io.github.webdriverio/mcp
NPM · @WDIO/MCP · SCANNED SEP 20
MCP server with WebdriverIO for browser and mobile app automation (iOS/Android via Appium)
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security88
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects deepmerge-ts 7.1.6, reached via @wdio/electron-service > deepmerge-ts. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Dependency health was assessed across the 400 of 544 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to webdriverio/mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 4 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5539 tokens (~104/item across 53 items; 36 tools + 17 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 38 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.webdriverio/mcp server?
io.github.webdriverio/mcp runs locally as an npm package, launched with npx -y @wdio/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @wdio/mcp
claude mcp add webdriverio-mcp -- npx -y @wdio/mcp
{
"mcpServers": {
"webdriverio-mcp": {
"command": "npx",
"args": [
"-y",
"@wdio/mcp"
]
}
}
} {
"servers": {
"webdriverio-mcp": {
"command": "npx",
"args": [
"-y",
"@wdio/mcp"
]
}
}
} codex mcp add webdriverio-mcp -- npx -y @wdio/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"webdriverio-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@wdio/mcp"
],
"enabled": true
}
}
} openclaw mcp add webdriverio-mcp --command npx --arg -y --arg @wdio/mcp
mcp_servers:
webdriverio-mcp:
command: "npx"
args: ["-y", "@wdio/mcp"] {
"McpServers": {
"webdriverio-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@wdio/mcp"
]
}
}
} assistant mcp add webdriverio-mcp -t stdio -c npx -a -y @wdio/mcp
{
"mcpServers": {
"webdriverio-mcp": {
"command": "npx",
"args": [
"-y",
"@wdio/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 15 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Schema quality: pass → fail ▼ functional
- Package version: 3.12.1 → 3.13.0 functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +13
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@wdio/mcp@3.13.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | webdriverio/mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/webdriverio/mcp/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2850388520 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:9ada93f174015d15d2c10d0f16a1ae113af34743d7c65454ccee68f6d5967228a50df58c95a2ae3c2a85eb8aecb80ab4806d6f627cd12f5dd99569485 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 3 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-ggr8-5vv4-36mx | CVE-2026-40345 | high | yes | |
| GHSA-7pqw-9j4j-h8q3 | CVE-2026-19693 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | no |
| GHSA-jmr9-qjv8-65gv | CVE-2026-56876 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | no |
Background: What a vulnerability scan can and cannot prove →
Dependencies 400 packages
| Packages resolved | 400 |
|---|---|
| Deprecated | 1 |
| Stale | 112 |
| Tree resolution | Partial |
The dependency tree was only partially resolved, so these counts may be incomplete.
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
attach_session ~302
Attaches to an existing remote WebDriver or Appium session by ID without creating a new session. Only one session can be active at a time. The externally managed session is detached, not terminated, by default on close.
| Name | Type | Req | Description |
|---|---|---|---|
| appiumConfig | object | – | Appium server connection (local provider only) |
| automationName | string | – | Appium automation driver for local command registration (mobile platforms only) |
| browser | string | – | Browser for local command registration (browser platform only, default: chrome) |
| capabilities | object | – | Capabilities used to register the correct browser or Appium command surface locally; they are not sent to the remote endpoint |
| platform | string | yes | Existing session platform type (browser, ios, or android; Electron attachment is unsupported). |
| provider | string | – | Provider hosting the existing session (default: local). Use "external" for a custom W3C WebDriver endpoint. |
| region | string | – | Sauce Labs region (default: eu-central-1). Only used with provider: "saucelabs". |
| sessionId | string | yes | Existing remote WebDriver/Appium session ID |
| trace | boolean | – | Enable trace recording for subsequent commands — produces a Playwright-compatible zip saved to .trace/ on close_session. |
| webdriverConfig | object | – | Existing W3C WebDriver endpoint connection (provider: "external" only). Defaults to 127.0.0.1:4445/. |
No output schema declared.
No examples provided.
click_element ~147
Waits for an element, scrolls it into view, and fires element.click(). May trigger navigation, form submission, or modals. Browser sessions only — on iOS element.click() is silently ignored; use tap_element instead. Default timeout: 3000ms.
| Name | Type | Req | Description |
|---|---|---|---|
| scrollToView | boolean | – | Whether to scroll the element into view before clicking |
| selector | string | yes | Value for the selector, in the form of css selector or xpath ("button.my-class" or "//button[@class='my-class']" or "button=Exact text with spaces" or "a*=Link containing text") |
| timeout | number | – | Maximum time to wait for element in milliseconds |
No output schema declared.
No examples provided.
close_session ~99
Closes the current session or detaches without terminating. Detach preserves app state on the Appium server — sessions with noReset: true auto-detach by default. Closing a browser attach session terminates chromedriver but the Chrome process spawned by launch_chrome remains running.
| Name | Type | Req | Description |
|---|---|---|---|
| detach | boolean | – | If true, disconnect without terminating; if false, terminate. When omitted, externally managed and auto-detach sessions are preserved while other sessions are terminated. |
No output schema declared.
No examples provided.
delete_cookies ~57
Deletes all cookies or a single cookie by name from the current browser session. Irreversible — deleted cookies cannot be recovered.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Optional cookie name to delete a specific cookie. If not provided, deletes all cookies |
No output schema declared.
No examples provided.
drag_and_drop ~123
Drags an element to another element or to relative x/y offsets. x and y are offsets from the source element, not absolute screen coordinates (unlike tap_element). Provide targetSelector OR both x and y. Mobile-only.
| Name | Type | Req | Description |
|---|---|---|---|
| duration | number | – | Drag duration in milliseconds |
| sourceSelector | string | yes | Source element selector to drag |
| targetSelector | string | – | Target element selector to drop onto |
| x | number | – | Target X offset (if no targetSelector) |
| y | number | – | Target Y offset (if no targetSelector) |
No output schema declared.
No examples provided.
emulate_device ~125
Emulates a mobile or tablet device in the current browser session by setting viewport, DPR, user-agent, and touch events. Requires a BiDi-enabled session (start_session with capabilities: { webSocketUrl: true }). Omit device to list available presets. Pass "reset" to restore desktop defaults. Changes persist for all subsequent tool calls until reset or session close. Browser-only.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device preset name (e.g. "iPhone 15", "Pixel 7"). Omit to list available presets. Pass "reset" to restore desktop defaults. |
No output schema declared.
No examples provided.
execute_electron_script ~101
Executes arbitrary JavaScript in the Electron main process. This is privileged code execution with access to Electron APIs; use only with trusted scripts.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | Values made available to the script as args[0], args[1], and so on. |
| script | string | yes | JavaScript body executed in the Electron main process. Use `electron` for Electron APIs, `args` for supplied values, and `return` for a result. |
No output schema declared.
No examples provided.
execute_script ~175
Executes arbitrary JavaScript in browser page context or Appium mobile: commands. Can read/modify DOM, trigger events, terminate apps, or run Android shell commands — use only when no dedicated tool covers the action. Browser: pass JS in script, use 'return' for values, string args matching selectors auto-resolve to elements. Mobile: use 'mobile: <command>' syntax in script with args array (e.g. "mobile: pressKey", "mobile: activateApp"). Prefer click_element/set_value/get_elements for standard interactions.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | Arguments to pass to the script. For browser: element selectors or values. For mobile commands: command-specific parameters as objects. |
| script | string | yes | JavaScript code (browser) or mobile command string like "mobile: pressKey" (Appium) |
No output schema declared.
No examples provided.
get_accessibility_tree ~95
Returns the page accessibility tree with roles, names, and selectors. Browser-only. Supports filtering by ARIA roles and pagination via limit/offset.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Maximum number of nodes to return (0 = no limit) |
| offset | number | – | Number of nodes to skip for pagination |
| roles | array | – | Filter by ARIA roles, e.g. ["button", "link", "heading"] |
No output schema declared.
No examples provided.
get_app_state ~60
Returns the current state of a mobile app: not installed, not running, background, or foreground. Mobile-only.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | yes | App bundle ID (iOS) or package name (Android), e.g. "com.example.app" |
No output schema declared.
No examples provided.
get_contexts ~37
Returns available automation contexts and the currently active one. Use before switch_context to discover NATIVE_APP and WEBVIEW_* targets. Mobile-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_cookies ~61
Returns all cookies for the current session, or a single cookie by name. Use to verify auth state, session tokens, or feature flags after login flows.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Cookie name to retrieve a specific cookie. If omitted, returns all cookies. |
No output schema declared.
No examples provided.
get_elements ~145
Returns interactable elements on the current page with selectors, text, and bounding boxes. Supports filtering by element type, viewport visibility, and pagination. Use when the wdio://session/current/elements resource does not return desired elements.
| Name | Type | Req | Description |
|---|---|---|---|
| inViewportOnly | boolean | – | Only return elements visible in the current viewport (default: false). |
| includeBounds | boolean | – | Include element bounding box coordinates (default: false) |
| includeContainers | boolean | – | Include container elements like divs and sections (default: false) |
| limit | number | – | Maximum number of elements to return (0 = no limit) |
| offset | number | – | Number of elements to skip (for pagination) |
No output schema declared.
No examples provided.
get_mock_calls ~156
Read current call arguments for a mock in the active session. Use the same target as mock. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName. Browser mocking is not implemented yet; Appium sessions are unsupported.
| Name | Type | Req | Description |
|---|---|---|---|
| apiName | string | – | Required for mockType electron: API module, such as dialog, app, or clipboard. |
| funcName | string | – | Required for mockType electron: API function, such as showOpenDialog or getName. |
| mockType | string | – | Mock type: electron or browser. Defaults to browser in WebDriver sessions; required in Electron sessions. Browser mocking is not implemented yet. Appium sessions are unsupported. |
No output schema declared.
No examples provided.
get_screenshot ~35
Takes a screenshot of the current page or screen and returns a base64-encoded image, resized and compressed for model context limits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_tabs ~39
Lists all browser tabs with handle, title, URL, and which is active. Use before switch_tab to find the target handle or index. Browser-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
hide_keyboard ~38
Dismisses the on-screen keyboard on mobile. Call after text entry when the keyboard obscures elements. No-op if already hidden. Mobile-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
launch_chrome ~159
Launches Chrome with remote debugging enabled. Wipes and recreates a temporary profile directory on each call. Mode "newInstance" (default) runs alongside existing Chrome; "freshSession" starts with an empty profile. Set copyProfileFiles to copy cookies/logins from your Default profile — changes do not sync back. After launch, call start_session with attach: true to connect. Spawns a detached Chrome process that persists if the server exits.
| Name | Type | Req | Description |
|---|---|---|---|
| copyProfileFiles | boolean | – | Copy your Default Chrome profile (cookies, logins) into the debug session. |
| mode | string | – | newInstance: open alongside existing Chrome | freshSession: clean profile |
| port | number | – | Remote debugging port (default: 9222) |
No output schema declared.
No examples provided.
list_apps ~142
List apps uploaded to a cloud provider (BrowserStack App Automate, Sauce Labs App Storage, TestMu Real Device Cloud, TestingBot Storage, or Digital.ai Applications). Reads provider-specific credentials from environment.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of apps to return (only applies when organizationWide is true, default 20) |
| organizationWide | boolean | – | (BrowserStack only) List apps uploaded by all users in the organization. Defaults to false (own uploads only). |
| provider | string | yes | Cloud provider |
| region | string | – | Sauce Labs region (default: eu-central-1) |
| sortBy | string | – | Sort order for results |
No output schema declared.
No examples provided.
manage_mock ~179
Manage a mock in the active session. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName. Browser mocking is not implemented yet; Appium sessions are unsupported. For Electron: clear removes call history, reset also removes configured behavior and queued values, restore reinstates the original function and releases the mock.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| apiName | string | – | Required for mockType electron: API module, such as dialog, app, or clipboard. |
| funcName | string | – | Required for mockType electron: API function, such as showOpenDialog or getName. |
| mockType | string | – | Mock type: electron or browser. Defaults to browser in WebDriver sessions; required in Electron sessions. Browser mocking is not implemented yet. Appium sessions are unsupported. |
No output schema declared.
No examples provided.
mock ~203
Configure a session-scoped mock. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Browser mocking is not implemented yet; Appium sessions are unsupported. Electron mocks require apiName and funcName. Repeated calls preserve history and queued once values. Use resolved/rejected behaviors for async APIs.
| Name | Type | Req | Description |
|---|---|---|---|
| apiName | string | – | Required for mockType electron: API module, such as dialog, app, or clipboard. |
| behavior | string | – | Default: mockReturnValue. Once behaviors queue a value for the next call. |
| funcName | string | – | Required for mockType electron: API function, such as showOpenDialog or getName. |
| mockType | string | – | Mock type: electron or browser. Defaults to browser in WebDriver sessions; required in Electron sessions. Browser mocking is not implemented yet. Appium sessions are unsupported. |
| value | – | – | JSON value to return, resolve, or reject with. Omit for undefined. |
No output schema declared.
No examples provided.
navigate ~64
Loads a URL in the current tab and waits for the page load event. Resets page state — DOM, JS runtime, timers, and frame context are destroyed. Use instead of clicking links when the target URL is known.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The URL to navigate to |
No output schema declared.
No examples provided.
open_web_extension ~118
Installs a web extension through WebDriver BiDi and opens one of its extension pages so existing MCP tools can inspect and drive its UI. Requires a BiDi-enabled browser session. Use base64 for cloud/remote sessions where the browser driver cannot read the MCP server filesystem.
| Name | Type | Req | Description |
|---|---|---|---|
| extensionData | – | yes | W3C BiDi webExtension.ExtensionData: unpacked directory path, archive path, or base64 archive. |
| path | string | yes | Path inside the extension package, such as options.html or popup.html. Leading slashes are ignored. |
No output schema declared.
No examples provided.
rotate_device ~54
Rotates a mobile device to portrait or landscape orientation. Waits for the OS rotation animation to complete. Use to test orientation-dependent layouts. Mobile-only; no effect in browser sessions.
| Name | Type | Req | Description |
|---|---|---|---|
| orientation | string | yes | Device orientation |
No output schema declared.
No examples provided.
scroll ~56
Scrolls the page vertically by a pixel amount. Browser-only — for mobile scrolling use swipe. Only supports up/down; no horizontal scrolling.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | yes | Scroll direction |
| pixels | number | – | Number of pixels to scroll |
No output schema declared.
No examples provided.
set_cookie ~137
Sets a browser cookie on the active session. The browser must already be on the target domain — cookies cannot be set cross-domain. Use to inject session tokens or feature flags without login flows.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Cookie domain (defaults to current domain) |
| expiry | number | – | Expiry date as Unix timestamp in seconds |
| httpOnly | boolean | – | HttpOnly flag |
| name | string | yes | Cookie name |
| path | string | – | Cookie path (defaults to "/") |
| sameSite | string | – | SameSite attribute |
| secure | boolean | – | Secure flag |
| value | string | yes | Cookie value |
No output schema declared.
No examples provided.
set_geolocation ~70
Overrides GPS coordinates for the session. Affects navigator.geolocation in browsers and location services on mobile. Location permissions must already be granted to the app.
| Name | Type | Req | Description |
|---|---|---|---|
| altitude | number | – | Altitude in meters (optional) |
| latitude | number | yes | Latitude coordinate |
| longitude | number | yes | Longitude coordinate |
No output schema declared.
No examples provided.
set_value ~135
Clears an input or textarea then types the given text character by character. Always replaces existing content — clearValue() runs first. Triggers input, change, and key events which may fire validation or autocomplete. Scrolls into view by default.
| Name | Type | Req | Description |
|---|---|---|---|
| scrollToView | boolean | – | Whether to scroll the element into view before typing |
| selector | string | yes | Value for the selector, in the form of css selector or xpath ("button.my-class" or "//button[@class='my-class']") |
| timeout | number | – | Maximum time to wait for element in milliseconds |
| value | string | yes | Text to enter into the element |
No output schema declared.
No examples provided.
start_session ~1,134
Starts a new browser, local Electron application, or mobile automation session. Only one active session at a time — starting another session closes or detaches from the existing session first. Use attach: true to connect to a running Chrome via CDP.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | App URL (bs://... for BrowserStack, storage:filename= for Sauce Labs, lt://... for TestMu, tb://... for TestingBot, cloud:<package-or-bundle> for Digital.ai mobile sessions) |
| appPath | string | – | Path to app file (.app/.apk/.ipa) |
| appWaitActivity | string | – | Activity to wait for on Android launch |
| appiumConfig | object | – | Appium server connection (local provider only) |
| attach | boolean | – | Attach to existing Chrome instead of launching |
| attachConfig | object | – | Chrome remote debugging connection (attach mode only, defaults: port 9222, host localhost) |
| autoAcceptAlerts | boolean | – | Auto-accept alerts (default: true) |
| autoDismissAlerts | boolean | – | Auto-dismiss alerts (default: false) |
| autoGrantPermissions | boolean | – | Auto-grant app permissions (default: true) |
| automationName | string | – | Automation driver |
| browser | string | – | Browser to launch (required for browser platform) |
| browserVersion | string | – | Browser version (cloud providers only, default: latest) |
| browserstackLocal | – | – | Deprecated: use "tunnel" instead. Enable BrowserStack Local tunnel routing. |
| capabilities | object | – | Additional capabilities to merge. For Electron, configure the official service under "wdio:electronServiceOptions" (for example appBinaryPath, appEntryPoint, appArgs, logDir, or captureRendererLogs). |
| deviceName | string | – | Mobile device/emulator/simulator name (required for ios/android) |
| deviceQuery | string | – | Digital.ai device selection query for dynamic allocation, e.g. "@os='android' and @version='14' and @name='.*Pixel.*'". Only used with provider: "digitalai" mobile sessions; if omitted, one is built… |
| electronDeeplinkScheme | string | – | URI scheme allowed by trigger_electron_deeplink, without ":" (for example, "myapp"). Electron-only and optional unless triggering deeplinks. |
| electronRootDir | string | – | Project root used by the Electron standalone service for Electron Builder/Electron Forge discovery. Electron-only. |
| fullReset | boolean | – | Uninstall app before/after session |
| headless | boolean | – | Run browser in headless mode (default: true) |
| navigationUrl | string | – | URL to navigate to after starting |
| newCommandTimeout | number | – | Appium command timeout in seconds |
| noReset | boolean | – | Preserve app data between sessions |
| os | string | – | Operating system for cloud provider browser sessions (e.g. "Windows", "Mac", "macOS", "Linux"). BrowserStack: sets bstack:options.os separately. TestMu/Sauce Labs/TestingBot: combined with osVersion… |
| osVersion | string | – | OS version for cloud provider browser sessions (e.g. "11", "15", "Monterey"). BrowserStack: sets bstack:options.osVersion separately. TestMu/Sauce Labs/TestingBot: combined with os into W3C platformN… |
| platform | string | yes | Session platform type |
| platformVersion | string | – | OS version for mobile sessions (e.g., "17.0", "14"). Mobile (ios/android) only. |
| provider | string | – | Session provider (default: local). Use "external" to connect to an externally managed W3C WebDriver endpoint. "digitalai" requires DIGITALAI_CLOUD_URL + DIGITALAI_ACCESS_KEY env vars. |
| region | string | – | Sauce Labs region (default: eu-central-1). Only used with provider: "saucelabs". |
| reporting | object | – | Cloud provider reporting labels (project, build, session) |
| saucelabsLocal | – | – | Deprecated: use "tunnel" instead. Enable Sauce Connect tunnel routing. |
| testmuLocal | – | – | Deprecated: use "tunnel" instead. Enable TestMu Tunnel routing. |
| trace | boolean | – | Enable trace recording — produces a Playwright-compatible zip saved to .trace/ on close_session, playable at player.vibium.dev. |
| tunnel | – | – | Enable local tunnel routing (cloud providers only, default: false). true = auto-start tunnel before session and stop on close. "external" = tunnel already running externally. |
| tunnelName | string | – | Tunnel identifier name. With tunnel: "external" this must match the running tunnel. With tunnel: true a unique name is auto-generated if not provided. |
| udid | string | – | Unique Device Identifier for iOS real device |
| webdriverConfig | object | – | Existing W3C WebDriver endpoint connection (provider: "external" only). Defaults to 127.0.0.1:4445/. |
| windowHeight | number | – | Browser window height |
| windowWidth | number | – | Browser window width |
No output schema declared.
No examples provided.
swipe ~117
Performs a full-screen swipe gesture. Direction is content movement — "up" scrolls content upward (finger moves down). For browser scrolling use scroll; for dragging a specific element use drag_and_drop. No error if content cannot scroll further. Mobile-only.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | yes | Swipe direction |
| duration | number | – | Swipe duration in milliseconds (default: 500) |
| percent | number | – | Percentage of screen to swipe (0-1, default: 0.5 for up/down, 0.95 for left/right) |
No output schema declared.
No examples provided.
switch_context ~113
Switches between native and webview automation contexts in a hybrid mobile app. In NATIVE_APP context, use accessibility IDs; in WEBVIEW_* context, use CSS/XPath. Changes persist for all subsequent commands. Accepts context name or 1-based index. Use get_contexts to discover available targets. Mobile-only.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Context name to switch to (e.g., "NATIVE_APP", "WEBVIEW_com.example.app", or use index from wdio://session/current/contexts resource) |
No output schema declared.
No examples provided.
switch_frame ~97
Switches WebDriver frame context into an iframe by CSS/XPath selector, or back to top-level if selector is omitted. Changes persist — all subsequent click_element, set_value, get_elements calls operate within the switched frame until you switch back. Waits up to 5s for the iframe. Browser-only.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | – | CSS/XPath selector for the iframe element. Omit to switch back to the top-level frame. |
No output schema declared.
No examples provided.
switch_tab ~82
Focuses a browser tab by window handle or 0-based index. All subsequent tool calls operate on the active tab. Provide handle OR index — use get_tabs to find them. Browser-only; use switch_context for mobile webviews.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | – | Window handle to switch to |
| index | integer | – | 0-based tab index to switch to |
No output schema declared.
No examples provided.
tap_element ~124
Taps a matched element via element.tap() or at absolute screen coordinates (x, y). No scroll-into-view or wait — element must already be visible on screen. Use instead of click_element on iOS where element.click() is ignored. Provide selector OR both x and y. Mobile-only.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | – | Element selector (CSS, XPath, accessibility ID, or UiAutomator) |
| x | number | – | X coordinate for screen tap (if no selector provided) |
| y | number | – | Y coordinate for screen tap (if no selector provided) |
No output schema declared.
No examples provided.
trigger_electron_deeplink ~70
Triggers a deeplink through the active Electron application. The Electron session must be started with electronDeeplinkScheme matching the URL scheme. Packaged binaries are required for deeplinks on Windows and Linux.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Deeplink URI to trigger through the Electron service. |
No output schema declared.
No examples provided.
upload_app ~110
Upload a local .apk or .ipa to a cloud provider (BrowserStack, Sauce Labs, TestMu, TestingBot, or Digital.ai). Returns the app URL for use in start_session.
| Name | Type | Req | Description |
|---|---|---|---|
| customId | string | – | Optional custom ID for the app (used to reference it later) |
| path | string | yes | Absolute path to the .apk or .ipa file |
| provider | string | yes | Cloud provider |
| region | string | – | Sauce Labs region (default: eu-central-1) |
No output schema declared.
No examples provided.
What is the io.github.webdriverio/mcp server?
io.github.webdriverio/mcp is listed in the public MCP registry as io.github.webdriverio/mcp. MCP server with WebdriverIO for browser and mobile app automation (iOS/Android via Appium). This page covers its npm package (@wdio/mcp).
Is the io.github.webdriverio/mcp server safe to use?
io.github.webdriverio/mcp scores 91 out of 100 on VerifyMCP. We recorded 3 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.webdriverio/mcp server expose?
io.github.webdriverio/mcp exposes 36 tools: start_session, attach_session, close_session, launch_chrome, emulate_device, and 31 more. Their descriptions and schemas cost roughly 4,959 tokens of context every time the server is loaded.
Is the io.github.webdriverio/mcp server still maintained?
io.github.webdriverio/mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.webdriverio/mcp server under?
io.github.webdriverio/mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.