Server data from the Official MCP Registry
Control iOS and Android devices with multi-device and seamless Native/WebView support.
Control iOS and Android devices with multi-device and seamless Native/WebView support.
This MCP server controls iOS and Android devices through on-device HTTP servers with per-device bearer token authentication. While the architecture is sound with proper auth for device communication, there are moderate security concerns: (1) arbitrary JavaScript execution via the run_code tool on both platforms, though sandboxed, lacks detailed validation; (2) broad system permissions including shell execution for device bootstrap; (3) limited input validation on tool parameters; (4) auth tokens are generated securely but stored in-memory without encryption. The code quality is good with comprehensive tests, but the nature of mobile device control and code execution capabilities requires careful threat modeling. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
4 files analyzed · 13 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Unverified package source
We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-srmorete-mobile-device-mcp": {
"args": [
"-y",
"@srmorete/mobile-device-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
An MCP server that lets AI agents control iOS and Android devices (tap, scroll, type, take screenshots, read UI trees, and run code). Works with multiple devices at the same time.
Three-layer architecture:
Devices are bootstrapped on first use — the server installs the driver app, allocates a port, starts the on-device server, and polls until it's healthy. After that, all tool calls are proxied over localhost HTTP with per-device bearer token auth.
| Tool | Description |
|---|---|
list_devices | List available iOS and Android devices |
screenshot | Capture the device screen (JPEG) |
uitree | Get the UI element tree as a flat list, with optional search and limit |
tap | Tap at screen coordinates |
double_tap | Double-tap at screen coordinates |
long_press | Long-press at screen coordinates (configurable duration) |
scroll | Swipe from start to end coordinates |
type_text | Type text into the focused element |
press_button | Press a hardware/navigation button (home, back, enter, volumeUp/Down, dpadUp/Down/Left/Right/Center) |
launch_app | Launch an app by bundle ID / package name |
terminate_app | Force-stop an app |
list_apps | List installed apps |
run_code | Execute sandboxed JavaScript on-device (see run_code below) |
Agents can pass code that looks like UIAutomator or XCUITest, both being Javascript under the hood. The sandbox restricts (Android) potentially dangerous Java operations and only allows (iOS) some XCUITest-ish commands
uiDevice (click, swipe, find elements, press keys, read display info), By (selectors), Until (wait conditions), console.log()app (query elements, tap, type, swipe), springboard, device, openApp(bundleId), sleep(ms), console.log()Both platforms automatically kill runaway scripts (infinite loops) and create a fresh sandbox per call.
npx)adb on PATHxcrun, simctlxcodebuild, devicectl, and iproxy (from libimobiledevice)claude mcp add mobile-device-mcp -- npx -y @srmorete/mobile-device-mcp@latest
Or with custom ports:
claude mcp add mobile-device-mcp -e MDMS_PORT_ANDROID=20000 -e MDMS_PORT_IOS=21000 -- npx -y @srmorete/mobile-device-mcp@latest
.mcp.json (Cursor, Claude Desktop, etc){
"mcpServers": {
"mobile-device-mcp": {
"command": "npx",
"args": ["-y", "@srmorete/mobile-device-mcp@latest"],
"env": {
"MDMS_PORT_ANDROID": "18000", # optional
"MDMS_PORT_IOS": "19000" # optional
}
}
}
}
git clone <repo-url>
cd mobile-device-mcp
bun install
# Build drivers for both platforms and pack tarball
./scripts/build.sh
The build script compiles the on-device drivers (Android APKs via Gradle, iOS test bundle via xcodebuild), copies them to drivers/, and creates an npm tarball.
To run locally during development:
bun run start # Start the MCP server
bun test # Run the test suite
| Environment Variable | Default | Description |
|---|---|---|
MDMS_PORT_ANDROID | 18000 | Base port for Android on-device servers |
MDMS_PORT_IOS | 19000 | Base port for iOS on-device servers |
Ports are assigned sequentially — first Android device gets 18000, second gets 18001, and so on. Same for iOS starting at 19000.
Mobile Device MCP server stands on the shoulders of giants such as mobile-mcp and Maestro. Used as inspiration but reframed the current approach to be multi-device and with seamless Native/WebView support (especially on Android).
MIT
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.