ExecBro
NPM · EXECBRO · SCANNED AUG 3
Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security70
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (140 of 144), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to igorzheludkov/execbro). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability58
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 18464 tokens (~318/item across 58 items; 58 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: the tool surface changed between 1.11.1 and 2.1.1: 14 tool removals, 0 breaking changes, 2 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · execbro
claude mcp add igorzheludkov-execbro -- npx -y execbro
codex mcp add igorzheludkov-execbro -- npx -y execbro
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"igorzheludkov-execbro": {
"type": "local",
"command": [
"npx",
"-y",
"execbro"
],
"enabled": true
}
}
} openclaw mcp add igorzheludkov-execbro --command npx --arg -y --arg execbro
mcp_servers:
igorzheludkov-execbro:
command: "npx"
args: ["-y", "execbro"] {
"mcpServers": {
"igorzheludkov-execbro": {
"command": "npx",
"args": [
"-y",
"execbro"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +50
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Stability: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: igorzheludkov/execbro security
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +12
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Schema quality: unverified functional
- First check of Tool coverage: 100 functional
- Package version: 2.1.0 → 2.1.1 functional
- 31 Jul 26 5
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance verified
Ecosystem: npm · Outcome: verified
Reason: verified
- Source repo:
- igorzheludkov/execbro
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/igorzheludkov/execbro/.github/workflows/publish.yml@refs/tags/v2.1.1
- Rekor log index:
- 2311400800
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:4b88fb808a37fae19bbad7d8f5056bed436b6a3e950fe6226c2f339c6ea690e6a9321da62d038c22e5d86746245cdd03cf3c0721449c69050661da981
- Discovery method:
- attestation_endpoint
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 140 packages
140 packages in the resolved dependency tree · 139 deprecated · 30 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
redux_get_state ~273
Read state from the Redux store bound to the app's <Provider>, resolved live via the fiber tree (same store redux_dispatch targets). PURPOSE: Inspect the current app state without relying on __RN_AI_DEVTOOLS__.stores.redux (which may point at a different store instance than the Provider). WHEN TO USE: Verify state shape before/after redux_dispatch, or check what slice keys exist before crafting an action. WORKFLOW: redux_get_state() -> craft action -> redux_dispatch -> redux_get_state({ path: 'app' }) to confirm. LIMITATIONS: Requires React DevTools hook (dev mode). State must be JSON-serializable; non-serializable values are replaced with an error marker. GOOD: redux_get_state({ path: 'app' }) BAD: redux_get_state({ path: 'app.isLoading.0' }) when isLoading is a boolean — path traversal returns undefined.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | — | RN device name (substring). Omit for default; see get_apps. |
| path | string | — | Optional dotted path into state (e.g. 'app' or 'auth.user'). Omit for the full state. |
| storeIndex | integer | — | Index of the Provider store to read from when the app has multiple <Provider> roots (default: 0). |
No output schema declared.
No examples provided.
reload_app ~343
Reload the React Native app (triggers JavaScript bundle reload like pressing 'r' in Metro). PURPOSE: Force a full JS bundle reload when Fast Refresh isn't enough — clears in-memory state and re-runs the bundle from scratch. WHEN TO USE (only these cases): (1) native code, app.json, Info.plist, Podfile, or a native module changed; (2) Fast Refresh visibly failed (red-screen or stale render confirmed via screenshot after a few seconds); (3) the app is in a broken state; (4) you need to reset app state completely; (5) the user explicitly asks. AVOID: reloading reflexively after JS/TS/TSX/style edits — Fast Refresh applies those in 1-2s. A reload discards navigation stack, context, hooks state, BLE/WebSocket connections, paired devices, and auth sessions, which can force re-pairing or re-login and break your verification loop. WORKFLOW: screenshot → wait 2s for Fast Refresh → if still stale, reload_app. Auto-connects to Metro if no connection exists (with or without a device argument) — no need to call scan_metro first. After reload, wait a few seconds before running other tools. SEE ALSO: get_refresh_status (did Fast Refresh accept?), get_bundle_status (did Metro compile?).
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | — | Target device name, substring match against the name shown by get_apps (a simulator UDID or adb serial also works). OMIT THIS unless several devices are connected — passing a name copied from list_de… |
No output schema declared.
No examples provided.
scan_metro ~226
Scan for running Metro bundler servers and automatically connect to any found React Native apps. This is typically the FIRST tool to call when starting a debugging session - it establishes the connection needed for other tools like get_logs, list_debug_globals, execute_in_app, and reload_app. PURPOSE: Discover Metro on ports 8081-8090 and auto-connect all React Native debugger targets it advertises. WHEN TO USE: At the start of any session, or after the user restarts Metro / boots a new simulator. WORKFLOW: scan_metro -> get_apps -> get_logs / ios_screenshot / tap. GOOD: scan_metro() BAD: scan_metro() called repeatedly in a loop — use ensure_connection to re-verify an existing connection.
| Name | Type | Req | Description |
|---|---|---|---|
| endPort | number | — | End port for scanning (default: 8090). Metro allocates upward from 8081, so ten ports covers several apps side by side; widen only if your bundler is pinned elsewhere. |
| startPort | number | — | Start port for scanning (default: 8081) |
No output schema declared.
No examples provided.
search_logs ~242
Search console logs for text (case-insensitive). PURPOSE: Find log lines matching a substring across the connected app's console buffer. WHEN TO USE: User reports a known error/warning, or wants to trace a specific event (e.g., "redux", "auth failed"). For unfocused exploration, prefer get_logs. WORKFLOW: scan_metro -> search_logs(text="...") -> if empty, get_logs to verify buffer populated. LIMITATIONS: Only matches text captured AFTER the app connected; won't find pre-connect logs. GOOD: search_logs({ text: "TypeError" }) BAD: search_logs({ text: "" }) (use get_logs for a raw dump)
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | — | RN device name (substring). Omit for all devices; see get_apps. |
| maxMessageLength | number | — | Max characters per message (default: 500, set to 0 for unlimited) |
| maxResults | number | — | Maximum number of results to return (default: 50) |
| text | string | yes | Text to search for in log messages |
| verbose | boolean | — | Disable all truncation and return full messages |
No output schema declared.
No examples provided.
search_network ~217
Search network requests by URL pattern (case-insensitive). PURPOSE: Filter the network buffer to requests whose URL matches a substring — fast way to find a specific endpoint in a noisy app. WHEN TO USE: You know part of the URL (e.g., "/graphql", "users", a domain) and want matching requests across all devices. WORKFLOW: search_network(urlPattern="/api/") -> get_request_details(requestId="...") for full headers/body. LIMITATIONS: Matches URL only; for method/status/body filtering use get_network_requests. Bodies are only present when the SDK is installed. GOOD: search_network({ urlPattern: "/graphql" }) BAD: search_network({ urlPattern: "" }) — empty pattern matches everything; use get_network_requests instead.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | — | RN device name (substring). Omit for all devices; see get_apps. |
| maxResults | number | — | Maximum number of results to return (default: 50) |
| urlPattern | string | yes | URL pattern to search for |
No output schema declared.
No examples provided.
send_feedback ~304
Report feedback about the ExecBro MCP tools THEMSELVES — a tool (tap, get_screen_layout, get_logs, etc.) that behaved incorrectly, was confusing, was missing, or could work better. This is EXCLUSIVELY about your experience operating ExecBro's debugging tools. It is NOT for bugs in the user's app under test, and NOT for the feature or task you were working on in this session — keep that out of the report entirely. Auto-collects environment info. Returns a pre-filled GitHub issue URL and formatted issue body. Ask the user to open the URL and paste the body to submit.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What about ExecBro's tools went wrong or could be better: which tool, what you expected it to do, what it actually did. Do NOT describe the app feature or task you were debugging — only the tool's be… |
| title | string | yes | Short summary of the ExecBro tooling issue (becomes the GitHub issue title) |
| type | string | yes | Type, scoped to ExecBro tooling: "bug" = an ExecBro tool malfunctioned, "feature_request" = a missing ExecBro capability, "feedback" = general notes on using the ExecBro tools |
| workflow_context | string | — | Which ExecBro tools were in use when the issue surfaced (e.g. "tap → get_screen_layout retry loop"). Name the tools and the debugging step — not the user's app goal. |
No output schema declared.
No examples provided.
swipe ~792
Swipe gesture that auto-routes to the correct platform (iOS or Android), with pixel-diff verification. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified swipe entry point. Easiest form: swipe({ direction: "up" }) scrolls to reveal more content ("down"/"left"/"right" also work; bare swipe() defaults to "up"). Optional distance in screenshot pixels (default 33% of axis). For precise control, pass all four coordinates (startX/startY/endX/endY) — they take precedence over direction. WHEN TO USE: Scrolling lists, paging carousels, pull-to-refresh, dismissing sheets, opening drawers — anything that needs a gesture rather than a tap. Especially useful in virtualized lists (FlatList/SectionList) where off-screen items aren't mounted in the fiber tree. VERIFICATION: verify=true (default) returns `verification.meaningful` — false means the scroll did nothing (end-of-list, non-scrollable surface, or missed coordinates). burst=true catches transient feedback like overscroll bounce. WORKFLOW: swipe({ direction: "up" }) -> read response.verification.meaningful. Advanced: pass startX/startY/endX/endY for coordinate-precise gestures. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB. Pass `device` to target a specific simulator/emulator when multiple are available — call list_devices for the inventory.
| Name | Type | Req | Description |
|---|---|---|---|
| burst | boolean | — | Capture rapid sequential frames after the swipe to detect transient feedback (overscroll bounce, fling-then-snap-back) even when the final state is unchanged. Frames are stored in the image buffer; u… |
| delta | number | — | iOS only — touch step size between events (driver-dependent default). Ignored on Android. |
| device | string | — | Target device. Accepts (a) an iOS simulator UDID, (b) an Android adb serial like 'emulator-5554', (c) the iOS simulator or Android emulator/device name (substring match), or (d) a connected RN app's… |
| direction | string | — | Shorthand for a centered scroll gesture (content-scroll semantics): "up" reveals content below (finger moves bottom→top), "down" reveals content above, "left"/"right" page horizontally. A bare swipe(… |
| distance | number | — | Travel length in screenshot pixels for the direction shorthand. Default: 33% of the relevant screen axis. |
| durationMs | number | — | Swipe duration in milliseconds (default: 300 on Android; iOS uses driver default if omitted) |
| endX | number | — | Ending X coordinate in screenshot pixels (explicit-coordinate mode) |
| endY | number | — | Ending Y coordinate in screenshot pixels (explicit-coordinate mode) |
| screenshot | boolean | — | Return the post-swipe image bytes in the response. Default true. Set to false to drop the PNG bytes — verification still runs (set verify=false to skip that too). |
| startX | number | — | Starting X coordinate in screenshot pixels (explicit-coordinate mode) |
| startY | number | — | Starting Y coordinate in screenshot pixels (explicit-coordinate mode) |
| verify | boolean | — | Compare before/after screenshots to detect whether the swipe produced a visual change. Set false to skip. When skipped, the response contains `verification: { skipped: true, skippedReason }` so calle… |
No output schema declared.
No examples provided.
tap ~927
Tap a UI element. Automatically tries multiple strategies: fiber tree (React), accessibility tree (native), and OCR (visual). [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified tap entry point — resolves text/testID/component/coordinates into a real touch event on the correct device. WHEN TO USE: Any time you need to press a button, focus an input, open a menu, or verify a handler fires. Prefer testID, then text, then component, then (x,y) from a screenshot's pressables list. WORKFLOW: ios_screenshot or android_screenshot -> tap(testID="...") | tap(text="...") | tap(x, y) -> screenshot again to verify. Use burst=true when meaningful=false but visual feedback looks transient. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB for accessibility/coordinate taps. Non-ASCII text skips fiber (Hermes); prefer testID. Pass `device` to target a specific simulator/emulator when multiple are available — call list_devices for the inventory. GOOD: tap({ testID: "login-btn" }); tap({ text: "Submit" }); tap({ x: 300, y: 600 }); tap({ x: 300, y: 600, native: true, device: "emulator-5554" }) BAD: tap({ text: "" }) or tap({ x: 0, y: 0 }) — missing a target. tap({ text: "Submit" }) without first screenshotting an ambiguous screen. SOURCE: need the file:line that renders an element? inspect_at_point(x, y).
| Name | Type | Req | Description |
|---|---|---|---|
| burst | boolean | — | Enable burst screenshot capture for enhanced verification. Captures 4 rapid screenshots (~150ms intervals) after the tap to detect transient visual feedback (press animations, highlights, ripples) th… |
| component | string | — | Component name match (case-insensitive substring, e.g. 'Button', 'MenuItem'). |
| device | string | — | Target device. Accepts (a) an iOS simulator UDID, (b) an Android adb serial like 'emulator-5554', (c) the iOS simulator or Android emulator/device name (substring match), or (d) a connected RN app's… |
| index | number | — | Zero-based index when multiple elements match (default: 0). |
| maxTraversalDepth | number | — | Max parent levels to traverse when searching by component name (default: 15). Increase if your component is deeply wrapped (e.g. inside multiple HOCs/animation wrappers). |
| native | boolean | — | When true, tap coordinates directly via ADB/simctl without requiring a React Native connection. Useful for interacting with native UI, system dialogs, or non-RN apps. Requires x/y coordinates. |
| screenshot | boolean | — | Return post-tap image bytes in the response. Default true. Set to false to drop the PNG bytes — verification still runs (set verify=false to skip that too). Combine with verify=true to get the meanin… |
| strategy | string | — | "auto" (default) tries fiber -> accessibility -> OCR. Set explicitly to skip strategies you know will fail. |
| testID | string | — | Exact match on the element's testID prop. |
| text | string | — | Visible text to match (case-insensitive substring). ASCII only for fiber strategy; OCR handles non-ASCII. |
| verify | boolean | — | Run before/after screenshot diff to detect if the tap had a meaningful visual effect. Default: true for coordinate/accessibility/ocr strategies, false for fiber. Independent of `screenshot` — verify… |
| x | number | — | X coordinate in pixels (from screenshot). Must provide both x and y. |
| y | number | — | Y coordinate in pixels (from screenshot). Must provide both x and y. |
No output schema declared.
No examples provided.