MCP server with WebdriverIO for browser and mobile app automation (iOS/Android via Appium)
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
navigateLoads a URL in the current tab and waits for the page load event. Resets page state — DOM, JS runtime, timers, and frame context are destroyed. Use instead of clicking links when the target URL is known.Loads a URL in the current tab and waits for the page load event. Resets page state — DOM, JS runtime, timers, and frame context are destroyed. Use instead of clicking links when the target URL is known.
No input schema was published for this tool.
click_elementClicks an element. On web pages the result lists what changed (new elements with refs, or the new page). In apps it does not: take a snapshot to see the new screen. Several steps in a row: perform_actions.Clicks an element. On web pages the result lists what changed (new elements with refs, or the new page). In apps it does not: take a snapshot to see the new screen. Several steps in a row: perform_actions.
No input schema was published for this tool.
set_valueReplaces the text of an input or textarea. On web pages the result lists what changed (new elements with refs, or the new page). In apps it does not: take a snapshot to see the new screen. To fill several fields or fill and then click, use one perform_actions call.Replaces the text of an input or textarea. On web pages the result lists what changed (new elements with refs, or the new page). In apps it does not: take a snapshot to see the new screen. To fill several fields or fill and then click, use one perform_actions call.
No input schema was published for this tool.
scrollScrolls the page vertically by a pixel amount. Browser-only — for mobile scrolling use swipe. Only supports up/down; no horizontal scrolling.Scrolls the page vertically by a pixel amount. Browser-only — for mobile scrolling use swipe. Only supports up/down; no horizontal scrolling.
No input schema was published for this tool.
set_cookieSets a browser cookie on the active session. The browser must already be on the target domain — cookies cannot be set cross-domain. Use to inject session tokens or feature flags without login flows.Sets a browser cookie on the active session. The browser must already be on the target domain — cookies cannot be set cross-domain. Use to inject session tokens or feature flags without login flows.
No input schema was published for this tool.
delete_cookiesprivilegedDeletes all cookies or a single cookie by name from the current browser session. Irreversible — deleted cookies cannot be recovered.Deletes all cookies or a single cookie by name from the current browser session. Irreversible — deleted cookies cannot be recovered.
No input schema was published for this tool.
tap_elementTaps an element (ref from snapshot, or selector) or taps at absolute screen coordinates (x, y). A tap on an element lists what changed on the screen. No scroll-into-view or wait — element must already be visible on screen. Use instead of click_element on iOS where element.click() is ignored. Provid…Taps an element (ref from snapshot, or selector) or taps at absolute screen coordinates (x, y). A tap on an element lists what changed on the screen. No scroll-into-view or wait — element must already be visible on screen. Use instead of click_element on iOS where element.click() is ignored. Provid…
No input schema was published for this tool.
swipePerforms a full-screen swipe gesture. Direction is content movement — "up" scrolls content upward (finger moves down). For browser scrolling use scroll; for dragging a specific element use drag_and_drop. No error if content cannot scroll further. Mobile-only.Performs a full-screen swipe gesture. Direction is content movement — "up" scrolls content upward (finger moves down). For browser scrolling use scroll; for dragging a specific element use drag_and_drop. No error if content cannot scroll further. Mobile-only.
No input schema was published for this tool.
drag_and_dropprivilegedDrags an element to another element or to relative x/y offsets. x and y are offsets from the source element, not absolute screen coordinates (unlike tap_element). Provide targetSelector OR both x and y. Mobile-only.Drags an element to another element or to relative x/y offsets. x and y are offsets from the source element, not absolute screen coordinates (unlike tap_element). Provide targetSelector OR both x and y. Mobile-only.
No input schema was published for this tool.
switch_contextSwitches between native and webview automation contexts in a hybrid mobile app. In NATIVE_APP context, use accessibility IDs; in WEBVIEW_* context, use CSS/XPath. Changes persist for all subsequent commands. Accepts context name or 1-based index. Use get_contexts to discover available targets. Mobi…Switches between native and webview automation contexts in a hybrid mobile app. In NATIVE_APP context, use accessibility IDs; in WEBVIEW_* context, use CSS/XPath. Changes persist for all subsequent commands. Accepts context name or 1-based index. Use get_contexts to discover available targets. Mobi…
No input schema was published for this tool.
hide_keyboardDismisses the on-screen keyboard on mobile. Call after text entry when the keyboard obscures elements. No-op if already hidden. Mobile-only.Dismisses the on-screen keyboard on mobile. Call after text entry when the keyboard obscures elements. No-op if already hidden. Mobile-only.
No input schema was published for this tool.
rotate_deviceRotates a mobile device to portrait or landscape orientation. Waits for the OS rotation animation to complete. Use to test orientation-dependent layouts. Mobile-only; no effect in browser sessions.Rotates a mobile device to portrait or landscape orientation. Waits for the OS rotation animation to complete. Use to test orientation-dependent layouts. Mobile-only; no effect in browser sessions.
No input schema was published for this tool.
set_geolocationOverrides GPS coordinates for the session. Affects navigator.geolocation in browsers and location services on mobile. Location permissions must already be granted to the app.Overrides GPS coordinates for the session. Affects navigator.geolocation in browsers and location services on mobile. Location permissions must already be granted to the app.
No input schema was published for this tool.
execute_scriptRuns JavaScript in the page (`return` a value; string args that match a selector are passed as elements) or, on Appium, a "mobile: <command>" with args. Prefer the dedicated tools for clicks and typing.Runs JavaScript in the page (`return` a value; string args that match a selector are passed as elements) or, on Appium, a "mobile: <command>" with args. Prefer the dedicated tools for clicks and typing.
No input schema was published for this tool.
get_elementsReturns interactable elements on the current page with selectors, text, and bounding boxes. Supports filtering by element type, viewport visibility, and pagination. Use when the wdio://session/current/elements resource does not return desired elements.Returns interactable elements on the current page with selectors, text, and bounding boxes. Supports filtering by element type, viewport visibility, and pagination. Use when the wdio://session/current/elements resource does not return desired elements.
No input schema was published for this tool.
launch_chromeLaunches Chrome with remote debugging enabled. Wipes and recreates a temporary profile directory on each call. Mode "newInstance" (default) runs alongside existing Chrome; "freshSession" starts with an empty profile. Set copyProfileFiles to copy cookies/logins from your Default profile — changes do…Launches Chrome with remote debugging enabled. Wipes and recreates a temporary profile directory on each call. Mode "newInstance" (default) runs alongside existing Chrome; "freshSession" starts with an empty profile. Set copyProfileFiles to copy cookies/logins from your Default profile — changes do…
No input schema was published for this tool.
emulate_deviceEmulates a mobile or tablet device in the current browser session by setting viewport, DPR, user-agent, and touch events. Requires a BiDi-enabled session (start_session with capabilities: { webSocketUrl: true }). Omit device to list available presets. Pass "reset" to restore desktop defaults. Chang…Emulates a mobile or tablet device in the current browser session by setting viewport, DPR, user-agent, and touch events. Requires a BiDi-enabled session (start_session with capabilities: { webSocketUrl: true }). Omit device to list available presets. Pass "reset" to restore desktop defaults. Chang…
No input schema was published for this tool.
mockNo description publishedThis tool published no description. Forge does not invent one.
get_mock_callsRead current call arguments for a mock in the active session. Use the same target as mock. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName; browser mocks require url and accept method. Appium sessions are unsupport…Read current call arguments for a mock in the active session. Use the same target as mock. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName; browser mocks require url and accept method. Appium sessions are unsupport…
No input schema was published for this tool.
manage_mockManage a mock in the active session. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName; browser mocks require url and accept method. Appium sessions are unsupported. clear removes call history, reset also removes con…Manage a mock in the active session. mockType defaults to browser in WebDriver sessions and is required in Electron sessions. Electron mocks require apiName and funcName; browser mocks require url and accept method. Appium sessions are unsupported. clear removes call history, reset also removes con…
No input schema was published for this tool.
enable_toolsNo description publishedThis tool published no description. Forge does not invent one.
start_sessionStarts a browser, Electron app or mobile app session (closes the active one). Browsers run headless at 1280x800 by default; pass navigationUrl to open a page right away. attach: true connects to a running Chrome via CDP.Starts a browser, Electron app or mobile app session (closes the active one). Browsers run headless at 1280x800 by default; pass navigationUrl to open a page right away. attach: true connects to a running Chrome via CDP.
No input schema was published for this tool.
attach_sessionAttaches to an existing remote WebDriver or Appium session by ID without creating a new session. Only one session can be active at a time. The externally managed session is detached, not terminated, by default on close.Attaches to an existing remote WebDriver or Appium session by ID without creating a new session. Only one session can be active at a time. The externally managed session is detached, not terminated, by default on close.
No input schema was published for this tool.
close_sessionCloses the session, or with detach: true disconnects and leaves it running. Attached sessions and Appium sessions with noReset are detached unless detach: false.Closes the session, or with detach: true disconnects and leaves it running. Attached sessions and Appium sessions with noReset are detached unless detach: false.
No input schema was published for this tool.
switch_tabSwitches to a tab by handle or 0-based index (see get_tabs). Later tools act on that tab.Switches to a tab by handle or 0-based index (see get_tabs). Later tools act on that tab.
No input schema was published for this tool.
switch_frameSwitches into an iframe (ref or selector), or back to the top page when selector is omitted. Later tools act inside the frame until you switch back. Returns the frame's elements.Switches into an iframe (ref or selector), or back to the top page when selector is omitted. Later tools act inside the frame until you switch back. Returns the frame's elements.
No input schema was published for this tool.
list_appsList apps uploaded to a cloud provider (BrowserStack App Automate, Sauce Labs App Storage, TestMu Real Device Cloud, TestingBot Storage, or Digital.ai Applications). Reads provider-specific credentials from environment.List apps uploaded to a cloud provider (BrowserStack App Automate, Sauce Labs App Storage, TestMu Real Device Cloud, TestingBot Storage, or Digital.ai Applications). Reads provider-specific credentials from environment.
No input schema was published for this tool.
upload_appprivilegedUpload a local .apk or .ipa to a cloud provider (BrowserStack, Sauce Labs, TestMu, TestingBot, or Digital.ai). Returns the app URL for use in start_session.Upload a local .apk or .ipa to a cloud provider (BrowserStack, Sauce Labs, TestMu, TestingBot, or Digital.ai). Returns the app URL for use in start_session.
No input schema was published for this tool.
query_docsNo description publishedThis tool published no description. Forge does not invent one.
get_screenshotTakes a screenshot of the current page or screen and returns a base64-encoded image, resized and compressed for model context limits.Takes a screenshot of the current page or screen and returns a base64-encoded image, resized and compressed for model context limits.
No input schema was published for this tool.
snapshotNo description publishedThis tool published no description. Forge does not invent one.
select_optionNo description publishedThis tool published no description. Forge does not invent one.
press_keyNo description publishedThis tool published no description. Forge does not invent one.
perform_actionsNo description publishedThis tool published no description. Forge does not invent one.
get_accessibility_treeNo description publishedThis tool published no description. Forge does not invent one.
get_tabsNo description publishedThis tool published no description. Forge does not invent one.
get_contextsNo description publishedThis tool published no description. Forge does not invent one.
get_app_stateNo description publishedThis tool published no description. Forge does not invent one.
get_cookiesNo description publishedThis tool published no description. Forge does not invent one.
open_web_extensionNo description publishedThis tool published no description. Forge does not invent one.
27 of 40 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
MCP server with WebdriverIO for browser and mobile app automation (iOS/Android via Appium)
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
163 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+151 more not listed. The counts by reason above cover all of them.
Not followed: optionalDependencies, peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.