Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.mobile-next/mobile-mcp

NPM · @MOBILENEXT/MOBILE-MCP · SCANNED SEP 20

MCP server for iOS and Android Mobile Development, Automation and Testing

0 this week 94 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 35 of 166 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to mobile-next/mobile-mcp). View diagnostics → Pass
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 6 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3528 tokens (~110/item across 32 items; 32 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.mobile-next/mobile-mcp server?

io.github.mobile-next/mobile-mcp runs locally as an npm package, launched with npx -y @mobilenext/mobile-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @mobilenext/mobile-mcp

# add to Claude Code
claude mcp add mobile-next-mobile-mcp -- npx -y @mobilenext/mobile-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "mobile-next-mobile-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@mobilenext/mobile-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "mobile-next-mobile-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@mobilenext/mobile-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add mobile-next-mobile-mcp -- npx -y @mobilenext/mobile-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mobile-next-mobile-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mobilenext/mobile-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add mobile-next-mobile-mcp --command npx --arg -y --arg @mobilenext/mobile-mcp
# ~/.hermes/config.yaml
mcp_servers:
  mobile-next-mobile-mcp:
    command: "npx"
    args: ["-y", "@mobilenext/mobile-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "mobile-next-mobile-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@mobilenext/mobile-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add mobile-next-mobile-mcp -t stdio -c npx -a -y @mobilenext/mobile-mcp
// mcp.json
{
  "mcpServers": {
    "mobile-next-mobile-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@mobilenext/mobile-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 −2
    • Stability: pass → 0.80 functional
  • 15 Sept 26 0
    • Stability: 0.97 → pass security
  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 9 Sept 26 +13
    • Malware scan: unverified → pass security
    • Stability: pass → 0.80 functional
    • Package version: 1.0.0 → 1.0.3 functional
  • 8 Sept 26 −15
    • Malware scan: pass → unverified security
    • Stability: 0.97 → pass security
    • Schema quality: pass → fail functional
    • Security disclosure: unverified → pass functional
    • Schema quality: good → excellent functional
    • Package version: 1.0.2 → 1.0.3 functional
  • 7 Sept 26 0
    • Security disclosure: pass → unverified functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@mobilenext/mobile-mcp@1.0.3

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo mobile-next/mobile-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/mobile-next/mobile-mcp/.github/workflows/build.yml@refs/tags/1.0.3
Rekor log index 2759267423
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:7c72e3fb33b7959ca3e9da8770895d0925ac9539115aa2ffdfc2ab1c24c335d606114240e39107229438dc5e693500bed416829733e875e9930edf2bf

Background: How many MCP packages publish verified provenance →

Dependencies 166 packages
Packages resolved 166
Stale 35
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 32 exposed · ~3,528 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
mobile_allocate_remote_device ~388

Reserve a physical device from the remote cloud fleet for exclusive use, returning a device identifier usable with the other mobile_* tools. Unlike local devices, a remote device is a shared and billed resource borrowed for the session - only call this after the user has explicitly asked to use a remote/cloud device, never speculatively or as a fallback when a local device isn't found. Requires mobile_login_to_cloud_provider to have been called first; if this fails with an authentication error, call that tool then retry. Use mobile_list_remote_devices first to see which names and versions actually exist in the fleet before filtering by them. Release the device with mobile_release_remote_device once the whole task is finished - releasing wipes the device's state, so do not release and reallocate between steps of the same task just to be tidy.

NameTypeReqDescription
namestringFilter by device name/model. Supports a trailing * for prefix match (e.g. "iPhone*"), or an exact name (e.g. "iPhone 16").
platformstringyesThe platform to allocate a device for
timeoutSecondsintegerSeconds to wait for allocation when wait is true. Defaults to 900 (15 minutes). Only relevant when wait is true.
typestringDevice type filter. Currently only "real" (physical devices) is supported by the fleet.
versionarrayFilter by OS version. Supports comparison prefixes >=, >, <=, < (e.g. ">=18"), or an exact version (e.g. "18.6.2"). Multiple values are ANDed together.
waitbooleanIf true, block until the device has finished allocating and is ready to use, up to timeoutSeconds. If false/omitted, this returns as soon as the reservation is made, but the device may not be immedia…

No output schema declared.

No examples provided.

mobile_batch_commands ~146

Run multiple tools in sequence in a single call, e.g. click, type, click, type. Use this to fill forms or perform multi-step flows without round-trips. The device argument is applied to every step unless a step provides its own.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
listElementsAtEndbooleanRun mobile_list_elements_on_screen after the last step and include its result. Defaults to false
stepsarrayyesTools to run, in order
stopOnErrorbooleanStop at the first failing step. Defaults to true

No output schema declared.

No examples provided.

mobile_click_on_screen_at_coordinates ~157

Click on the screen, either at x,y coordinates or on an element by its ref (e.g. "@e5") from the latest mobile_list_elements_on_screen result. Prefer ref when the element is listed.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
refstringElement ref from mobile_list_elements_on_screen, e.g. "@e5". Takes precedence over x,y
xnumberThe x coordinate to click on the screen, in pixels. Required unless ref is given
ynumberThe y coordinate to click on the screen, in pixels. Required unless ref is given

No output schema declared.

No examples provided.

mobile_clipboard ~78

Read or replace the device clipboard. Pass text to set the clipboard, omit it to read the current clipboard.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
textstringText to place on the clipboard. Omit to read the clipboard instead.

No output schema declared.

No examples provided.

mobile_double_tap_on_screen ~84

Double-tap on the screen at given x,y coordinates.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
xnumberyesThe x coordinate to double-tap, in pixels
ynumberyesThe y coordinate to double-tap, in pixels

No output schema declared.

No examples provided.

mobile_get_crash ~72

Get the full content of a crash report by its ID. Use mobile_list_crashes to find available crash IDs.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
idstringyesThe crash report ID to retrieve

No output schema declared.

No examples provided.

mobile_get_device_logs ~263

Collect live device logs (logcat on Android, unified log on iOS) as one JSON object per line. Only logs emitted after the call starts are captured, so trigger the behavior you want to observe right before or during the call. Stops after `limit` entries or after 30 seconds of silence. Each line of a stack trace counts as one entry, so filter by process or tag to avoid filling the limit with noise. Start with a small limit (20-50) for a quick look. For large captures, pass `saveTo` to write logs to a file and only the entry count is returned.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
filterarrayFilters, ANDed together. key=value includes, key!=value excludes. Keys: pid, process, tag, level, subsystem, category, message. Example: ["tag=ActivityManager", "level=Error", "process!=SpringBoard"]
limitintegerStop after this many log entries
saveTostringPath to write the logs to instead of returning them. Filename must end with .log, .txt, or .jsonl

No output schema declared.

No examples provided.

mobile_get_foreground_app ~64

Get the app currently in the foreground on the device. Use this to verify which app or screen you are on before interacting with it.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_get_orientation ~44

Get the current screen orientation of the device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_get_screen_size ~47

Get the screen size of the mobile device in pixels

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_install_app ~93

Install an app on mobile device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
pathstringyesThe path to the app file to install. For iOS simulators, provide a .zip file or a .app directory. For Android provide an .apk file. For iOS real devices provide an .ipa file

No output schema declared.

No examples provided.

mobile_launch_app ~113

Launch an app on mobile device. Use this to open a specific app. You can find the package name of the app by calling list_apps_on_device.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
localestringComma-separated BCP 47 locale tags to launch the app with (e.g., fr-FR,en-GB)
packageNamestringyesThe package name of the app to launch

No output schema declared.

No examples provided.

mobile_list_apps ~44

List all the installed apps on the device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_list_available_devices ~72

List all available devices. This includes both physical mobile devices and mobile simulators and emulators. It returns both Android and iOS devices. These are local devices already connected to this machine, ready to use immediately at no cost - for devices from the shared remote cloud fleet, use mobile_list_remote_devices instead.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

mobile_list_crashes ~44

List crash reports available on the device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_list_elements_on_screen ~120

List elements on screen with their ref, coordinates, and display text or accessibility label. Use the ref with mobile_click_on_screen_at_coordinates. Refs and coordinates stay valid as long as the screen does not change; re-list only after navigation or a layout change.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
formatstringOutput format. "text" (default) is one compact line per element, "json" is a json array

No output schema declared.

No examples provided.

mobile_list_remote_devices ~126

List the catalog of device models (make, platform, OS version) available to reserve from the remote cloud device fleet. This is different from mobile_list_available_devices, which lists real devices and simulators/emulators already connected to this local machine and ready to use immediately at no cost. Remote devices live in a shared cloud fleet: they are not usable until reserved with mobile_allocate_remote_device, and reserving one may be a limited/billed resource. Requires mobile_login_to_cloud_provider to have been called first; if this fails with an authentication error, call that tool then retry.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

mobile_login_to_cloud_provider ~182

Start authenticating this machine with the remote device cloud provider. This is required once before mobile_list_remote_devices or mobile_allocate_remote_device will work; if either of those fails with an authentication error, call this tool and then retry. This starts a browser-based device-code login and returns quickly with a URL and a one-time code - it does NOT wait for the login to complete. Show the URL and code to the user verbatim and ask them to open the URL and enter the code in their own browser. The login keeps running in the background after this tool returns; once the user confirms they've completed it, retry the remote devices tool that originally failed. Only call this after the user has explicitly asked to connect to, log into, or use remote/cloud devices - never call it speculatively, since it interrupts the user to act in their browser.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

mobile_long_press_on_screen_at_coordinates ~128

Long press on the screen at given x,y coordinates. If long pressing on an element, use the mobile_list_elements_on_screen tool to find the coordinates.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
durationnumberDuration of the long press in milliseconds. Defaults to 500ms.
xnumberyesThe x coordinate to long press on the screen, in pixels
ynumberyesThe y coordinate to long press on the screen, in pixels

No output schema declared.

No examples provided.

mobile_open_url ~54

Open a URL in browser on device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
urlstringyesThe URL to open

No output schema declared.

No examples provided.

mobile_press_button ~112

Press a button on device

NameTypeReqDescription
buttonstringyesThe button to press. Supported buttons: BACK (android only), HOME, VOLUME_UP, VOLUME_DOWN, ENTER, DPAD_CENTER (android tv only), DPAD_UP (android tv only), DPAD_DOWN (android tv only), DPAD_LEFT (and…
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_release_remote_device ~128

Release a device previously reserved with mobile_allocate_remote_device back to the remote cloud fleet so it becomes available to others. Releasing is destructive to the device's state: apps installed, files pushed, and any other changes made during this session are lost, and a later mobile_allocate_remote_device call may take time and could return a different physical unit. Only release once the whole task is finished - if there is more work to do on the same device shortly, keep holding it rather than releasing and reallocating.

NameTypeReqDescription
devicestringyesThe device identifier to release back to the remote fleet

No output schema declared.

No examples provided.

mobile_save_screenshot ~125

Save a screenshot of the mobile device to a file

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
maxSizeintegerMaximum width/height in pixels, keeping aspect ratio. Omit for full size.
saveTostringyesThe path to save the screenshot to. Filename must end with .png, .jpg, or .jpeg
scalenumberScale factor (0.0-1.0). Ignored if maxSize is provided.

No output schema declared.

No examples provided.

mobile_set_location ~122

Override the GPS location reported by the device, or clear the override to restore the real location. Omit latitude and longitude to clear.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
latitudenumberLatitude in decimal degrees, e.g. 37.7749. Omit together with longitude to clear the override.
longitudenumberLongitude in decimal degrees, e.g. -122.4194. Omit together with latitude to clear the override.

No output schema declared.

No examples provided.

mobile_set_orientation ~53

Change the screen orientation of the device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
orientationstringyesThe desired orientation

No output schema declared.

No examples provided.

mobile_start_screen_recording ~127

Start recording the screen of a mobile device. The recording runs in the background until stopped with mobile_stop_screen_recording. Returns the path where the recording will be saved.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
outputstringThe file path to save the recording to. Filename must end with .mp4. If not provided, a temporary path will be used.
timeLimitnumberMaximum recording duration in seconds. The recording will stop automatically after this time.

No output schema declared.

No examples provided.

mobile_stop_screen_recording ~61

Stop an active screen recording on a mobile device. Returns the file path, size, and approximate duration of the recording.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

mobile_swipe_on_screen ~138

Swipe on the screen

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
directionstringyesThe direction to swipe
distancenumberThe distance to swipe in pixels. Defaults to 400 pixels for iOS or 30% of screen dimension for Android
xnumberThe x coordinate to start the swipe from, in pixels. If not provided, uses center of screen
ynumberThe y coordinate to start the swipe from, in pixels. If not provided, uses center of screen

No output schema declared.

No examples provided.

mobile_take_screenshot ~129

Take a screenshot of the mobile device. Use this to understand what's on screen, if you need to press an element that is available through view hierarchy then you must list elements on screen instead. Do not cache this result.

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
maxSizeintegerMaximum width/height in pixels, keeping aspect ratio. Defaults to 1024.
scalenumberScale factor (0.0-1.0). Ignored if maxSize is provided.

No output schema declared.

No examples provided.

mobile_terminate_app ~61

Stop and terminate an app on mobile device

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
packageNamestringyesThe package name of the app to terminate

No output schema declared.

No examples provided.

mobile_type_keys ~82

Type text into the focused element

NameTypeReqDescription
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.
submitbooleanyesWhether to submit the text. If true, the text will be submitted as if the user pressed the enter key.
textstringyesThe text to type

No output schema declared.

No examples provided.

mobile_uninstall_app ~71

Uninstall an app from mobile device

NameTypeReqDescription
bundle_idstringyesBundle identifier (iOS) or package name (Android) of the app to be uninstalled
devicestringyesThe device identifier to use. Use mobile_list_available_devices to find which devices are available to you.

No output schema declared.

No examples provided.

Common questions

What is the io.github.mobile-next/mobile-mcp server?

io.github.mobile-next/mobile-mcp is listed in the public MCP registry as io.github.mobile-next/mobile-mcp. MCP server for iOS and Android Mobile Development, Automation and Testing. This page covers its npm package (@mobilenext/mobile-mcp).

Is the io.github.mobile-next/mobile-mcp server safe to use?

io.github.mobile-next/mobile-mcp scores 94 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.mobile-next/mobile-mcp server expose?

io.github.mobile-next/mobile-mcp exposes 32 tools: mobile_list_available_devices, mobile_login_to_cloud_provider, mobile_list_remote_devices, mobile_allocate_remote_device, mobile_release_remote_device, and 27 more. Their descriptions and schemas cost roughly 3,528 tokens of context every time the server is loaded.

Is the io.github.mobile-next/mobile-mcp server still maintained?

io.github.mobile-next/mobile-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.mobile-next/mobile-mcp server under?

io.github.mobile-next/mobile-mcp declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.