapshot type |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_execute_js ~251
[Tauri Apps Only] Execute JavaScript in a Tauri app's webview context. Requires active driver_session. Has access to window.__TAURI__. If you need a return value, it must be JSON-serializable. For functions that return values, use an IIFE: "(() => { return 5; })()" not "() => { return 5; }". Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser JS execution, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| args | array | — | Arguments to pass to the script |
| script | string | yes | JavaScript code to execute in the webview context. If returning a value, it must be JSON-serializable. For functions that return values, use IIFE syntax: "(() => { return value; })()" not "() => { re… |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_find_element ~278
[Tauri Apps Only] Find DOM elements in a running Tauri app's webview. Supports CSS selectors (default), XPath expressions, and text content matching via the strategy parameter. The "text" strategy first searches element text content, then falls back to placeholder, aria-label, and title attributes. Returns the element's HTML. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser pages or documentation sites, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| selector | string | yes | The selector to find: CSS selector (default), XPath expression, text content, or ref ID (e.g., "ref=e3"). Interpretation depends on strategy. |
| strategy | string | — | Selector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (… |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_get_pointed_element ~179
[Tauri Apps Only] Retrieves element metadata for an element the user previously pointed at via Alt+Shift+Click in the Tauri app. Returns the same rich metadata as webview_select_element (tag, id, classes, attributes, text, bounding rect, CSS selector, computed styles, parent chain) plus an annotated screenshot. The user must Alt+Shift+Click an element first before calling this tool. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_get_styles ~273
[Tauri Apps Only] Get computed CSS styles from elements in a Tauri app. Supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser style inspection, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| multiple | boolean | — | Whether to get styles for all matching elements (true) or just the first (false) |
| properties | array | — | Specific CSS properties to retrieve. If omitted, returns all computed styles |
| selector | string | yes | Element selector: CSS selector (default), XPath expression, text content, or ref ID |
| strategy | string | — | Selector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (… |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_interact ~387
[Tauri Apps Only] Click, scroll, swipe, focus, or perform gestures in a Tauri app webview. Supported actions: click, double-click, long-press, scroll, swipe, focus. Supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. For browser interaction, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Type of interaction to perform |
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| duration | number | — | Duration in ms for long-press or swipe (default: 500ms for long-press, 300ms for swipe) |
| fromX | number | — | Starting X coordinate for swipe |
| fromY | number | — | Starting Y coordinate for swipe |
| scrollX | number | — | Horizontal scroll amount in pixels (positive = right) |
| scrollY | number | — | Vertical scroll amount in pixels (positive = down) |
| selector | string | — | Element selector: CSS selector (default), XPath expression, text content, or ref ID (e.g., "ref=e3") |
| strategy | string | — | Selector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (… |
| toX | number | — | Ending X coordinate for swipe |
| toY | number | — | Ending Y coordinate for swipe |
| windowId | string | — | Window label to target (defaults to "main") |
| x | number | — | X coordinate for direct coordinate interaction |
| y | number | — | Y coordinate for direct coordinate interaction |
No output schema declared.
No examples provided.
webview_keyboard ~337
[Tauri Apps Only] Type text or send keyboard events in a Tauri app. The selector parameter (for "type" action) supports CSS selectors (default), XPath, and text content matching via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser keyboard input, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Keyboard action type: "type" for typing text into an element, "press/down/up" for key events |
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| key | string | — | Key to press (required for "press/down/up" actions, e.g., "Enter", "a", "Escape") |
| modifiers | array | — | Modifier keys to hold |
| selector | string | — | Element selector for element to type into (required for "type" action): CSS selector (default), XPath, text content, or ref ID |
| strategy | string | — | Selector strategy: "css" (default) for CSS selectors, "xpath" for XPath expressions, "text" to find elements by text content, with fallback to placeholder, aria-label, and title attributes. Ref IDs (… |
| text | string | — | Text to type (required for "type" action) |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_screenshot ~223
[Tauri Apps Only] Screenshot a running Tauri app's webview. Requires active driver_session. Captures only visible viewport. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser screenshots, use Chrome DevTools MCP instead. For Electron apps, this will NOT work.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| filePath | string | — | File path to save the screenshot to instead of returning as base64 |
| format | string | — | Image format |
| maxWidth | integer | — | Maximum width in pixels. Images wider than this will be scaled down proportionally. Can also be set via TAURI_MCP_SCREENSHOT_MAX_WIDTH environment variable. |
| quality | number | — | JPEG quality (0-100, only for jpeg format) |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_select_element ~188
[Tauri Apps Only] Activates an element picker overlay in the Tauri app. The user visually selects an element by clicking it, and the tool returns rich element metadata (tag, id, classes, attributes, text, bounding rect, CSS selector, computed styles, parent chain) plus an annotated screenshot with the element highlighted. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| timeout | number | — | Timeout in ms for user to pick an element (5000-120000, default 60000) |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.
webview_wait_for ~224
[Tauri Apps Only] Wait for elements, text, or IPC events in a Tauri app. When type is "selector", supports CSS (default), XPath, and text strategies via the strategy parameter. Requires active driver_session. Targets the only connected app, or the default app if multiple are connected. Specify appIdentifier (port or bundle ID) to target a specific app. For browser waits, use Chrome DevTools MCP instead.
| Name | Type | Req | Description |
|---|---|---|---|
| appIdentifier | string|number | — | App port or bundle ID to target. Defaults to the only connected app or the default app if multiple are connected. |
| strategy | string | — | Selector strategy (applies when type is "selector"): "css" (default), "xpath", or "text". |
| timeout | number | — | Timeout in milliseconds (default: 5000ms) |
| type | string | yes | What to wait for |
| value | string | yes | Selector, text content, or IPC event name to wait for |
| windowId | string | — | Window label to target (defaults to "main") |
No output schema declared.
No examples provided.