MCP server for iOS and Android Mobile Development, Automation and Testing
{
"mcpServers": {
"mobile-mcp": {
"args": [
"-y",
"@mobilenext/mobile-mcp@latest"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
MCP server for iOS and Android Mobile Development, Automation and Testing
Is it safe?
No known CVEs for @mobilenext/mobile-mcp. 2 previously resolved.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 3 days ago. 4,423 stars. 13,582 weekly downloads.
Will it work with my client?
Transport: stdio, sse, http. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@mobilenext/mobile-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
No open vulnerabilities. 2 fixed CVEs.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationCVE-2026-35394Fixed@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
### Summary The `mobile_open_url` tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. ### Details The vulnerable code passes URLs directly to `adb shell am start -a android.intent.action.VIEW -d <url>` without checking the URL scheme. This can enable malicious schemes such as `tel:`, `sms:`, `mailto:`, `conte
CVE-2026-33989Fixed@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
### Summary The `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. ### Details **File:** `src/server.ts` (lines 584-592) ```typescript tool( "mobile_save_screenshot", "Save Screenshot", "Save a screenshot of the mobile
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Persistent memory using a knowledge graph
Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.
Pre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
MCP Security Weekly
Get CVE alerts and security updates for io.github.mobile-next/mobile-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.