# @buoy-gg/mcp Let AI agents read and drive a running React Native or Flutter app through Buoy's devtools. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 7.0.41 - **Author:** io.github.Buoy-gg - **License:** Unknown - **npm:** @buoy-gg/mcp - **Source:** https://github.com/Buoy-gg/buoy - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-10-13T23:16:39.337Z - **Version scanned:** 7.0.67 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_devices` — List the apps connected to Buoy: id, name, platform, whether it is connected and has MCP access, the simulator or phone it runs on with the host controls that w - `list_tool_actions` — List the actions a tool exposes, and which connected devices offer it. Leave toolId out to list every tool's actions. Use the action names with call_action. - `get_snapshot` — Read a tool's current state (its sync snapshot) from a device. Starts watching the tool and returns the next fresh snapshot. - `call_action` — Invoke any action a tool exposes (see list_tool_actions) and return its result. This is the generic escape hatch that works for every Buoy tool. - `sim_farm_status` — Show the Sim Farm: how many farm simulators exist, which are awake or in use and by whom, free memory and disk, how many more sims fit, templates, leases, and r - `sim_farm_setup` - `sim_farm_acquire` - `sim_farm_release` — Give one lease's sims back. `fast` (default) stops the app and restores its seeded data in about 2 s; `full` rebuilds each sim from the template. Use `full` aft - `sim_farm_action` — Act on sims in your lease: `screenshot` (returns file paths), `open-url` (deep link, pass `url`), `launch` the app, `reset` (restore seeded app data), or `rebui - `sim_farm_lock` — Hold or free a Mac-wide lock tied to your lease. `perf-slot` is for fair speed tests: while you hold it the farm boots, clones and screenshots nothing else, and - `sim_farm_report` — Tell the person how your run is going. They watch it live in Buoy Desktop. Send one when a sim starts work, passes, fails or needs help, with a short note. `cou - `sim_farm_extend` — Ask for more time on your run before deadlineAt. The farm never goes past the run's cap (capAt). It says how much you got. - `sim_farm_finish` — End your run with a result. Gives back every sim it still holds. The person sees the summary in Buoy Desktop, so make it one or two plain sentences, e.g. 'Idea - `run_benchmark_batch` — Run a perf-monitor benchmark batch and return per-metric leaders, risk flags and a comparison of available case results. Give it a target route and a matrix of - `get_automation_status` — Get the perf-monitor automation batch status (current phase + last completed batch) without waiting. - `wait_for_automation` — Block until the in-flight perf-monitor batch finishes, then return its ranked comparison. Use this if a batch was started another way (e.g. on the device). - `get_batch_report` — Re-rank a previously-run benchmark batch by its batchId (from the saved recordings index). - `compare_reports` — Compare two saved benchmark runs head-to-head. Native runs: avg + p95 for FPS/CPU/memory, jank. Browser runs: FPS, frame gaps, long tasks, slow-frame scripts, i - `get_benchmark_settings` — Read the device's saved benchmark settings (per-page duration, runs, cooldown, reload, shuffle) in plain English with a time estimate. Call this before run_benc - `set_benchmark_settings` — PERSIST benchmark settings on the device so they stick across runs. Only use when the user explicitly wants to save a change ("always", "save this"). For a one- - `get_events` — Read retained events from connected Buoy sources. Filter with sources, such as ['network'], ['redux'], ['react-query'], ['storage'] or ['route']. Returns compac - `network_conditions` — Read or set the device's network conditions. Offline blocks new intercepted HTTP requests; slow adds 500 ms and verySlow adds 2000 ms before dispatch. Normal cl - `get_network_requests` - `get_network_request` — Read ONE captured request by its id (from get_network_requests): method, URL, status, whether a mock produced it, request and response headers (secrets redacted - `network_action` — Pin or save captured requests as retained records, or remove records and clear lists. Bodies may be truncated or omitted by storage budgets. Records are kept se - `network_override` — Configure response, failure or delay rules for supported requests intercepted by the app integration. Coverage depends on transport, hooks and rule-loading timi - `get_react_query` — Read queries reported by the connected React Query integration, including available status, observer counts, timestamps and errors. includeData:true requests ca - `react_query_action` — Mutate the app's React Query cache: invalidate / refetch / reset / remove a single query (by queryHash, from get_react_query), or clear the entire query cache. - `get_zustand_state` - `zustand_action` - `get_jotai_state` - `jotai_action` - `get_redux_state` - `redux_dispatch` - `get_storage` - `storage_action` - `screenshot_component` - `run_flow` - `screen_recording` - `native_tap` ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@buoy-gg/mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on your machine; read-only tool surface. - Floor 13, ceiling 31 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40buoy-gg%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/%40buoy-gg%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40buoy-gg%2Fmcp - HTML page: https://forgeregistry.com/registry/%40buoy-gg%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.