Mobile MCP

Published advisories for @mobilenext/mobile-mcp

From the OSV database, for this npm package. Check that your installed version is past any fix.

• CVE-2026-33989@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture toolsFixed in 0.0.49.
• CVE-2026-35394@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_urlFixed in 0.0.50.

Tools Mobile MCP exposes (35)

Listed by the server itself during our scan of commit 57efc27.

• get_more_tools

  Only call this when none of the other tools can do what you need on a mobile device, or for mobile testing or mobile app development. Do not call it for tasks unrelated to mobile, or when another tool already covers the task. The context is sent to the mobile-mcp developers, so never include PII, se

• mobile_list_available_devices

  List all available devices. This includes both physical mobile devices and mobile simulators and emulators. It returns both Android and iOS devices. These are local devices already connected to this machine, ready to use immediately at no cost - for devices from the shared remote cloud fleet, use mo

• mobile_login_to_cloud_provider

  Start authenticating this machine with the remote device cloud provider. This is required once before mobile_list_remote_devices or mobile_allocate_remote_device will work; if either of those fails with an authentication error, call this tool and then retry. This starts a browser-based device-code l

• mobile_list_remote_devices

  List the catalog of device models (make, platform, OS version) available to reserve from the remote cloud device fleet. This is different from mobile_list_available_devices, which lists real devices and simulators/emulators already connected to this local machine and ready to use immediately at no c

• mobile_allocate_remote_device

  Reserve a physical device from the remote cloud fleet for exclusive use, returning a device identifier usable with the other mobile_* tools. Unlike local devices, a remote device is a shared and billed resource borrowed for the session - never call this silently. If no local device is available, off

• mobile_release_remote_device

  Release a device previously reserved with mobile_allocate_remote_device back to the remote cloud fleet so it becomes available to others. Releasing is destructive to the device's state: apps installed, files pushed, and any other changes made during this session are lost, and a later mobile_allocate

• mobile_list_apps

  List all the installed apps on the device

• mobile_get_foreground_app

  Get the app currently in the foreground on the device, including the focused activity class on Android or view controller class on iOS when available. Use this to verify which app or screen you are on before interacting with it.

• mobile_launch_app

  Launch an app on mobile device. Use this to open a specific app. You can find the package name of the app by calling mobile_list_apps.

• mobile_terminate_app

  Stop and terminate an app on mobile device

• mobile_clear_app_data

  Clear an app's data, such as its cache, documents, preferences and databases, and stop the app, so the next launch starts as if freshly installed. The app stays installed. Supported on Android devices and emulators and on iOS simulators, not on real iOS devices.

• mobile_install_app

  Install an app on mobile device

• mobile_uninstall_app

  Uninstall an app from mobile device

• mobile_get_screen_size

  Get the screen size of the mobile device in pixels

• mobile_click_on_screen_at_coordinates

  Click on the screen, either at x,y coordinates or on an element by its ref (e.g. "@e5") from the latest mobile_list_elements_on_screen result. Prefer ref when the element is listed.

• mobile_double_tap_on_screen

  Double-tap on the screen, either at x,y coordinates or on an element by its ref (e.g. "@e5") from the latest mobile_list_elements_on_screen result. Prefer ref when the element is listed.

• mobile_long_press_on_screen_at_coordinates

  Long press on the screen, either at x,y coordinates or on an element by its ref (e.g. "@e5") from the latest mobile_list_elements_on_screen result. Prefer ref when the element is listed.

• mobile_list_elements_on_screen

  List elements on screen with their ref, coordinates, and display text or accessibility label. Use the ref with mobile_click_on_screen_at_coordinates, mobile_double_tap_on_screen or mobile_long_press_on_screen_at_coordinates. Refs and coordinates stay valid as long as the screen does not change; re-l

• mobile_press_button

  Press a button on device

• mobile_open_url

  Open an http:// or https:// URL in the browser on device. Other URL schemes, such as app deep links, are rejected unless the server was started with MOBILEMCP_ALLOW_UNSAFE_URLS=1.

• mobile_swipe_on_screen

  Swipe on the screen

• mobile_type_keys

  Type text into the focused element

• mobile_save_screenshot

  Save a screenshot of the mobile device to a file

• mobile_take_screenshot

  Take a screenshot of the mobile device. Use this to understand what's on screen, if you need to press an element that is available through view hierarchy then you must list elements on screen instead. The screenshot is usually smaller than the screen, so when the device reports its screen size the r

• mobile_set_orientation

  Change the screen orientation of the device

• mobile_fold_device

  Fold or unfold a foldable device, such as iPhone Duo simulators and foldable Android emulators. Provide either posture or angle.

• mobile_set_location

  Override the GPS location reported by the device, or clear the override to restore the real location. Omit latitude and longitude to clear.

• mobile_clipboard

  Read or replace the device clipboard. Pass text to set the clipboard, omit it to read the current clipboard.

• mobile_get_device_logs

  Collect live device logs (logcat on Android, unified log on iOS) as one JSON object per line. Only logs emitted after the call starts are captured, so trigger the behavior you want to observe right before or during the call. Stops after `limit` entries or after 30 seconds of silence. Each line of a

• mobile_get_orientation

  Get the current screen orientation of the device

• mobile_start_screen_recording

  Start recording the screen of a mobile device. The recording runs in the background until stopped with mobile_stop_screen_recording. Returns the path where the recording will be saved.

• mobile_stop_screen_recording

  Stop an active screen recording on a mobile device. Returns the file path, size, and approximate duration of the recording.

• mobile_list_crashes

  List crash reports available on the device

• mobile_get_crash

  Get the full content of a crash report by its ID. Use mobile_list_crashes to find available crash IDs.

• mobile_batch_commands

  Run multiple tools in sequence in a single call, e.g. click, type, click, type. Use this to fill forms or perform multi-step flows without round-trips. The device argument is applied to every step unless a step provides its own. Tools allowed as steps: get_more_tools, mobile_list_available_devices,

Hosts it contacted while running

At a glance

Stars

10k

Forks

914

Language

TypeScript

License

Apache-2.0

Created

Mar 2025

Last update

Oct 30, 2026

Type

MCP Server

Price

Free

Topics

Questions about Mobile MCP

Guides

• How to Install an MCP Server in Claude, Cursor and VS Code
• MCP Server Security: How to Vet a Server Before You Use It
• MCP Tool Poisoning: Malicious Descriptions and Rug Pulls
• Glossary of MCP, skills and agent security terms
• More Productivity & Workflow agents, MCP servers & skills