Metro MCP
NPM · METRO-MCP · SCANNED SEP 21
MCP server for React Native/Expo runtime debugging, inspection, and automation via Metro/CDP
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 5 of 43 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to steve228uk/metro-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 16 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 6585 tokens (~62/item across 105 items; 88 tools + 17 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 89% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 90 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
- Supports UI / widget rendering.Pass
How do I install the Metro MCP server?
Metro MCP runs locally as an npm package, launched with npx -y metro-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · metro-mcp
claude mcp add steve228uk-metro-mcp -- npx -y metro-mcp
{
"mcpServers": {
"steve228uk-metro-mcp": {
"command": "npx",
"args": [
"-y",
"metro-mcp"
]
}
}
} {
"servers": {
"steve228uk-metro-mcp": {
"command": "npx",
"args": [
"-y",
"metro-mcp"
]
}
}
} codex mcp add steve228uk-metro-mcp -- npx -y metro-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"steve228uk-metro-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"metro-mcp"
],
"enabled": true
}
}
} openclaw mcp add steve228uk-metro-mcp --command npx --arg -y --arg metro-mcp
mcp_servers:
steve228uk-metro-mcp:
command: "npx"
args: ["-y", "metro-mcp"] {
"McpServers": {
"steve228uk-metro-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"metro-mcp"
]
}
}
} assistant mcp add steve228uk-metro-mcp -t stdio -c npx -a -y metro-mcp
{
"mcpServers": {
"steve228uk-metro-mcp": {
"command": "npx",
"args": [
"-y",
"metro-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 11 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/metro-mcp@0.15.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | steve228uk/metro-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/steve228uk/metro-mcp/.github/workflows/publish.yml@refs/tags/v0.15.0 |
| Rekor log index | 2715930430 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:a2adae7e32186f50e7e305a441e66742f4d441bf92fcf2e15165f94fae5b44321e5644856af9ea7d6d7a35490703c2357312c883985cf32064f97fab7 |
Background: How many MCP packages publish verified provenance →
Dependencies 43 packages
| Packages resolved | 43 |
|---|---|
| Stale | 5 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_recording_annotation ~73
Add a human-readable annotation (comment marker) to the current recording. Useful for labelling major flow checkpoints like "reached checkout", "error appeared here", "navigated to payment". Annotations appear as code comments in generated tests.
| Name | Type | Req | Description |
|---|---|---|---|
| note | string | yes | Annotation text to embed in the recording |
No output schema declared.
No examples provided.
app_lifecycle ~79
Launch, terminate, install, or uninstall an app on the simulator/emulator.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| appPath | string | – | Path to .app or .apk file (for install) |
| bundleId | string | yes | App bundle identifier (e.g., com.example.app) |
| platform | string | – | – |
No output schema declared.
No examples provided.
audit_accessibility ~77
Audit the current screen within bounded Fiber traversal limits. Checks labels, roles, testIDs, and alt text; returns issues, summary, and traversal coverage.
| Name | Type | Req | Description |
|---|---|---|---|
| maxDepth | integer | – | Maximum Fiber depth to inspect |
| maxNodes | integer | – | Maximum Fibers to inspect |
| severity | string | – | Filter by severity level |
No output schema declared.
No examples provided.
check_element_accessibility ~46
Check accessibility properties of a specific component by name or testID.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Component name to check |
| testID | string | – | testID to find |
No output schema declared.
No examples provided.
clear_console_logs ~40
Clear the console log buffer.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key to clear, or omit for current device. Use "all" to clear all. |
No output schema declared.
No examples provided.
clear_errors ~38
Clear the error buffer.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key to clear, or omit for current device. Use "all" to clear all. |
No output schema declared.
No examples provided.
clear_network_requests ~40
Clear the network request buffer.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key to clear, or omit for current device. Use "all" to clear all. |
No output schema declared.
No examples provided.
delete_file ~79
Delete a file from the app sandbox. Requires confirm: true to prevent accidental deletion.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | App package name (Android, for run-as) |
| confirm | boolean | yes | Must be set to true to confirm the deletion |
| path | string | yes | Absolute path to the file to delete |
| platform | string | – | – |
No output schema declared.
No examples provided.
dispatch_redux_action ~34
Dispatch a Redux action to the store.
| Name | Type | Req | Description |
|---|---|---|---|
| payload | – | – | Action payload |
| type | string | yes | Action type |
No output schema declared.
No examples provided.
evaluate_js ~68
Execute a JavaScript expression in the running React Native app and return the result. Use this for inspecting variables, calling functions, or querying app state.
| Name | Type | Req | Description |
|---|---|---|---|
| awaitPromise | boolean | – | Wait for promise to resolve if expression returns a promise |
| expression | string | yes | JavaScript expression to evaluate |
No output schema declared.
No examples provided.
find_components ~92
Search for components by name inside the app runtime. Check traversal.complete before treating no matches as definitive.
| Name | Type | Req | Description |
|---|---|---|---|
| includeProps | boolean | – | Include component props in matches |
| maxDepth | integer | – | Maximum fiber depth to traverse (default 200, maximum 600) |
| maxNodes | integer | – | Maximum fibers to scan (default 1200) |
| pattern | string | yes | Case-insensitive component name pattern |
No output schema declared.
No examples provided.
generate_test_from_recording ~127
Convert the most recent recording into a test file. Supports three formats: appium (WebdriverIO + Mocha), maestro (YAML), and detox (Jest). Call stop_test_recording first.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | iOS bundle ID or Android app package |
| format | string | yes | Output format |
| includeSetup | boolean | – | Include WDIO configuration usage comments (the runner owns setup and teardown) |
| platform | string | – | Target platform (appium only) |
| testName | string | – | Name for the test / describe block |
No output schema declared.
No examples provided.
generate_wdio_config ~352
Generate a minimal but runnable wdio.conf.ts for Appium + React Native testing, along with the npm install command.
| Name | Type | Req | Description |
|---|---|---|---|
| androidAppPath | string | – | Path to the Android .apk when platform is both |
| androidDeviceName | string | – | Optional Android Appium device name when platform is both |
| androidPackageName | string | – | Android app package when platform is both |
| androidPlatformVersion | string | – | Optional Android version when platform is both |
| androidUdid | string | – | Optional Android device serial when platform is both |
| appPath | string | – | Path to .app / .apk (leave empty to use a running simulator) |
| bundleId | string | – | iOS bundle ID or Android app package |
| deviceName | string | – | Optional Appium device name for a single-platform config |
| iosAppPath | string | – | Path to the iOS .app when platform is both |
| iosBundleId | string | – | iOS bundle ID when platform is both |
| iosDeviceName | string | – | Optional iOS Appium device name when platform is both |
| iosPlatformVersion | string | – | Optional iOS version when platform is both |
| iosUdid | string | – | Optional iOS simulator UDID when platform is both |
| noReset | boolean | – | Preserve installed app data; false allows Appium to reset the app |
| outputPath | string | – | Shown in the output, not written to disk |
| platform | string | – | – |
| platformVersion | string | – | Optional OS version for a single-platform config |
| udid | string | – | Optional device UDID / serial for a single-platform config |
No output schema declared.
No examples provided.
get_accessibility_summary ~23
Quick overview: counts of elements with and without proper accessibility props.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_all_storage ~30
Dump all AsyncStorage key-value pairs.
| Name | Type | Req | Description |
|---|---|---|---|
| maxLength | number | – | Max length for each value |
No output schema declared.
No examples provided.
get_app_directories ~82
Get known app sandbox directory paths (documents, cache, temp, library). Returns absolute paths usable with list_directory and read_file.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | App bundle ID (iOS, e.g. com.example.app) or package name (Android). Required for iOS; used for Android private-directory resolution. |
| platform | string | – | – |
No output schema declared.
No examples provided.
get_app_info ~26
Get information about the connected React Native app (bundle URL, platform, device name).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_build_info ~47
Return build-time and runtime flags for the running React Native app: __DEV__, platform, OS version, RN version, Hermes engine, New Architecture, and expo-application fields if available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_bundle_errors ~28
Get recent Metro compilation/transform errors.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Maximum errors to return |
No output schema declared.
No examples provided.
get_component_tree ~125
Get a paged flat React component tree. Follow nextCursor to complete the snapshot and check traversal.complete before treating an empty page as authoritative.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque nextCursor returned by the previous page |
| maxDepth | integer | – | Maximum fiber depth to traverse (default 200, maximum 600) |
| maxNodes | integer | – | Maximum fibers to scan (default 1200) |
| pageSize | integer | – | Nodes per page (default 100, maximum 250) |
| structureOnly | boolean | – | Return component names and selectors without props |
No output schema declared.
No examples provided.
get_connection_status ~18
Check the connection status to Metro bundler.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_console_logs ~140
Get recent console output. Filter by level or search text.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all" for aggregated logs. Defaults to current device. |
| format | string | – | Return 'json' for a structured array of log entries |
| level | string | – | Filter by log level |
| limit | number | – | Maximum number of logs to return |
| search | string | – | Search text to filter logs |
| since | number | – | Only return entries after this Unix timestamp (ms). Pass the timestamp of the last seen entry to fetch only new ones. |
| summary | boolean | – | Return a one-line summary with counts |
No output schema declared.
No examples provided.
get_current_route ~18
Get the currently focused route name and params.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_env_vars ~89
Return a filtered subset of process.env from the running app. Credential-like keys (SECRET, KEY, TOKEN, PASSWORD, etc.) are redacted by default. Use filter to search by key name substring.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Substring to match against env var key names (case-insensitive) |
| includeAll | boolean | – | When true, includes credential keys that are otherwise redacted |
No output schema declared.
No examples provided.
get_errors ~115
Get recent uncaught exceptions from the React Native app.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all" for aggregated errors. Defaults to current device. |
| format | string | – | Return 'json' for a structured array of error entries |
| limit | number | – | Maximum number of errors to return |
| since | number | – | Only return entries after this Unix timestamp (ms). Pass the timestamp of the last seen entry to fetch only new ones. |
| summary | boolean | – | Return a one-line summary with counts |
No output schema declared.
No examples provided.
get_expo_config ~28
Return expo-constants manifest/expoConfig fields if the app uses Expo, otherwise null.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_file_info ~65
Get file or directory metadata: size, modification date, and whether it is a directory.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | App package name (Android, for run-as) |
| path | string | yes | Absolute path to the file or directory |
| platform | string | – | – |
No output schema declared.
No examples provided.
get_flamegraph ~68
Return the current profiling results as a human-readable text chart. Shows React DevTools component profile (if captured), CPU flamegraph (if CDP profile captured), and React render data from <Profiler> components (if set up). Call stop_profiling first to populate the profile data.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_memory_info ~49
Get current JavaScript heap memory usage from the running app. Returns used heap, total heap, and heap size limit (when available). Call repeatedly to track memory growth over time or to detect leaks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_native_logs ~67
Get native platform logs from iOS simulator (syslog) or Android device (logcat).
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Filter string (process name for iOS, tag for Android) |
| lines | number | – | Number of log lines to return |
| platform | string | – | – |
No output schema declared.
No examples provided.
get_navigation_state ~39
Get the full React Navigation / Expo Router state tree including current route, params, and stack history.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return compact format |
No output schema declared.
No examples provided.
get_network_requests ~115
Get recent network requests from the React Native app.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all" for aggregated requests. Defaults to current device. |
| format | string | – | Return 'json' for a structured array of request objects |
| limit | number | – | Maximum number of requests to return |
| since | number | – | Only return requests after this Unix timestamp (ms). Pass the timestamp of the last seen entry to fetch only new ones. |
| summary | boolean | – | Return a one-line summary with counts |
No output schema declared.
No examples provided.
get_network_stats ~42
Get aggregated network statistics: breakdown by domain, status code, and response times.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all". Defaults to current device. |
No output schema declared.
No examples provided.
get_platform_constants ~25
Return the full Platform.constants object from React Native, including OS-specific build details.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_profile_status ~29
Check whether profiling is active, which mode is in use, and whether a previous profile is available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_react_renders ~76
Read React render timing data collected via <Profiler onRender={trackRender}>. Returns all recorded renders sorted by actualDuration descending, with memoization savings from baseDuration. Requires importing trackRender from metro-mcp/client. Use clear=true to reset the buffer.
| Name | Type | Req | Description |
|---|---|---|---|
| clear | boolean | – | Clear the render buffer after reading. |
No output schema declared.
No examples provided.
get_redux_actions ~37
Get recent Redux actions (requires metro-mcp client SDK for real-time tracking).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Maximum actions to return |
No output schema declared.
No examples provided.
get_redux_state ~69
Get the current Redux state tree or a specific slice. Works without client SDK if Redux DevTools extension is present or store is exposed globally.
| Name | Type | Req | Description |
|---|---|---|---|
| compact | boolean | – | Return compact format |
| path | string | – | Dot-separated path to a state slice (e.g., "user.profile") |
No output schema declared.
No examples provided.
get_request_details ~72
Get full details of a specific network request including headers and body.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all". Defaults to current device. |
| index | number | – | Index of the request if multiple match (-1 for last) |
| url | string | yes | URL or partial URL to find the request |
No output schema declared.
No examples provided.
get_response_body ~77
Get response body for a network request (cached if small; requires active session if large).
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device key or "all". Defaults to current device. |
| index | number | – | Index of the request if multiple match (-1 for last) |
| url | string | yes | URL or partial URL to find the request |
No output schema declared.
No examples provided.
get_route_history ~17
Get the navigation back stack / history.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_screen_orientation ~25
Get the current screen orientation of the device.
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | – | – |
No output schema declared.
No examples provided.
get_storage_item ~29
Read a specific AsyncStorage key value.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | AsyncStorage key to read |
No output schema declared.
No examples provided.
get_storage_keys ~20
List all AsyncStorage keys in the React Native app.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_testable_elements ~69
Get elements with testID or accessibilityLabel. Check traversal.complete before treating an empty elements array as definitive.
| Name | Type | Req | Description |
|---|---|---|---|
| maxDepth | integer | – | Maximum fiber depth to traverse (default 200, maximum 600) |
| maxNodes | integer | – | Maximum fibers to scan (default 1200) |
No output schema declared.
No examples provided.
grant_permission ~120
Grant a permission to the app on the connected iOS simulator or Android emulator.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | Bundle ID (iOS) or package name (Android). Auto-detected if omitted. |
| platform | string | – | Target platform |
| service | string | yes | iOS: simctl service (calendar, contacts, contacts-limited, location, location-always, microphone, motion, photos, photos-add, media-library, reminders, siri). Android: runtime permission (e.g. "CAMER… |
No output schema declared.
No examples provided.
inspect_at_point ~87
Inspect the smallest measured host component at screen coordinates. Uses awaited Fabric/Paper measurement and returns traversal completeness metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| includeProps | boolean | – | Include component props in the result |
| maxDepth | integer | – | – |
| maxNodes | integer | – | – |
| x | number | yes | X coordinate (points/dp) |
| y | number | yes | Y coordinate (points/dp) |
No output schema declared.
No examples provided.
inspect_component ~78
Get props, state, and hooks for the first exact component-name match, with traversal completeness metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| maxDepth | integer | – | Maximum fiber depth to traverse (default 200, maximum 600) |
| maxNodes | integer | – | Maximum fibers to scan (default 1200) |
| name | string | yes | Exact component name to inspect |
No output schema declared.
No examples provided.
install_certificate ~41
Install a root certificate on the iOS simulator or Android device.
| Name | Type | Req | Description |
|---|---|---|---|
| certPath | string | yes | Path to the certificate file |
| platform | string | – | – |
No output schema declared.
No examples provided.
list_commands ~40
List all custom commands registered by the app. Commands are registered on global.__METRO_BRIDGE__.commands or global.__METRO_BRIDGE_COMMANDS__.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Metro MCP server?
Metro MCP is listed in the public MCP registry as io.github.steve228uk/metro-mcp. MCP server for React Native/Expo runtime debugging, inspection, and automation via Metro/CDP. This page covers its npm package (metro-mcp).
Is the Metro MCP server safe to use?
Metro MCP scores 90 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Metro MCP server expose?
Metro MCP exposes 88 tools: get_console_logs, clear_console_logs, get_network_requests, get_request_details, get_response_body, and 83 more. Their descriptions and schemas cost roughly 6,214 tokens of context every time the server is loaded.
Is the Metro MCP server still maintained?
Metro MCP is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Metro MCP server under?
Metro MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.