baton-run

MCPattested
v0.2.10kanumuri9593MITUpdated 1d agonpmGitHub

Local run control plane for people and coding agents: launch, hot-reload, screenshot and check Flutter, web, React Native and native iOS/Android apps.

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build
A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.
536Downloads/wk
1GitHub stars
1d agoLast update
Package
Authorkanumuri9593
LicenseMIT
Version0.2.10
Sourcenpm+mcp-registry
Trust Status
A
85/100Trusted
✓Listed in Forge index+10/10
✓Identity verified · attested build+20/20
—Ed25519 publish signature+0/5
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
✓npm Trusted Publishing (Sigstore)+5/5
—npm maintainer match+0/5
→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusIdentity verified
PublisherUnverified
SignatureUnsigned
Domain—
Provenance✓ Sigstore-verified · f66bed3
Dependencies✓ 60 resolved+ · none vulnerable
Tool surface29 tools · 1 privileged
Security scan✓ Cleanv0.2.10 · todayHow well does this scan work?
EvalsNone
IndexedOct 13, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

29 tools · 1 privileged
Statically extracted from the published packagev0.2.10 · 1h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

diagnoseSearch bounded log and network evidence across projects. Defaults to errors only and 20 findings.

Search bounded log and network evidence across projects. Defaults to errors only and 20 findings.

No input schema was published for this tool.

run_workflowLaunch up to eight project targets in dependency order and wait for each to become ready, in one call. Stops launching dependents on failure. Returns compact session IDs, URLs and errors; retains sessions for debugging. Use browser/device tools next to validate the actual flow. Paths must be absolu…

Launch up to eight project targets in dependency order and wait for each to become ready, in one call. Stops launching dependents on failure. Returns compact session IDs, URLs and errors; retains sessions for debugging. Use browser/device tools next to validate the actual flow. Paths must be absolu…

No input schema was published for this tool.

inspect_projectRead fresh launch sources, configuration problems, nested projects and guidance file paths. Does not run commands or expose environment values. Use before choosing an environment, checkout and device; review screenshot evidence rather than treating capture as visual approval.

Read fresh launch sources, configuration problems, nested projects and guidance file paths. Does not run commands or expose environment values. Use before choosing an environment, checkout and device; review screenshot evidence rather than treating capture as visual approval.

No input schema was published for this tool.

list_targetsList everything runnable in a project: launch.json configs, package.json dev scripts, Flutter entrypoints.

List everything runnable in a project: launch.json configs, package.json dev scripts, Flutter entrypoints.

No input schema was published for this tool.

list_sessionsList running sessions with their status, capabilities, URLs and device.

List running sessions with their status, capabilities, URLs and device.

No input schema was published for this tool.

list_checkoutsList git checkouts this project can run from: This checkout, linked worktrees, local branches, remotes.

List git checkouts this project can run from: This checkout, linked worktrees, local branches, remotes.

No input schema was published for this tool.

run_targetStart a target by name. Returns the new session id to use with the other tools. Optional branch or checkout runs from a git worktree without moving the current folder.

Start a target by name. Returns the new session id to use with the other tools. Optional branch or checkout runs from a git worktree without moving the current folder.

No input schema was published for this tool.

hot_reloadHot reload a session, keeping app state. Flutter only. Returns code 0 on success; a non-zero code carries the compile error.

Hot reload a session, keeping app state. Flutter only. Returns code 0 on success; a non-zero code carries the compile error.

No input schema was published for this tool.

hot_restartHot restart a session, dropping app state. For web dev servers and plain processes this reboots the process.

Hot restart a session, dropping app state. For web dev servers and plain processes this reboots the process.

No input schema was published for this tool.

stop_sessionStop one session, or every running session with all=true.

Stop one session, or every running session with all=true.

No input schema was published for this tool.

forget_sessionRemove stopped sessions from the list. Running sessions must be stopped first. Use all=true to clear every stopped session.

Remove stopped sessions from the list. Running sessions must be stopped first. Use all=true to clear every stopped session.

No input schema was published for this tool.

read_logsRead recent output from a session, newest last. Use filter to grep for an error: it searches

Read recent output from a session, newest last. Use filter to grep for an error: it searches

No input schema was published for this tool.

list_run_historyList past and current runs persisted on disk -- survives daemon restarts. Each line is

List past and current runs persisted on disk -- survives daemon restarts. Each line is

No input schema was published for this tool.

list_network_requestsList HTTP requests the app has made, newest last. One line each:

List HTTP requests the app has made, newest last. One line each:

No input schema was published for this tool.

get_network_requestOne captured request in full: headers, timeline events, and optionally the bodies.

One captured request in full: headers, timeline events, and optionally the bodies.

No input schema was published for this tool.

clear_network_requestsForget every captured request for a session, in the daemon and in the app itself.

Forget every captured request for a session, in the daemon and in the app itself.

No input schema was published for this tool.

read_launch_configRead a project's launch.json exactly as written -- comments, formatting and all -- plus the

Read a project's launch.json exactly as written -- comments, formatting and all -- plus the

No input schema was published for this tool.

write_launch_configprivilegedOVERWRITE a project's launch.json with the text given. The whole file is replaced, so read it

OVERWRITE a project's launch.json with the text given. The whole file is replaced, so read it

No input schema was published for this tool.

list_devicesList connected devices, simulators and emulators available to Flutter. Use boot_device to start one that is not running.

List connected devices, simulators and emulators available to Flutter. Use boot_device to start one that is not running.

No input schema was published for this tool.

set_debug_flagToggle a framework debug flag on a running Flutter session, e.g. ext.flutter.debugPaint with {enabled: true} or ext.flutter.timeDilation with {timeDilation: 5}. Values are sent as the strings Flutter expects.

Toggle a framework debug flag on a running Flutter session, e.g. ext.flutter.debugPaint with {enabled: true} or ext.flutter.timeDilation with {timeDilation: 5}. Values are sent as the strings Flutter expects.

No input schema was published for this tool.

screenshotCapture the screen of a running session so the visual result of a change can be checked.

Capture the screen of a running session so the visual result of a change can be checked.

No input schema was published for this tool.

check_changeAfter editing code: apply the change and return the evidence in one call, instead of

After editing code: apply the change and return the evidence in one call, instead of

No input schema was published for this tool.

boot_deviceBoot an iOS simulator or Android emulator by name (e.g. "iPhone 17 Pro", "Pixel_8") or id,

Boot an iOS simulator or Android emulator by name (e.g. "iPhone 17 Pro", "Pixel_8") or id,

No input schema was published for this tool.

wait_forBlock until a session reaches a state. Use after run_target or hot_restart instead of polling read_logs.

Block until a session reaches a state. Use after run_target or hot_restart instead of polling read_logs.

No input schema was published for this tool.

session_summaryCheap structured overview -- call this before deciding what to do next.

Cheap structured overview -- call this before deciding what to do next.

No input schema was published for this tool.

run_proofRun proof verification and return a zip with screenshots, network call counts, response times and logs.

Run proof verification and return a zip with screenshots, network call counts, response times and logs.

No input schema was published for this tool.

list_proofsList past proof bundles, newest first.

List past proof bundles, newest first.

No input schema was published for this tool.

show_dashboardShow a live Baton control panel in the chat: every running app with its simulator or URL, status, CPU and memory;

Show a live Baton control panel in the chat: every running app with its simulator or URL, status, CPU and memory;

No input schema was published for this tool.

dashboard_actionUsed by the Baton card: refresh; catalog (projects and devices for New run); run a project target on a device; boot a device;

Used by the Baton card: refresh; catalog (projects and devices for New run); run a project target on a device; boot a device;

No input schema was published for this tool.

29 of 29 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Local run control plane for people and coding agents: launch, hot-reload, screenshot and check Flutter, web, React Native and native iOS/Android apps.

Keywords
batonmcpmodel-context-protocolcoding-agentsai-agentsagent-toolsdeveloper-toolsflutterhot-reloadhudlaunch.jsondev-serverreact-nativenextjsviteclisimulatorios-simulatorandroid-emulatormonorepomulti-projectdevtools
Alternatives
Comparing tool surfaces…

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-13 — observed resolution, not a publisher declaration.

60 packages resolved · 12 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

63 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

+51 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.