Electron MCP Server by amafjarkasi

Findings (14)

• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.8.0: 5 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-8r9q-7v3j-jr4g, GHSA-rvq5-wwqv-78pq, GHSA-w48q-cv73-mx4w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.0: 3 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  electron@29.4.6: 45 known vulnerabilities

  GHSA-2p8c-gr87-2676, GHSA-3c8v-cfp5-9885, GHSA-3qxv-5xgr-q7w9, GHSA-4f78-qhmw-8j8m, GHSA-4p4r-m79c-wq3v +40 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  extract-zip@2.0.1: 2 known vulnerabilities

  GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.2.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@7.5.10: 1 known vulnerability

  GHSA-96hv-2xvq-fx4p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.24.2: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/unit-helpers.test.mjs:1557
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.0: 5 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a postinstall script

  node scripts/ensure-electron.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (111)

• start_app

  Start an Electron application with remote debugging enabled. Example: {"appPath":"D:/apps/my-electron-app","debugPort":9222}

• attach

  Attach to an already-running Electron/Chromium app that was started with --remote-debugging-port. Example: {"debugPort":9222}

• attach_by_pid

  Attach to a running Electron app by PID. Resolves the remote-debugging port from process arguments. App must have been started with --remote-debugging-port.

• find_apps

  Scan running OS processes for Electron apps. Returns PID, command, and any detected --remote-debugging-port / --inspect ports. Use to find targets for attach or attach_by_pid.

• discover_apps

  Scan a local port range (default: 9222-9235) for reachable Chrome DevTools Protocol endpoints. Useful when an app was started with an unknown debug port.

• stop_app

  Stop a process started by start_app, or detach bookkeeping for an attached session

• list_apps

  List Electron applications managed or attached by this server

• diagnose

  Summarize process health: debug port reachability, target roles (page/worker/browser), recent console errors, and discovered local debug ports

• doctor

  Local environment health check: package/node/platform, Electron binary, env flags, managed process count, optional free-port sample (localhost bind only)

• get_logs

  Get captured stdout/stderr logs for a managed Electron process

• get_console_messages

  Get buffered page console/log/exception messages captured via CDP

• list_targets

  List Chrome DevTools Protocol targets with role classification (page/worker/browser/other)

• evaluate

  Evaluate JavaScript in an Electron target via CDP Runtime.evaluate. Defaults to the first page/renderer target.

• screenshot

  Capture a PNG/JPEG screenshot of a page target via Page.captureScreenshot (optional CSS selector clips to element bounds)

• save_screenshot

  Capture a screenshot and write it to a local file path (PNG/JPEG); optional selector clips to element

• get_dom

  Read documentElement.outerHTML or a specific element's outerHTML

• query_selector

  Query DOM nodes with document.querySelectorAll and return tag/id/class/text summary

• reload

  Reload a page target (or all page targets) in an Electron app

• pause

  Pause JavaScript execution on a target via Debugger.pause

• resume

  Resume JavaScript execution on a target via Debugger.resume

• cdp_command

  Execute an arbitrary Chrome DevTools Protocol method on a target (Domain.method)

• page_info

  Get URL, title, readyState, and userAgent for a page target

• navigate

  Navigate a page target to a URL (Page.navigate) and optionally wait for load

• wait_for

  Wait until a selector exists/hides/enables, text/URL/console matches, or node count is met

• click

  Click the center of a CSS selector via CDP Input.dispatchMouseEvent

• hover

  Move the pointer over a CSS selector (mouseover / hover menus). Does not click.

• scroll

  Scroll the page or an element. With a selector and no deltas, scrolls that element into view. With deltaY/deltaX, sends a mouse wheel at the element (or the viewport).

• drag

  Press on fromSelector, move to toSelector, and release. Also sends an HTML5 drag with text/plain dataTransfer so drop listeners receive the payload. Pass data to override the source text.

• type_text

  Type text into the focused element (optionally click a selector first)

• press_key

  Press a key or shortcut (Enter, Escape, Tab, Arrow*, or a character) with optional modifiers

• set_console_live

  Enable/disable live MCP log notifications for console events (all levels when enabled; errors always notify)

• get_cookies

  Read cookies for the page (optionally filtered by URL)

• set_cookie

  Set a cookie on the page (provide url or domain; defaults to current location.href). file:// pages usually reject cookies unless you pass an http(s) url or domain.

• delete_cookie

  Delete a cookie by name. Provide url or domain, same as set_cookie. Defaults url to the page location.

• get_storage

  Read localStorage or sessionStorage key/value pairs from the page

• set_storage

  Write localStorage or sessionStorage entries (optionally clear first)

• clear_buffers

  Clear buffered console messages, network events, process logs, ipc, and/or audits

• snapshot

  Accessibility tree snapshot (roles/names) via CDP Accessibility.getFullAXTree — agent-friendly UI map

• vision

  One-shot app state: screenshot + page_info + recent console errors + network failures + windows

• highlight

  Scroll a CSS selector into view and paint a CDP overlay highlight (auto-hides when durationMs > 0)

• click_ax

  Click an element by accessibility name (optional role). Uses the AX tree, not CSS.

• type_ax

  Focus an element by accessibility name and insert text (optional clear)

• handle_dialog

  Auto accept or dismiss the next JavaScript dialogs (alert/confirm/prompt). clear:true disarms.

• assert_ui

  Check url/title/text/selector/console-error budget/expression. Returns pass:false with per-check detail (does not throw on a failed check).

• select_option

  Choose an option in a <select> by value or visible label, then fire input and change.

• act_and_verify

  Composite action & assertion: performs a UI action (click, click_ax, type_text, type_ax), waits for network idle, verifies assertion (assert_ui), and captures a screenshot immediately if assertion fails.

• triage

  One-shot crash and failure triage: inspects page state, collects console errors, failed network calls, audit issues, log tail, and resolves the stack trace of the top exception.

• save_storage_state

  Export all page cookies, localStorage, and sessionStorage into a standardized JSON storage state artifact (Playwright-compatible format)

• load_storage_state

  Restore page cookies, localStorage, and sessionStorage from a saved JSON storage state file or payload

• fill_form

  Fill multiple input fields (text, password, checkboxes, radio buttons, dropdowns) and optionally submit in a single turn. Supports {{secret:VAR}} resolution and accessibility refs.

• repro_bundle

  Package a complete, self-contained repro investigation bundle (screenshot, MHTML DOM archive, HAR network replay, source-mapped stack traces, logs, and system/health info) into a zip artifact.

• responsive_theme_matrix

  Run a multi-theme (dark/light) and multi-viewport responsive sweep, verifying UI layout, detecting text clipping/horizontal overflow, and capturing screenshot artifacts.

• get_network_log

  Get buffered network request/response events captured via CDP Network domain. Supports optional filtering by tail, status code, failure status, or URL pattern.

• get_response_body

  Fetch body for a buffered network requestId (call after Network.loadingFinished)

• block_urls

  Block URL patterns via Network.setBlockedURLs (e.g. *.analytics.com/*)

• set_extra_headers

  Set extra HTTP headers for subsequent requests (Network.setExtraHTTPHeaders)

• network_stub

  Intercept matching URLs via Fetch and fulfill or fail them. Replaces a rule with the same urlPattern. Pair with clear_network_stubs.

• clear_network_stubs

  Disable Fetch interception and drop stub rules for this session

• wait_network_idle

  Wait until no network request is in flight and the log has been quiet for idleMs

• export_har

  Write the buffered network log as HAR 1.2 JSON (method, URL, status; no bodies). Also exposes the file as an artifact resource.

• emulate_network

  Set the page offline, or slow it with latency and throughput in bytes per second. clear:true restores a normal network. Does not change viewport, user agent, geolocation, or media; use emulate for those.

• get_downloads

  Arm download capture and list files saved by the app. Requires inspectMain. The first call installs a will-download listener that writes into directory (default: OS temp) and suppresses the save dialog. Call it before the download starts, then call again for savePath.

• network_failure_report

  Composite network diagnostics: gathers all failed HTTP requests (status >= 400 or failed requests), fetches response bodies inline, and exports a HAR artifact.

• offline_resilience_check

  Audit how gracefully the Electron app handles network loss, high latency, or HTTP 500 server faults during interactions. Emulates faults, checks for crashes or unhandled rejections, restores network, and computes a Resilience Grade (A-F).

• start_tracing

  Start Chrome DevTools Protocol performance tracing (pair with stop_tracing)

• stop_tracing

  Stop CDP tracing and write a JSON trace file (open in chrome://tracing)

• get_performance_metrics

  Renderer Performance.getMetrics (JS heap, layout count, task duration, …)

• start_cpu_profile

  Start V8 CPU profiler on a page target (pair with stop_cpu_profile)

• stop_cpu_profile

  Stop CPU profiler and write a .cpuprofile JSON file

• heap_snapshot

  Take a V8 heap snapshot (.heapsnapshot) for leak investigation

• diff_screenshot

  Capture (or compare) a screenshot against a baseline PNG; reports identical + byte similarity

• get_audit_issues

  Buffered Chromium Audits issues (cookie/CORS/mixed-content/deprecations) captured since attach

• start_coverage

  Start JS precise coverage (optional CSS rule usage). Pair with stop_coverage.

• stop_coverage

  Stop coverage and return JS (and optional CSS) coverage data; optionally write JSON

• set_file_input

  Set files on an <input type=file> via DOM.setFileInputFiles (host paths)

• emulate

  Device metrics / UA / geolocation / media emulation (or clear=true to reset)

• start_screencast

  Start Page.startScreencast; buffers up to maxFrames (ack frames). Pair with stop_screencast.

• stop_screencast

  Stop screencast; optionally write last frame PNG/JPEG to path

• set_breakpoint

  Debugger.setBreakpointByUrl (0-based lineNumber). Keep debugger enabled while BPs exist.

• remove_breakpoint

  Debugger.removeBreakpoint by breakpointId from set_breakpoint

• resolve_stack

  Resolve stack frames to source snippets (Debugger.getScriptSource / file://)

• perf_audit

  Lighthouse-lite: Performance.getMetrics + nav/paint timing + recent Audits issues (not full Lighthouse)

• capture_mhtml

  Save page as MHTML via Page.captureSnapshot. Also registers the file as an artifact resource.

• virtual_clock

  Emulation.setVirtualTimePolicy — pause / advance virtual time (use budget when advancing)

• print_pdf

  Write the page to a PDF. Uses Page.printToPDF, and falls back to webContents.printToPDF when that method is missing (needs inspectMain). printBackground defaults to true. Also registers as an artifact resource.

• perf_snapshot

  Composite performance profiler: coordinates start_tracing + start_cpu_profile + start_coverage, optionally captures an interaction or reload, stops all collectors, and bundles perf audit, metrics, and artifact URIs.

• leak_check

  Memory leak detector: triggers garbage collection, measures baseline DOM and heap counters, repeats an action or wait, runs GC again, and reports retained node/listener/heap growth.

• evaluate_main

  Evaluate JavaScript in the Electron main/node CDP target (use start_app with inspectMain:true for best results)

• main_state

  Electron main-process nervous system: windows, app paths, versions, metrics (requires inspectMain / node target)

• ipc_tap

  Install main-process IPC tap (ipcMain.handle wrap + webContents send/ipc-message). Requires inspectMain.

• get_ipc_log

  Drain / read captured IPC entries after ipc_tap. Requires inspectMain.

• find_installed_apps

  Scan common install locations for packaged Electron apps (.app / exe / .desktop)

• webcontents_topology

  Map BrowserWindows / webContents (main) to CDP targets. Requires inspectMain.

• open_deep_link

  Emit Electron open-url and second-instance (requires inspectMain). Returns the URL the app recorded and mirrors it to window.__DEEP_LINK__.

• focus_window

  Bring an Electron BrowserWindow forward (show, focus, moveTop). Requires inspectMain. Omit windowId to use the first window. Pass show:false to focus without showing a hidden window.

• get_clipboard

  Read the OS clipboard. Returns text and, when present, imageDataUrl (PNG). Requires inspectMain.

• set_clipboard

  Write the OS clipboard. Pass text, imageDataUrl (a data:image/... URL), or both. Requires inspectMain.

• set_permission

  Allow or deny an Electron permission and grant it to the page via Browser.grantPermissions. Returns checked, the page's Notification.permission or equivalent. Requires inspectMain. Unlisted permissions are denied after the handler is installed.

• set_window_bounds

  Move or resize a BrowserWindow. Omit a field to leave it unchanged. Requires inspectMain. Does not show a hidden window.

• electron_security_audit

  Run security audit against Electron security recommendations (inspects webPreferences, sandbox, nodeIntegration, contextIsolation, setWindowOpenHandler, will-navigate guards, and binary fuses). Requires inspectMain.

• ipc_invoke

  Directly invoke a main-process IPC handle channel or emit an IPC event with arguments. Requires inspectMain.

• ipc_schema_inference

  Infer IPC channel contracts, argument shapes, and generate TypeScript interfaces from captured IPC tap traffic. Requires inspectMain.

• mock_electron_api

  Mock an Electron main-process API (e.g. dialog.showOpenDialog, shell.openExternal, app.getPath) with a custom return value or implementation. Requires inspectMain.

• get_mock_calls

  Get recorded invocations and arguments for a mocked Electron API method

• restore_electron_mocks

  Restore original implementations of mocked Electron APIs

• get_application_menu

  Inspect the native Electron application menu hierarchy, items, roles, accelerators, and enabled states

• click_menu_item

  Trigger a click on a native application menu item by path (e.g. 'File > Open File...'), id, or role

• trigger_shortcut

  Trigger an Electron global shortcut accelerator (e.g. 'CommandOrControl+Shift+P')

• get_process_health

  Watchdog health check diagnosing renderer crashes (OOM, killed), window hangs, responsiveness, and process memory

• ipc_fuzz_and_verify

  Fuzz test renderer-to-main IPC channels with boundary and malformed payloads (null, prototype pollution, path traversal, oversized buffers) and verify process crash resistance.

• run_script

  Advanced server-side step runner & workflow engine: executes an array of tool steps sequentially with templating ({{vars.x}}, {{steps[0].result.x}}, {{secret:KEY}}), conditional branching (if), assertions (expect), automatic retries, diagnostic failure screenshots, and optional export to Playwright