Back to Browse

Mobile Device MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Control iOS and Android devices with multi-device and seamless Native/WebView support.

About

Control iOS and Android devices with multi-device and seamless Native/WebView support.

Security Report

4.2
Use Caution4.2High Risk

This MCP server provides mobile device control with a reasonable three-layer architecture and per-device bearer token authentication. Permissions are appropriate for its purpose (OS-level device interaction via adb/xcodebuild, network access to localhost servers). However, several security concerns warrant attention: unsanitized command-line arguments passed to shell commands (adb, xcodebuild, simctl, iproxy), insufficient input validation on device IDs and coordinates, sensitive data (auth tokens) potentially logged, and the `run_code` sandbox (especially Android's Rhino engine) lacks comprehensive validation. Code quality is generally good with reasonable error handling, but error handling in bootstrap could log sensitive credentials. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

process_spawn

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

system_info

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-srmorete-mobile-device-mcp": {
      "args": [
        "-y",
        "@srmorete/mobile-device-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Mobile Device MCP

An MCP server that lets AI agents control iOS and Android devices (tap, scroll, type, take screenshots, read UI trees, and run code). Works with multiple devices at the same time.

How It Works

Three-layer architecture:

  1. On-device servers — Lightweight HTTP servers running on each mobile device (UIAutomator on Android, XCUITest on iOS) that expose the accessibility tree and accept interaction commands.
  2. UI tree filter — Normalizes raw UI trees from both platforms into a unified flat element list.
  3. MCP server — The external interface. Handles device discovery, bootstrapping, port allocation, and proxies requests to on-device servers.

Devices are bootstrapped on first use — the server installs the driver app, allocates a port, starts the on-device server, and polls until it's healthy. After that, all tool calls are proxied over localhost HTTP with per-device bearer token auth.

Tools

ToolDescription
list_devicesList available iOS and Android devices
screenshotCapture the device screen (JPEG)
uitreeGet the UI element tree as a flat list, with optional search and limit. Off-screen elements are excluded unless include_invisible: true
tapTap at screen coordinates
double_tapDouble-tap at screen coordinates
long_pressLong-press at screen coordinates (configurable duration)
scrollSwipe from start to end coordinates
type_textType text into the focused element
press_buttonPress a hardware/navigation button (home, back, enter, volumeUp/Down, dpadUp/Down/Left/Right/Center)
launch_appLaunch an app by bundle ID / package name
terminate_appForce-stop an app
list_appsList installed apps
install_appInstall an app from a host-local file (.apk for Android, .app for iOS simulator, .app/.ipa for iOS device). Replaces existing installs
run_codeExecute sandboxed JavaScript on-device (see run_code below)

run_code

Agents can pass code that looks like UIAutomator or XCUITest, both being Javascript under the hood. The sandbox restricts (Android) potentially dangerous Java operations and only allows (iOS) some XCUITest-ish commands

  • Android: Rhino engine with UIAutomator bindings — uiDevice (click, swipe, find elements, press keys, read display info), By (selectors), Until (wait conditions), console.log()
  • iOS: JavaScriptCore with XCUITest bindings — app (query elements, tap, type, swipe), springboard, device, openApp(bundleId), sleep(ms), console.log()

Both platforms automatically kill runaway scripts (infinite loops) and create a fresh sandbox per call.

Prerequisites

  • Node.js 18+ (for running via npx)
  • Android: Android SDK with adb on PATH
  • iOS Simulator: Xcode with xcrun, simctl
  • iOS Real Device: Xcode with xcodebuild, devicectl, and iproxy (from libimobiledevice)
  • Building from source: Bun runtime, Gradle (Android), Xcode (iOS)

Installation

Claude Code

claude mcp add mobile-device-mcp -- npx -y @srmorete/mobile-device-mcp@latest

Or with custom ports:

claude mcp add mobile-device-mcp -e MDMS_PORT_ANDROID=20000 -e MDMS_PORT_IOS=21000 -- npx -y @srmorete/mobile-device-mcp@latest

Modifying .mcp.json (Cursor, Claude Desktop, etc)

{
  "mcpServers": {
    "mobile-device-mcp": {
      "command": "npx",
      "args": ["-y", "@srmorete/mobile-device-mcp@latest"],
      "env": {
        "MDMS_PORT_ANDROID": "18000",           # optional
        "MDMS_PORT_IOS": "19000"                # optional
      }
    }
  }
}

Building from Source

git clone <repo-url>
cd mobile-device-mcp
bun install

# Build drivers for both platforms and pack tarball
./scripts/build.sh

The build script compiles the on-device drivers (Android APKs via Gradle, iOS test bundle via xcodebuild), copies them to drivers/, and creates an npm tarball.

To run locally during development:

bun run start           # Start the MCP server
bun test                # Run the test suite

Configuration

Environment VariableDefaultDescription
MDMS_PORT_ANDROID18000Base port for Android on-device servers
MDMS_PORT_IOS19000Base port for iOS on-device servers

Ports are assigned sequentially — first Android device gets 18000, second gets 18001, and so on. Same for iOS starting at 19000.

Acknowledgements

Mobile Device MCP server stands on the shoulders of giants such as mobile-mcp and Maestro. Used as inspiration but reframed the current approach to be multi-device and with seamless Native/WebView support (especially on Android).

License

MIT

Reviews

No reviews yet

Be the first to review this server!

Mobile Device MCP Server - Control iOS and Android devices with multi-device and | MCP Marketplace