← Back to search

@tapflowio/mcp-server

GitHub Actions Scanned 3d ago

MCP server for tapflow — lets LLM agents control iOS/Android simulators via Model Context Protocol

npm
? Not scanned yet

Versions

0.17.0latest
Jul 27, 2026
0.16.0
Jul 22, 2026
0.15.0
Jul 19, 2026
0.14.0
Jul 8, 2026
0.13.0-experimental.1
Jul 5, 2026
+ show 19 moreshow less
0.12.0-experimental.1
Jul 3, 2026
0.11.1-experimental.1
Jul 2, 2026
0.11.0-experimental.1
Jun 29, 2026
0.10.0-experimental.1
Jun 23, 2026
0.9.2-experimental.1
Jun 20, 2026
0.9.1-experimental.1
Jun 17, 2026
0.9.0-experimental.1
Jun 17, 2026
0.8.2-experimental.1
Jun 13, 2026
0.8.1-experimental.2
Jun 12, 2026
0.8.1-experimental.1
Jun 11, 2026
0.8.0-experimental.1
Jun 10, 2026
0.7.0-experimental.1
Jun 8, 2026
0.6.1-experimental.1
Jun 6, 2026
0.6.0-experimental.1
Jun 6, 2026
0.5.1-experimental.1
Jun 5, 2026
0.5.0-experimental.1
Jun 3, 2026
0.4.1-experimental.1
May 31, 2026
0.3.1-experimental.1
May 28, 2026
0.3.1-experimental.0
May 28, 2026

Tools 16

list_builds
annotations: none low

List all apps and their builds available on the relay. Use this to find buildId before calling install_app or launch_app.

sessionId string
list_devices
annotations: none low

List all available simulators and emulators registered on the tapflow relay.

sessionId string
connect_device
annotations: none low

Join a device session so you can control it. Required before boot_device, install_app, and launch_app.

sessionId string
disconnect_device
annotations: none low

End a device session and release the connection.

sessionId string
boot_device
annotations: none low

Boot a simulator/emulator. Requires connect_device first. Waits up to 30 seconds for the device to be ready.

deviceId string sessionId string
shutdown_device
annotations: none low

Shut the session\'s booted simulator/emulator down — powers the device off to free resources or force a

deviceId string sessionId string
query_ui_tree
annotations: none low

Query the accessibility tree of the current screen: interactive and text-bearing elements as

sessionId string
run_flow
annotations: none low

Replay a tapflow flow (YAML) deterministically — no LLM in the loop. Use this for verified scenarios instead of

flow string path string buildId number install boolean sessionId string
screenshot
annotations: none low

Capture the current screen of a device. Returns the image so you can analyze it.

format enum sessionId string
tap
annotations: none low

Tap at a pixel coordinate matching the screenshot. Use the width and height from the screenshot tool response.

x number y number sessionId string screenshotWidth number screenshotHeight number
swipe
annotations: none low

Swipe from one pixel coordinate to another. Use the width and height from the screenshot tool response.

endX number endY number startX number startY number sessionId string durationMs number screenshotWidth number screenshotHeight number
type_text
annotations: none low

Type text into the currently focused input field (tap the field first).

text string sessionId string
press_key
annotations: none low

Press a keyboard key by its KeyboardEvent.code name: "Enter", "Backspace", "Escape", "Tab",

key string sessionId string
press_button
annotations: none low

Press a hardware button by a cross-platform name: "home", "lock", "volume_up", "volume_down" work on both

button string sessionId string
install_app
annotations: none low

Install an app on the device. Requires connect_device first. Waits up to 60 seconds.

buildId number sessionId string
launch_app
annotations: none low

Launch an installed app on the device. Requires connect_device first. Waits up to 15 seconds.

buildId number sessionId string

Permissions 4

network medium
Server uses network capabilities via: fetch(), ws
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 50

low
Tool 'list_builds' has no annotations annotation_checker · 100%
low
Tool 'list_devices' has no annotations annotation_checker · 100%
low
Tool 'connect_device' has no annotations annotation_checker · 100%
low
Tool 'disconnect_device' has no annotations annotation_checker · 100%
low
Tool 'boot_device' has no annotations annotation_checker · 100%
low
Tool 'shutdown_device' has no annotations annotation_checker · 100%
low
Tool 'query_ui_tree' has no annotations annotation_checker · 100%
low
Tool 'run_flow' has no annotations annotation_checker · 100%
low
Tool 'screenshot' has no annotations annotation_checker · 100%
low
Tool 'tap' has no annotations annotation_checker · 100%
low
Tool 'swipe' has no annotations annotation_checker · 100%
low
Tool 'type_text' has no annotations annotation_checker · 100%
low
Tool 'press_key' has no annotations annotation_checker · 100%
low
Tool 'press_button' has no annotations annotation_checker · 100%
low
Tool 'install_app' has no annotations annotation_checker · 100%
low
Tool 'launch_app' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 85 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: yaml@2.6.0 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.4.2 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.4.2 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Buffer.from base64 in jo-duchan-tapflow-a444885/packages/relay/src/RelayServer.ts:2161 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: list_builds manifest_parser · 85%
info
Tool: list_devices manifest_parser · 85%
info
Tool: connect_device manifest_parser · 85%
info
Tool: disconnect_device manifest_parser · 85%
info
Tool: boot_device manifest_parser · 85%
info
Tool: shutdown_device manifest_parser · 85%
info
Tool: query_ui_tree manifest_parser · 85%
info
Tool: run_flow manifest_parser · 85%
info
Tool: screenshot manifest_parser · 85%
info
Tool: tap manifest_parser · 85%
info
Tool: swipe manifest_parser · 85%
info
Tool: type_text manifest_parser · 85%
info
Tool: press_key manifest_parser · 85%
info
Tool: press_button manifest_parser · 85%
info
Tool: install_app manifest_parser · 85%
info
Tool: launch_app manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (54) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 98 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%