Official MCP server for agent-device, Callstack's device automation CLI for inspecting, controlling, debugging, recording, and collecting evidence from iOS, Android, TV, macOS, Linux, React Native, Expo, Flutter, and native apps.
Agent Device MCP exposes structured tools backed by `AgentDeviceClient`; the docs state it does not expose generic shell execution over MCP., Tools and CLI workflows can open apps, inspect UI, tap, type, scroll, perform gestures, wait, assert state, handle alerts, and close sessions., Evidence workflows can capture screenshots, recordings, logs, traces, network traffic, performance samples, crash context, React profiles, and replay files., Mutating commands should run serially against one session, and separate sessions or devices should be used for parallel work., Prefer dedicated test devices or simulators, and require approval before entering credentials, submitting forms, changing settings, installing apps, sending messages, or touching production accounts.
Privacy notes
Screenshots, recordings, traces, logs, network dumps, replay files, reports, UI snapshots, typed input, and React profiles can contain private UI state, tokens, request data, customer information, or credentials., macOS, iOS, Android, and TV automation can expose local app state, notifications, device names, package identifiers, app content, system dialogs, and permission prompts., Network inspection artifacts may include headers, payloads, session identifiers, URLs, and API data; review before sharing or committing., Interactive CLI runs may check npm for newer package versions unless `AGENT_DEVICE_NO_UPDATE_NOTIFIER=1` is set.
Author
Callstack
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 4 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.
4 areas
SafetyExecution & processesAgent Device MCP exposes structured tools backed by `AgentDeviceClient`; the docs state it does not expose generic shell execution over MCP.
SafetyCredentials & tokensTools and CLI workflows can open apps, inspect UI, tap, type, scroll, perform gestures, wait, assert state, handle alerts, and close sessions.
SafetyNetwork accessEvidence workflows can capture screenshots, recordings, logs, traces, network traffic, performance samples, crash context, React profiles, and replay files.
SafetyCredentials & tokensMutating commands should run serially against one session, and separate sessions or devices should be used for parallel work.
SafetyCredentials & tokensPrefer dedicated test devices or simulators, and require approval before entering credentials, submitting forms, changing settings, installing apps, sending messages, or touching production accounts.
PrivacyCredentials & tokensScreenshots, recordings, traces, logs, network dumps, replay files, reports, UI snapshots, typed input, and React profiles can contain private UI state, tokens, request data, customer information, or credentials.
PrivacyPermissions & scopesmacOS, iOS, Android, and TV automation can expose local app state, notifications, device names, package identifiers, app content, system dialogs, and permission prompts.
PrivacyCredentials & tokensNetwork inspection artifacts may include headers, payloads, session identifiers, URLs, and API data; review before sharing or committing.
PrivacyExecution & processesInteractive CLI runs may check npm for newer package versions unless `AGENT_DEVICE_NO_UPDATE_NOTIFIER=1` is set.
Safety notes
Agent Device MCP exposes structured tools backed by `AgentDeviceClient`; the docs state it does not expose generic shell execution over MCP.
Tools and CLI workflows can open apps, inspect UI, tap, type, scroll, perform gestures, wait, assert state, handle alerts, and close sessions.
Evidence workflows can capture screenshots, recordings, logs, traces, network traffic, performance samples, crash context, React profiles, and replay files.
Mutating commands should run serially against one session, and separate sessions or devices should be used for parallel work.
Prefer dedicated test devices or simulators, and require approval before entering credentials, submitting forms, changing settings, installing apps, sending messages, or touching production accounts.
Privacy notes
Screenshots, recordings, traces, logs, network dumps, replay files, reports, UI snapshots, typed input, and React profiles can contain private UI state, tokens, request data, customer information, or credentials.
macOS, iOS, Android, and TV automation can expose local app state, notifications, device names, package identifiers, app content, system dialogs, and permission prompts.
Network inspection artifacts may include headers, payloads, session identifiers, URLs, and API data; review before sharing or committing.
Interactive CLI runs may check npm for newer package versions unless `AGENT_DEVICE_NO_UPDATE_NOTIFIER=1` is set.
Prerequisites
Node.js 22 or newer and `agent-device` installed globally or project-locally.
Xcode tooling for iOS, tvOS, or macOS targets, or Android SDK and ADB for Android targets.
Device, simulator, emulator, TV, macOS, or Linux desktop target that the agent is allowed to automate.
Required local permissions such as Android device trust, iOS Developer Mode, macOS Accessibility, and Screen Recording where applicable.
Dedicated test apps, test accounts, and controlled artifact directories before using real-device automation.
Agent Device MCP Server exposes structured MCP tools for Callstack's
agent-device CLI. It gives Claude and other agents a device-aware way to open
apps, inspect current UI state, interact with visible refs and selectors, verify
changes through fresh snapshots, collect debugging evidence, and close sessions.
The project targets iOS, Android, tvOS, Android TV, macOS, Linux desktop, React
Native, Expo, Flutter, and native apps. Its docs position the CLI as a live app
verification layer for agents, with compact accessibility snapshots, semantic
refs, screenshots, recordings, logs, traces, network evidence, performance
samples, crash context, React profiles, and replayable .ad scripts.
These sources were reviewed on 2026-06-06. Prefer the live repository,
agent setup docs, npm registry metadata, README, MCP metadata, installation
docs, security guidance, package metadata, and license for current setup
commands, supported targets, permissions, and trust guidance.
Features
Official stdio MCP server through agent-device mcp.
MCP metadata for the agent-device npm package.
Claude Code, Cursor, Windsurf, Cline, Goose, Codex, and project-rule setup guidance.
UI inspection through compact accessibility snapshots, interactive refs, selectors, and React Native component trees.
App interaction through open, tap, type, scroll, gestures, waits, assertions, alert handling, and session closing.
Evidence capture with screenshots, video recordings, logs, traces, network traffic, performance samples, crash context, and React profiles.
Replayable .ad workflow scripts for local runs, CI, and repeatable checks.
iOS Simulator, Android Emulator, physical device, tvOS, Android TV, macOS, and Linux desktop support.
Local security guidance for permissions, artifacts, update notices, network captures, and responsible disclosure.
Installation
Install the CLI on the machine where the agent will run:
npm install -g agent-device@latest
agent-device --version
agent-device help workflow
For Claude Code, add the stdio MCP server:
claude mcp add --transport stdio --scope user agent-device -- agent-device mcp
Use a project-local install or a human-selected pinned package version for
unattended agent workflows. The docs warn against asking agents to choose a
version or silently run mutable latest-version npx installs without an
explicit trust decision.
Use Cases
Verify a mobile feature by opening an app, taking a snapshot, acting on refs, and re-checking state.
Capture screenshots, logs, traces, or network evidence for a regression before proposing a code fix.
Turn an exploratory interaction into a replayable workflow for later local or CI checks.
Inspect React Native component trees, props, state, hooks, slow renders, and rerenders when debugging UI behavior.
Use one agent-facing tool across iOS, Android, TV, desktop, Expo, Flutter, React Native, and native apps.
Keep device verification close to the coding workflow without exposing a generic shell through MCP.
Safety and Privacy
Agent Device MCP can control real apps and capture rich evidence. Use test
devices, simulators, emulators, and test accounts whenever possible. Require
review before actions that enter credentials, submit forms, change settings,
send messages, install apps, interact with production data, or automate personal
devices.
Treat artifacts as sensitive. Screenshots, recordings, logs, traces, network
dumps, reports, replay files, app state, and React profiles can include tokens,
credentials, private UI, customer data, API payloads, or unreleased product
details. Store artifacts in controlled directories, sanitize before sharing, and
avoid committing them unless they are intentional test fixtures.
Duplicate Check
The catalog already has mobile-next/mobile-mcp, which focuses on Mobile MCP
for iOS and Android automation. Agent Device is a separate Callstack package
with its own npm package, MCP metadata, agent setup docs, security guidance,
multi-target app verification workflow, evidence capture, replay, debugging,
profiling, and desktop/TV support. No callstack/agent-device, agent-device
MCP, or matching source URL entry was found in content/mcp, content/tools,
content/guides, content/agents, or content/skills.
Show that Agent Device MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/agent-device-mcp-server)
How it compares
Agent Device MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Official MCP server for agent-device, Callstack's device automation CLI for inspecting, controlling, debugging, recording, and collecting evidence from iOS, Android, TV, macOS, Linux, React Native, Expo, Flutter, and native apps.
MCP server for controlling iOS simulators from AI agents, including simulator discovery, UI taps, typing, swipes, accessibility inspection, screenshots, video recording, app install, and app launch.
WebDriverIO MCP server that lets Claude automate browsers and mobile apps with navigation, clicks, typing, screenshots, accessibility snapshots, cookies, geolocation, native app sessions, and Appium-style gestures.
✓Agent Device MCP exposes structured tools backed by `AgentDeviceClient`; the docs state it does not expose generic shell execution over MCP.
Tools and CLI workflows can open apps, inspect UI, tap, type, scroll, perform gestures, wait, assert state, handle alerts, and close sessions.
Evidence workflows can capture screenshots, recordings, logs, traces, network traffic, performance samples, crash context, React profiles, and replay files.
Mutating commands should run serially against one session, and separate sessions or devices should be used for parallel work.
Prefer dedicated test devices or simulators, and require approval before entering credentials, submitting forms, changing settings, installing apps, sending messages, or touching production accounts.
✓Use version 1.3.3 or newer. The upstream security policy documents command-injection vulnerabilities in older versions and states that they were fixed in v1.3.3.
The server invokes simulator, IDB, and host commands to tap, type, swipe, screenshot, record video, install apps, launch apps, and stop recordings.
Filter high-risk or noisy tools with `IOS_SIMULATOR_MCP_FILTERED_TOOLS` when an agent should only inspect UI state.
App install and launch tools can execute simulator app code, change simulator state, and interact with test credentials or local development services.
Screenshots and recordings can overwrite or create files in configured output directories; review paths before letting an agent write artifacts.
✓WebDriverIO MCP Server can navigate pages, click elements, type values, scroll, switch frames or tabs, execute scripts, set cookies, delete cookies, set geolocation, and capture screenshots.
Mobile tools can tap, swipe, drag, rotate devices, hide keyboards, switch native or web contexts, upload apps, and interact with iOS or Android sessions through WebDriverIO-compatible backends.
Treat browser and mobile sessions as active automation, not passive inspection; use test accounts and avoid production workflows that can submit forms, trigger purchases, send messages, or mutate customer data.
Script execution, cookie mutation, geolocation spoofing, and cloud-device provider integrations should be limited to reviewed test environments.
HTTP transport mode can expose automation tools beyond a local stdio process; bind it carefully and require network controls before shared use.
✓Browser pages can contain prompt-injection text in visible content, hidden HTML, ARIA labels, console output, network responses, or page metadata.
The server can navigate pages, click, hover, fill forms, drag, upload files, accept dialogs, dismiss dialogs, go through history, change viewport size, close tabs, and restart Firefox.
Enabling evaluate_script allows arbitrary JavaScript in page context; compromised instructions could read page data, modify the DOM, or interact with accessible browser APIs.
Enabling privileged context tools with the required Firefox system-access environment variable can expose privileged Firefox APIs and may extend beyond web-content sandbox boundaries.
Connect-existing mode can attach to a real browsing session with cookies, logins, active tabs, history, and saved state, so avoid it unless the profile is dedicated to automation.
Accepting insecure certificates weakens TLS validation and can hide man-in-the-middle or misconfiguration signals.
Privacy notes
✓Screenshots, recordings, traces, logs, network dumps, replay files, reports, UI snapshots, typed input, and React profiles can contain private UI state, tokens, request data, customer information, or credentials.
macOS, iOS, Android, and TV automation can expose local app state, notifications, device names, package identifiers, app content, system dialogs, and permission prompts.
Network inspection artifacts may include headers, payloads, session identifiers, URLs, and API data; review before sharing or committing.
Interactive CLI runs may check npm for newer package versions unless `AGENT_DEVICE_NO_UPDATE_NOTIFIER=1` is set.
✓Tool results may expose app screens, accessibility labels, text fields, screenshots, videos, bundle identifiers, simulator UDIDs, file paths, output directories, app paths, and environment variables.
Simulator apps may contain test accounts, customer fixtures, tokens, unreleased UI, internal URLs, logs, or private feature flags.
MCP transcripts, client logs, screenshots, videos, and saved artifacts can retain sensitive UI and app-state data outside the simulator.
Do not share recordings, screenshots, simulator data, app bundles, UDIDs, or output directories from proprietary apps unless the team has approved that disclosure.
✓Screenshots, accessibility trees, app state, cookies, URLs, page content, form values, device metadata, geolocation, trace artifacts, and generated test code can be visible to the MCP client, model provider, logs, and local files.
Browser sessions can inherit logged-in state, cookies, local storage, and private tabs from a test profile if profiles are reused.
Mobile testing can expose app screens, notification content, identifiers, credentials, uploaded app binaries, device logs, and cloud-device provider metadata.
Keep BrowserStack, Sauce Labs, Appium, application, and test-account credentials in secret storage or MCP environment configuration rather than prompts or repository files.
✓Page content, DOM snapshots, accessibility labels, console messages, network requests, headers, screenshots, uploaded file paths, extension names, Firefox prefs, and browser logs can be sent to the MCP client and model.
A regular Firefox profile can expose cookies, saved sessions, browsing history, account data, extensions, and private tabs to browser automation.
Screenshot save paths, uploaded files, downloaded artifacts, and model transcripts can reveal local project names, test data, credentials shown on pages, or customer information.
Use a separate profile, minimize enabled capabilities, avoid sensitive sites, and review provider/browser data handling before automating logged-in sessions.
Prerequisites
Node.js 22 or newer and `agent-device` installed globally or project-locally.
Xcode tooling for iOS, tvOS, or macOS targets, or Android SDK and ADB for Android targets.
Device, simulator, emulator, TV, macOS, or Linux desktop target that the agent is allowed to automate.
Required local permissions such as Android device trust, iOS Developer Mode, macOS Accessibility, and Screen Recording where applicable.
macOS with Xcode and iOS simulators installed.
Node.js and npx available for running the npm package.
Facebook IDB installed and available on PATH, or configured through `IOS_SIMULATOR_MCP_IDB_PATH`.
A booted simulator, or permission for the agent to open and interact with Simulator.
Node.js and npm or another package runner that can execute `@wdio/mcp`.
MCP client that can run local stdio servers, or a reviewed HTTP transport setup when using the server's HTTP mode.
Local browser, WebDriver, or WebDriverIO-compatible environment for the browser sessions you want Claude to control.
Appium, simulator, emulator, device, or cloud-device credentials when using iOS or Android automation.
Node.js 20.19.0 or newer.
Local Firefox 100 or newer, or an explicit Firefox binary path passed through the documented CLI option.
A dedicated Firefox automation profile with no personal cookies, saved passwords, or regular browsing sessions.
Optional adb and Firefox for Android setup when using Android automation mode.
Install
claude mcp add --transport stdio --scope user agent-device -- agent-device mcp
claude mcp add ios-simulator -- npx -y ios-simulator-mcp