Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Rahulec08
Source: mcp.so
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list-devicesList all connected Android devices
install-appInstall an Android application APK
uninstall-appUninstall an Android application
take-screenshotTake a screenshot on an Android device
list-installed-packagesList all installed packages on an Android device
launch-appLaunch an app on an Android device
execute-adb-commandExecute a custom ADB command
extract-locatorsExtract element locators from UI XML source
save-ui-hierarchySave UI hierarchy XML to a file
find-by-textGenerate XPath to find element by text
generate-test-scriptGenerate Appium test script from actions
inspect-and-actInspect UI to identify element locators and then perform an action
capture-ui-locatorsCapture all UI elements and their locators for future use
initialize-appiumInitialize an Appium driver session for mobile automation
close-appiumClose the current Appium driver session
appium-screenshotTake a screenshot using Appium
tap-elementTap on a UI element identified by a selector
send-keysSend text input to a UI element
get-page-sourceGet the XML representation of the current UI
swipePerform a swipe gesture on the screen
wait-for-elementWait for an element to be visible on screen
long-pressPerform a long press gesture on an element
scroll-to-elementScroll until an element becomes visible
get-orientationGet the current device orientation
set-orientationSet the device orientation
hide-keyboardHide the keyboard if it's currently visible
get-current-packageGet the current active app package name
get-current-activityGet the current Android activity name
launch-appium-appLaunch the app associated with the current Appium session
close-appClose the app associated with the current Appium session
reset-appReset the app (terminate and relaunch) associated with the current Appium session
get-device-timeGet the current device time
lock-deviceLock the device screen
is-device-lockedCheck if the device is currently locked
unlock-deviceUnlock the device screen
press-key-codePress an Android key code
open-notificationsOpen the notifications panel (Android only)
get-contextsGet all available contexts (NATIVE_APP, WEBVIEW, etc.)
switch-contextSwitch between contexts (e.g., NATIVE_APP, WEBVIEW)
get-current-contextGet the current context
pull-filePull a file from the device
push-filePush a file to the device
get-battery-infoGet the device battery information
element-existsCheck if an element exists on the current page
list-ios-simulatorsGet list of available iOS simulators
find-by-ios-predicateFind an element using iOS predicate string (iOS only)
find-by-ios-class-chainFind an element using iOS class chain (iOS only)
tap-by-ios-predicateTap on an element using iOS predicate string (iOS only)
tap-by-ios-class-chainTap on an element using iOS class chain (iOS only)
send-keys-by-ios-predicateSend text to an element using iOS predicate string (iOS only)
send-keys-by-ios-class-chainSend text to an element using iOS class chain (iOS only)
perform-touch-idSimulate Touch ID fingerprint (iOS only)
shake-deviceSimulate shake gesture (iOS only)
start-recordingStart recording the screen
stop-recordingStop recording the screen and get the recording data
execute-mobile-commandExecute a custom mobile command for iOS or Android
get-element-textGet text content from a UI element
send-keys-to-deviceSend keys directly to the device without focusing on any element
send-key-eventSend a key event to the device (e.g., HOME, BACK)
clear-elementClear text from an input element
scroll-screenScroll the screen in a specified direction
get-element-attributesGet all available attributes of an element
inspect-elementGet detailed information about an element (for debugging)
get-element-treeGet a hierarchical view of the UI elements (similar to Appium Inspector)
has-text-in-screenCheck if specific text exists anywhere on the current screen
find-elements-by-textFind all elements containing specific text
tap-element-by-textTap on an element containing specific text
generate-element-locatorsGenerate multiple types of locators for an element
perform-element-actionPerform a specific action on an element using various locator strategies
smart-tapIntelligently tap an element trying different locator strategies in a specific order
inspect-and-tapInspect an element using one locator, then tap using the best available locator
perform-w3c-gesturePerform touch gestures using the W3C Actions API (more reliable than TouchAction API)
xcode_check_cli_installedCheck if Xcode command line tools are installed
xcode_get_pathGet the path to the Xcode installation
xcode_install_cliInstall Xcode command line tools (requires user interaction)
xcode_get_ios_simulatorsGet a list of available iOS simulators
xcode_boot_simulatorBoot an iOS simulator
xcode_shutdown_simulatorShutdown an iOS simulator
xcode_create_simulatorCreate a new iOS simulator
xcode_delete_simulatorDelete an iOS simulator
xcode_erase_simulatorErase all data from a simulator
xcode_get_simulator_statusGet the status of all simulators
xcode_get_simulator_infoGet detailed information about a specific simulator
xcode_wait_for_simulatorWait for a simulator to be ready
xcode_install_appInstall an app on a simulator
xcode_uninstall_appUninstall an app from a simulator
xcode_launch_appLaunch an app on a simulator
xcode_terminate_appTerminate an app on a simulator
xcode_list_installed_appsList all installed apps on a simulator
xcode_take_screenshotTake a screenshot of a simulator
xcode_record_videoStart recording video of a simulator (returns process info)
xcode_add_media_to_simulatorAdd photos/videos to a simulator
xcode_copy_to_simulatorCopy files to a simulator (limited to media files)
xcode_get_privacy_permissionGet privacy permission status for an app
xcode_grant_privacy_permissionGrant privacy permission to an app
xcode_revoke_privacy_permissionRevoke privacy permission from an app
xcode_reset_privacy_permissionReset privacy permission for an app
xcode_open_urlOpen a URL on a simulator
xcode_set_simulator_locationSet the location of a simulator
xcode_clear_simulator_locationClear the location of a simulator
10 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
110/110 tools missing one or more hints — list-devices (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); install-app (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); uninstall-app (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +107 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — inspect-and-act (line 333: fs.mkdir(locatorsDir, { recursive: true }))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
94/110 tool handlers declare input schemas (85%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool test coverage
Only 8/110 tools referenced in tests (7%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
1 call in production code run through a shell (src/lib/appium/appiumHelper.js:129)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.10.2 (high), @modelcontextprotocol/sdk@1.10.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
2/15 production deps stale: wd@2023-07-12 (3.2y), xml2js@2024-05-31 (2.3y)
Tool description accuracy
stop-recording: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/rsec08/appium-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check