# Karagöz (npm · karagoz-mcp)

Device automation for Android emulators and phones, iOS simulators and iPhones. No daemon.

- Trust score: 83/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `karagoz-mcp`: 83/100 (this document), [markdown](https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp.md), [page](https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp)

## Channel facts

- Registry: `npm`
- Package: `karagoz-mcp`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to yagizdo/karagoz-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1604 tokens (~89/item across 18 items; 18 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 71% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Karagöz MCP server?

Karagöz runs locally as an npm package, launched with npx -y karagoz-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add yagizdo-karagoz-mcp -- npx -y karagoz-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "yagizdo-karagoz-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "karagoz-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "yagizdo-karagoz-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "karagoz-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add yagizdo-karagoz-mcp -- npx -y karagoz-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yagizdo-karagoz-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "karagoz-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yagizdo-karagoz-mcp --command npx --arg -y --arg karagoz-mcp
```

### Hermes

```yaml
mcp_servers:
  yagizdo-karagoz-mcp:
    command: "npx"
    args: ["-y", "karagoz-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "yagizdo-karagoz-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "karagoz-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add yagizdo-karagoz-mcp -t stdio -c npx -a -y karagoz-mcp
```

### Other

```json
{
  "mcpServers": {
    "yagizdo-karagoz-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "karagoz-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 82, 0)

- [security regression] Stability: 0.23 → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.3.2 → 0.4.0

### 2026-11-03 (score 82, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-11-02 (score 66, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.3.1 → 0.3.2

### 2026-11-01 (score 81, +16)

- [security regression] Stability: 0.13 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.3.0 → 0.3.1

### 2026-10-31 (score 65, 0)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Schema quality: 79 → 89
- [functional] Package version: 0.2.0 → 0.3.0

### 2026-10-30 (score 65, −14)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Stability: unverified → 0.10
- [functional] Package version: 0.1.1 → 0.2.0

### 2026-10-29 (score 79, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → pass

## MCP tools (18)

### `devices` (~28 tokens)

List devices

List Android devices and emulators, running iOS simulators, and iPhones connected to this Mac.

### `screenshot` (~97 tokens)

Take a screenshot

Save a full-resolution PNG of the screen and return its path with size, scale and safe area. Use ui_tree to read the screen; inline only to look at the image.

Input parameters:

- `device` (string): Id or name.
- `inline` (boolean): Also return the image. Take coordinates from ui_tree, not from the image.
- `out` (string): Absolute PNG path, ending in .png. Default: a new temp file.

### `ui_tree` (~98 tokens)

Read the UI tree

Return the focused window's accessibility tree as JSON, compact by default: nodes with no text, label or action and nodes off screen are left out. Node bounds [left, top, right, bottom] are the physical pixels tap and swipe take. On an iPhone it needs karagoz's runner: install it once with install_runner.

Input parameters:

- `detail` (string): full: every node.
- `device` (string): Id or name.

### `tap` (~160 tokens)

Tap

Tap x, y in physical pixels, or the center of the node whose text or contentDesc (iOS: label or value) equals text, or whose resource id (iOS: identifier) matches id. An iPhone needs install_runner once.

Input parameters:

- `device` (string): Id or name.
- `id` (string): Resource id, full or the part after :id/ (iOS: identifier).
- `text` (string): Exact text or contentDesc (iOS: label or value), case-sensitive.
- `timeout` (integer): With text or id: ms to keep reading the tree until the node appears; the call can run up to 6 s longer.
- `x` (number)
- `y` (number)

### `long_press` (~179 tokens)

Long-press

Long-press x, y in physical pixels, or the center of the node whose text or contentDesc (iOS: label or value) equals text, or whose resource id (iOS: identifier) matches id. An iPhone needs install_runner once.

Input parameters:

- `device` (string): Id or name.
- `duration` (integer): Hold time in ms. Default 1000.
- `id` (string): Resource id, full or the part after :id/ (iOS: identifier).
- `text` (string): Exact text or contentDesc (iOS: label or value), case-sensitive.
- `timeout` (integer): With text or id: ms to keep reading the tree until the node appears; the call can run up to 6 s longer.
- `x` (number)
- `y` (number)

### `double_tap` (~164 tokens)

Double-tap

Double-tap x, y in physical pixels, or the center of the node whose text or contentDesc (iOS: label or value) equals text, or whose resource id (iOS: identifier) matches id. An iPhone needs install_runner once.

Input parameters:

- `device` (string): Id or name.
- `id` (string): Resource id, full or the part after :id/ (iOS: identifier).
- `text` (string): Exact text or contentDesc (iOS: label or value), case-sensitive.
- `timeout` (integer): With text or id: ms to keep reading the tree until the node appears; the call can run up to 6 s longer.
- `x` (number)
- `y` (number)

### `swipe` (~90 tokens)

Swipe

Swipe from x1, y1 to x2, y2 in physical pixels. An iPhone needs install_runner once.

Input parameters:

- `device` (string): Id or name.
- `duration` (integer): ms from start to end. Default 300.
- `x1` (number, required)
- `x2` (number, required)
- `y1` (number, required)
- `y2` (number, required)

### `text` (~59 tokens)

Type text

Type into the focused field. Any text; on Android, text beyond ASCII is pasted through the clipboard and the old clip put back. An iPhone needs install_runner once.

Input parameters:

- `device` (string): Id or name.
- `text` (string, required)

### `key` (~96 tokens)

Press a key

Press one key.

Input parameters:

- `device` (string): Id or name.
- `key` (string, required): KeyEvent name (HOME, BACK, KEYCODE_7) or code 1-340; "7" is code 7 (KEYCODE_0), not the digit. iOS takes HOME, POWER, VOLUME_UP/DOWN and keyboard keys; an iPhone only keys that type a character, and…

### `install` (~99 tokens)

Install an app

Install an .apk, or a .app or .ipa on an iOS simulator or iPhone, or replace the installed version of the same app. An iPhone takes only a build signed for it; karagoz does not re-sign. Times out after 30 s plus 1 s per MB.

Input parameters:

- `apk` (string, required): Absolute path to the .apk, .app or .ipa.
- `device` (string): Id or name.

### `launch` (~45 tokens)

Launch an app

Start an app as its launcher icon does. On iOS it returns before the app is in front.

Input parameters:

- `device` (string): Id or name.
- `package` (string, required)

### `open_url` (~88 tokens)

Open a URL

Open a URL in the app that handles it, or in the app named by app. On iOS it returns before the app is in front, and a simulator may first ask "Open in <app>?".

Input parameters:

- `app` (string): Package name or bundle id; not on an iOS simulator.
- `device` (string): Id or name.
- `url` (string, required)

### `terminate` (~32 tokens)

Stop an app

Force-stop every process of an app.

Input parameters:

- `device` (string): Id or name.
- `package` (string, required)

### `uninstall` (~28 tokens)

Uninstall an app

Remove an app.

Input parameters:

- `device` (string): Id or name.
- `package` (string, required)

### `logs` (~106 tokens)

Read device logs

Read the newest device log records, oldest first. On iOS without since: the last minute, or the last hour with package. An iPhone read takes about 10 s.

Input parameters:

- `device` (string): Id or name.
- `lines` (integer): Number of newest records. Default 30.
- `package` (string): Only this app's records.
- `since` (number): Unix seconds on the device clock; only later records. Pass a record's time to continue.

### `doctor` (~35 tokens)

Check adb and Xcode

Report which adb and Xcode tools karagoz uses, their versions, and how to fix one that is missing, old or broken.

### `install_runner` (~71 tokens)

Install karagoz's iPhone runner

Build karagoz's runner with your Apple team and install it on a paired iPhone over USB; ui_tree, tap, swipe, text and key need it there.

Input parameters:

- `device` (string): Id or name.
- `team` (string): Apple team ID; needed only when Xcode lists several.

### `uninstall_runner` (~33 tokens)

Remove karagoz's iPhone runner

Remove karagoz's runner and its provisioning profile from an iPhone.

Input parameters:

- `device` (string): Id or name.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp#diagnostics

## Score history

- 2026-11-05: 83
- 2026-11-04: 82
- 2026-11-03: 82
- 2026-11-02: 66
- 2026-11-01: 81
- 2026-10-31: 65
- 2026-10-30: 65
- 2026-10-29: 79
- 2026-10-28: 68
- 2026-10-27: 53

## Common questions

### What is the Karagöz MCP server?

Karagöz is an MCP server listed in the public MCP registry as io.github.yagizdo/karagoz-mcp. Device automation for Android emulators and phones, iOS simulators and iPhones. No daemon. This page covers its npm package (karagoz-mcp).

### Is the Karagöz MCP server safe to use?

Karagöz scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Karagöz MCP server expose?

Karagöz exposes 18 tools: devices, screenshot, ui_tree, tap, long_press, and 13 more. Their descriptions and schemas cost roughly 1,508 tokens of context every time the server is loaded.

### Is the Karagöz MCP server still maintained?

Karagöz is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Karagöz MCP server under?

Karagöz declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/karagoz-mcp
- Socket report: https://socket.dev/npm/package/karagoz-mcp
- Repository: https://github.com/yagizdo/karagoz-mcp
- Website: https://karagozmcp.com/
- Changelog RSS feed: https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp.json
- HTML version of this page: https://verifymcp.io/servers/yagizdo-karagoz-mcp/karagoz-mcp