← MCP Security Catalog

WebDriverIO MCP Server 3.12.0

npm · @wdio/mcp · latest release

Scan failed
Security result
33
Observed tools
—
Version rating
—
Change risk

Independent inventory

Observed 2026-09-04T08:14:48.416Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
attach_sessionAttaches to an existing remote WebDriver or Appium session by ID without creating a new session. Only one session can be active at a time. The externally managed session is detached, not terminated, by default on close.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string",
      "minLength": 1,
      "description": "Existing remote WebDriver/Appium session ID"
    },
    "provider": {
      "default": "local",
      "description": "Provider hosting the existing session (default: local). Use \"external\" for a custom W3C WebDriver endpoint.",
      "type": "string",
      "enum": [
        "local",
        "browserstack",
        "saucelabs",
        "testmu",
        "testingbot",
        "digitalai",
        "external"
      ]
    },
    "platform": {
      "type": "string",
      "enum": [
        "browser",
        "ios",
        "android"
      ],
      "description": "Existing session platform type (browser, ios, or android; Electron attachment is unsupported)."
    },
    "browser": {
      "description": "Browser for local command registration (browser platform only, default: chrome)",
      "type": "string",
      "enum": [
        "chrome",
        "firefox",
        "edge",
        "safari"
      ]
    },
    "automationName": {
      "description": "Appium automation driver for local command registration (mobile platforms only)",
      "type": "string",
      "enum": [
        "XCUITest",
        "UiAutomator2"
      ]
    },
    "webdriverConfig": {
      "description": "Existing W3C WebDriver endpoint connection (provider: \"external\" only). Defaults to 127.0.0.1:4445/.",
      "type": "object",
      "properties": {
        "protocol": {
          "default": "http",
          "type": "string"
        },
        "hostname": {
          "default": "127.0.0.1",
          "type": "string"
        },
        "port": {
          "default": 4445,
          "type": "number"
        },
        "path": {
          "default": "/",
          "type": "string"
        }
      }
    },
    "appiumConfig": {
      "description": "Appium server connection (local provider only)",
      "type": "object",
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "number"
        },
        "path": {
          "type": "string"
        },
        "protocol": {
          "type": "string"
        }
      }
    },
    "region": {
      "default": "eu-central-1",
      "description": "Sauce Labs region (default: eu-central-1). Only used with provider: \"saucelabs\".",
      "type": "string",
      "enum": [
        "us-west-1",
        "eu-central-1",
        "apac-southeast-1"
      ]
    },
    "trace": {
      "description": "Enable trace recording for subsequent commands — produces a Playwright-compatible zip saved to .trace/ on close_session.",
      "type": "boolean"
    },
    "capabilities": {
      "description": "Capabilities used to register the correct browser or Appium command surface locally; they are not sent to the remote endpoint",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    }
  },
  "required": [
    "sessionId",
    "platform"
  ]
}
Annotations
{
  "title": "Attach Session",
  "destructiveHint": false
}
——
click_elementWaits for an element, scrolls it into view, and fires element.click(). May trigger navigation, form submission, or modals. Browser sessions only — on iOS element.click() is silently ignored; use tap_element instead. Default timeout: 3000ms.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "selector": {
      "type": "string",
      "description": "Value for the selector, in the form of css selector or xpath (\"button.my-class\" or \"//button[@class='my-class']\" or \"button=Exact text with spaces\" or \"a*=Link containing text\")"
    },
    "scrollToView": {
      "description": "Whether to scroll the element into view before clicking",
      "type": "boolean"
    },
    "timeout": {
      "description": "Maximum time to wait for element in milliseconds",
      "type": "number"
    }
  },
  "required": [
    "selector"
  ]
}
Annotations
{
  "title": "Click Element",
  "destructiveHint": false
}
——
close_sessionCloses the current session or detaches without terminating. Detach preserves app state on the Appium server — sessions with noReset: true auto-detach by default. Closing a browser attach session terminates chromedriver but the Chrome process spawned by launch_chrome remains running.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "detach": {
      "description": "If true, disconnect without terminating; if false, terminate. When omitted, externally managed and auto-detach sessions are preserved while other sessions are terminated.",
      "type": "boolean"
    }
  }
}
Annotations
{
  "title": "Close Session",
  "destructiveHint": true
}
——
delete_cookiesDeletes all cookies or a single cookie by name from the current browser session. Irreversible — deleted cookies cannot be recovered.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "name": {
      "description": "Optional cookie name to delete a specific cookie. If not provided, deletes all cookies",
      "type": "string"
    }
  }
}
Annotations
{
  "title": "Delete Cookies",
  "destructiveHint": true,
  "idempotentHint": true
}
——
drag_and_dropDrags an element to another element or to relative x/y offsets. x and y are offsets from the source element, not absolute screen coordinates (unlike tap_element). Provide targetSelector OR both x and y. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "sourceSelector": {
      "type": "string",
      "description": "Source element selector to drag"
    },
    "targetSelector": {
      "description": "Target element selector to drop onto",
      "type": "string"
    },
    "x": {
      "description": "Target X offset (if no targetSelector)",
      "type": "number"
    },
    "y": {
      "description": "Target Y offset (if no targetSelector)",
      "type": "number"
    },
    "duration": {
      "description": "Drag duration in milliseconds",
      "type": "number",
      "minimum": 100,
      "maximum": 5000
    }
  },
  "required": [
    "sourceSelector"
  ]
}
Annotations
{
  "title": "Drag and Drop",
  "destructiveHint": false
}
——
emulate_deviceEmulates a mobile or tablet device in the current browser session by setting viewport, DPR, user-agent, and touch events. Requires a BiDi-enabled session (start_session with capabilities: { webSocketUrl: true }). Omit device to list available presets. Pass "reset" to restore desktop defaults. Changes persist for all subsequent tool calls until reset or session close. Browser-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "device": {
      "description": "Device preset name (e.g. \"iPhone 15\", \"Pixel 7\"). Omit to list available presets. Pass \"reset\" to restore desktop defaults.",
      "type": "string"
    }
  }
}
Annotations
{
  "title": "Emulate Device",
  "destructiveHint": false,
  "idempotentHint": true
}
——
execute_electron_scriptExecutes arbitrary JavaScript in the Electron main process. This is privileged code execution with access to Electron APIs; use only with trusted scripts.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "script": {
      "type": "string",
      "minLength": 1,
      "description": "JavaScript body executed in the Electron main process. Use `electron` for Electron APIs, `args` for supplied values, and `return` for a result."
    },
    "args": {
      "description": "Values made available to the script as args[0], args[1], and so on.",
      "type": "array",
      "items": {}
    }
  },
  "required": [
    "script"
  ]
}
Annotations
{
  "title": "Execute Electron Main-Process Script",
  "destructiveHint": true
}
——
execute_scriptExecutes arbitrary JavaScript in browser page context or Appium mobile: commands. Can read/modify DOM, trigger events, terminate apps, or run Android shell commands — use only when no dedicated tool covers the action. Browser: pass JS in script, use 'return' for values, string args matching selectors auto-resolve to elements. Mobile: use 'mobile: <command>' syntax in script with args array (e.g. "mobile: pressKey", "mobile: activateApp"). Prefer click_element/set_value/get_elements for standard interactions.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "script": {
      "type": "string",
      "description": "JavaScript code (browser) or mobile command string like \"mobile: pressKey\" (Appium)"
    },
    "args": {
      "description": "Arguments to pass to the script. For browser: element selectors or values. For mobile commands: command-specific parameters as objects.",
      "type": "array",
      "items": {}
    }
  },
  "required": [
    "script"
  ]
}
Annotations
{
  "title": "Execute Script",
  "destructiveHint": false
}
——
get_accessibility_treeReturns the page accessibility tree with roles, names, and selectors. Browser-only. Supports filtering by ARIA roles and pagination via limit/offset.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "limit": {
      "default": 0,
      "description": "Maximum number of nodes to return (0 = no limit)",
      "type": "number"
    },
    "offset": {
      "default": 0,
      "description": "Number of nodes to skip for pagination",
      "type": "number"
    },
    "roles": {
      "description": "Filter by ARIA roles, e.g. [\"button\", \"link\", \"heading\"]",
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}
Annotations
{
  "title": "Get Accessibility Tree",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_app_stateReturns the current state of a mobile app: not installed, not running, background, or foreground. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "bundleId": {
      "type": "string",
      "description": "App bundle ID (iOS) or package name (Android), e.g. \"com.example.app\""
    }
  },
  "required": [
    "bundleId"
  ]
}
Annotations
{
  "title": "Get App State",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_contextsReturns available automation contexts and the currently active one. Use before switch_context to discover NATIVE_APP and WEBVIEW_* targets. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get Automation Contexts",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_cookiesReturns all cookies for the current session, or a single cookie by name. Use to verify auth state, session tokens, or feature flags after login flows.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "name": {
      "description": "Cookie name to retrieve a specific cookie. If omitted, returns all cookies.",
      "type": "string"
    }
  }
}
Annotations
{
  "title": "Get Cookies",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_elementsReturns interactable elements on the current page with selectors, text, and bounding boxes. Supports filtering by element type, viewport visibility, and pagination. Use when the wdio://session/current/elements resource does not return desired elements.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "inViewportOnly": {
      "description": "Only return elements visible in the current viewport (default: false).",
      "type": "boolean"
    },
    "includeContainers": {
      "description": "Include container elements like divs and sections (default: false)",
      "type": "boolean"
    },
    "includeBounds": {
      "description": "Include element bounding box coordinates (default: false)",
      "type": "boolean"
    },
    "limit": {
      "default": 0,
      "description": "Maximum number of elements to return (0 = no limit)",
      "type": "number"
    },
    "offset": {
      "default": 0,
      "description": "Number of elements to skip (for pagination)",
      "type": "number"
    }
  }
}
Annotations
{
  "title": "Get Visible Elements",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_screenshotTakes a screenshot of the current page or screen and returns a base64-encoded image, resized and compressed for model context limits.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get Screenshot",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
get_tabsLists all browser tabs with handle, title, URL, and which is active. Use before switch_tab to find the target handle or index. Browser-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Get Browser Tabs",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
hide_keyboardDismisses the on-screen keyboard on mobile. Call after text entry when the keyboard obscures elements. No-op if already hidden. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "title": "Hide Keyboard",
  "destructiveHint": false,
  "idempotentHint": true
}
——
launch_chromeLaunches Chrome with remote debugging enabled. Wipes and recreates a temporary profile directory on each call. Mode "newInstance" (default) runs alongside existing Chrome; "freshSession" starts with an empty profile. Set copyProfileFiles to copy cookies/logins from your Default profile — changes do not sync back. After launch, call start_session with attach: true to connect. Spawns a detached Chrome process that persists if the server exits.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "port": {
      "default": 9222,
      "description": "Remote debugging port (default: 9222)",
      "type": "number"
    },
    "mode": {
      "default": "newInstance",
      "description": "newInstance: open alongside existing Chrome | freshSession: clean profile",
      "type": "string",
      "enum": [
        "newInstance",
        "freshSession"
      ]
    },
    "copyProfileFiles": {
      "description": "Copy your Default Chrome profile (cookies, logins) into the debug session.",
      "type": "boolean"
    }
  }
}
Annotations
{
  "title": "Launch Chrome",
  "destructiveHint": false
}
——
list_appsList apps uploaded to a cloud provider (BrowserStack App Automate, Sauce Labs App Storage, TestMu Real Device Cloud, TestingBot Storage, or Digital.ai Applications). Reads provider-specific credentials from environment.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "browserstack",
        "saucelabs",
        "testmu",
        "testingbot",
        "digitalai"
      ],
      "description": "Cloud provider"
    },
    "sortBy": {
      "default": "uploaded_at",
      "description": "Sort order for results",
      "type": "string",
      "enum": [
        "app_name",
        "uploaded_at"
      ]
    },
    "organizationWide": {
      "description": "(BrowserStack only) List apps uploaded by all users in the organization. Defaults to false (own uploads only).",
      "type": "boolean"
    },
    "limit": {
      "default": 20,
      "description": "Maximum number of apps to return (only applies when organizationWide is true, default 20)",
      "type": "integer",
      "minimum": 1,
      "maximum": 9007199254740991
    },
    "region": {
      "default": "eu-central-1",
      "description": "Sauce Labs region (default: eu-central-1)",
      "type": "string",
      "enum": [
        "us-west-1",
        "eu-central-1",
        "apac-southeast-1"
      ]
    }
  },
  "required": [
    "provider"
  ]
}
Annotations
{
  "title": "List Cloud Provider Apps",
  "readOnlyHint": true,
  "idempotentHint": true
}
——
navigateLoads a URL in the current tab and waits for the page load event. Resets page state — DOM, JS runtime, timers, and frame context are destroyed. Use instead of clicking links when the target URL is known.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "minLength": 1,
      "description": "The URL to navigate to"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "title": "Navigate to URL",
  "destructiveHint": false,
  "idempotentHint": true
}
——
open_web_extensionInstalls a web extension through WebDriver BiDi and opens one of its extension pages so existing MCP tools can inspect and drive its UI. Requires a BiDi-enabled browser session. Use base64 for cloud/remote sessions where the browser driver cannot read the MCP server filesystem.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "extensionData": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "path"
            },
            "path": {
              "type": "string",
              "minLength": 1,
              "description": "Path to an unpacked extension directory on the remote end."
            }
          },
          "required": [
            "type",
            "path"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "archivePath"
            },
            "path": {
              "type": "string",
              "minLength": 1,
              "description": "Path to a packaged extension archive on the remote end."
            }
          },
          "required": [
            "type",
            "path"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "base64"
            },
            "value": {
              "type": "string",
              "minLength": 1,
              "description": "Base64-encoded packaged extension archive."
            }
          },
          "required": [
            "type",
            "value"
          ]
        }
      ],
      "description": "W3C BiDi webExtension.ExtensionData: unpacked directory path, archive path, or base64 archive."
    },
    "path": {
      "type": "string",
      "minLength": 1,
      "description": "Path inside the extension package, such as options.html or popup.html. Leading slashes are ignored."
    }
  },
  "required": [
    "extensionData",
    "path"
  ]
}
Annotations
{
  "title": "Open Web Extension",
  "destructiveHint": false
}
——
rotate_deviceRotates a mobile device to portrait or landscape orientation. Waits for the OS rotation animation to complete. Use to test orientation-dependent layouts. Mobile-only; no effect in browser sessions.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "orientation": {
      "type": "string",
      "enum": [
        "PORTRAIT",
        "LANDSCAPE"
      ],
      "description": "Device orientation"
    }
  },
  "required": [
    "orientation"
  ]
}
Annotations
{
  "title": "Rotate Device",
  "destructiveHint": false,
  "idempotentHint": true
}
——
scrollScrolls the page vertically by a pixel amount. Browser-only — for mobile scrolling use swipe. Only supports up/down; no horizontal scrolling.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "direction": {
      "type": "string",
      "enum": [
        "up",
        "down"
      ],
      "description": "Scroll direction"
    },
    "pixels": {
      "default": 500,
      "description": "Number of pixels to scroll",
      "type": "number"
    }
  },
  "required": [
    "direction"
  ]
}
Annotations
{
  "title": "Scroll Page",
  "destructiveHint": false
}
——
set_cookieSets a browser cookie on the active session. The browser must already be on the target domain — cookies cannot be set cross-domain. Use to inject session tokens or feature flags without login flows.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Cookie name"
    },
    "value": {
      "type": "string",
      "description": "Cookie value"
    },
    "domain": {
      "description": "Cookie domain (defaults to current domain)",
      "type": "string"
    },
    "path": {
      "description": "Cookie path (defaults to \"/\")",
      "type": "string"
    },
    "expiry": {
      "description": "Expiry date as Unix timestamp in seconds",
      "type": "number"
    },
    "httpOnly": {
      "description": "HttpOnly flag",
      "type": "boolean"
    },
    "secure": {
      "description": "Secure flag",
      "type": "boolean"
    },
    "sameSite": {
      "description": "SameSite attribute",
      "type": "string",
      "enum": [
        "strict",
        "lax",
        "none"
      ]
    }
  },
  "required": [
    "name",
    "value"
  ]
}
Annotations
{
  "title": "Set Cookie",
  "destructiveHint": false,
  "idempotentHint": true
}
——
set_geolocationOverrides GPS coordinates for the session. Affects navigator.geolocation in browsers and location services on mobile. Location permissions must already be granted to the app.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "latitude": {
      "type": "number",
      "minimum": -90,
      "maximum": 90,
      "description": "Latitude coordinate"
    },
    "longitude": {
      "type": "number",
      "minimum": -180,
      "maximum": 180,
      "description": "Longitude coordinate"
    },
    "altitude": {
      "description": "Altitude in meters (optional)",
      "type": "number"
    }
  },
  "required": [
    "latitude",
    "longitude"
  ]
}
Annotations
{
  "title": "Set Geolocation",
  "destructiveHint": false,
  "idempotentHint": true
}
——
set_valueClears an input or textarea then types the given text character by character. Always replaces existing content — clearValue() runs first. Triggers input, change, and key events which may fire validation or autocomplete. Scrolls into view by default.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "selector": {
      "type": "string",
      "description": "Value for the selector, in the form of css selector or xpath (\"button.my-class\" or \"//button[@class='my-class']\")"
    },
    "value": {
      "type": "string",
      "description": "Text to enter into the element"
    },
    "scrollToView": {
      "description": "Whether to scroll the element into view before typing",
      "type": "boolean"
    },
    "timeout": {
      "description": "Maximum time to wait for element in milliseconds",
      "type": "number"
    }
  },
  "required": [
    "selector",
    "value"
  ]
}
Annotations
{
  "title": "Set Input Value",
  "destructiveHint": false,
  "idempotentHint": true
}
——
start_sessionStarts a new browser, local Electron application, or mobile automation session. Only one active session at a time — starting another session closes or detaches from the existing session first. Use attach: true to connect to a running Chrome via CDP.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "provider": {
      "default": "local",
      "description": "Session provider (default: local). Use \"external\" to connect to an externally managed W3C WebDriver endpoint. \"digitalai\" requires DIGITALAI_CLOUD_URL + DIGITALAI_ACCESS_KEY env vars.",
      "type": "string",
      "enum": [
        "local",
        "browserstack",
        "saucelabs",
        "testmu",
        "testingbot",
        "digitalai",
        "external"
      ]
    },
    "platform": {
      "type": "string",
      "enum": [
        "browser",
        "electron",
        "ios",
        "android"
      ],
      "description": "Session platform type"
    },
    "browser": {
      "description": "Browser to launch (required for browser platform)",
      "type": "string",
      "enum": [
        "chrome",
        "firefox",
        "edge",
        "safari"
      ]
    },
    "browserVersion": {
      "description": "Browser version (cloud providers only, default: latest)",
      "type": "string"
    },
    "electronRootDir": {
      "description": "Project root used by the Electron standalone service for Electron Builder/Electron Forge discovery. Electron-only.",
      "type": "string",
      "minLength": 1
    },
    "electronDeeplinkScheme": {
      "description": "URI scheme allowed by trigger_electron_deeplink, without \":\" (for example, \"myapp\"). Electron-only and optional unless triggering deeplinks.",
      "type": "string",
      "pattern": "^[A-Za-z][A-Za-z0-9+.-]*$"
    },
    "os": {
      "description": "Operating system for cloud provider browser sessions (e.g. \"Windows\", \"Mac\", \"macOS\", \"Linux\"). BrowserStack: sets bstack:options.os separately. TestMu/Sauce Labs/TestingBot: combined with osVersion into W3C platformName. Digital.ai: combined with osVersion into the digitalai:osName capability (e.g. \"Mac OS Sequoia\", \"Windows 10\") — required for the grid to match a node. Browser platform only.",
      "type": "string"
    },
    "osVersion": {
      "description": "OS version for cloud provider browser sessions (e.g. \"11\", \"15\", \"Monterey\"). BrowserStack: sets bstack:options.osVersion separately. TestMu/Sauce Labs/TestingBot: combined with os into W3C platformName. Digital.ai: combined with os into digitalai:osName. Browser platform only.",
      "type": "string"
    },
    "app": {
      "description": "App URL (bs://... for BrowserStack, storage:filename= for Sauce Labs, lt://... for TestMu, tb://... for TestingBot, cloud:<package-or-bundle> for Digital.ai mobile sessions)",
      "type": "string"
    },
    "reporting": {
      "description": "Cloud provider reporting labels (project, build, session)",
      "type": "object",
      "properties": {
        "project": {
          "type": "string"
        },
        "build": {
          "type": "string"
        },
        "session": {
          "type": "string"
        }
      }
    },
    "headless": {
      "description": "Run browser in headless mode (default: true)",
      "type": "boolean"
    },
    "windowWidth": {
      "default": 1920,
      "description": "Browser window width",
      "type": "number",
      "minimum": 400,
      "maximum": 3840
    },
    "windowHeight": {
      "default": 1080,
      "description": "Browser window height",
      "type": "number",
      "minimum": 400,
      "maximum": 2160
    },
    "deviceName": {
      "description": "Mobile device/emulator/simulator name (required for ios/android)",
      "type": "string"
    },
    "deviceQuery": {
      "description": "Digital.ai device selection query for dynamic allocation, e.g. \"@os='android' and @version='14' and @name='.*Pixel.*'\". Only used with provider: \"digitalai\" mobile sessions; if omitted, one is built from deviceName/platformVersion.",
      "type": "string"
    },
    "platformVersion": {
      "description": "OS version for mobile sessions (e.g., \"17.0\", \"14\"). Mobile (ios/android) only.",
      "type": "string"
    },
    "appPath": {
      "description": "Path to app file (.app/.apk/.ipa)",
      "type": "string"
    },
    "automationName": {
      "description": "Automation driver",
      "type": "string",
      "enum": [
        "XCUITest",
        "UiAutomator2"
      ]
    },
    "autoGrantPermissions": {
      "description": "Auto-grant app permissions (default: true)",
      "type": "boolean"
    },
    "autoAcceptAlerts": {
      "description": "Auto-accept alerts (default: true)",
      "type": "boolean"
    },
    "autoDismissAlerts": {
      "description": "Auto-dismiss alerts (default: false)",
      "type": "boolean"
    },
    "appWaitActivity": {
      "description": "Activity to wait for on Android launch",
      "type": "string"
    },
    "udid": {
      "description": "Unique Device Identifier for iOS real device",
      "type": "string"
    },
    "noReset": {
      "description": "Preserve app data between sessions",
      "type": "boolean"
    },
    "fullReset": {
      "description": "Uninstall app before/after session",
      "type": "boolean"
    },
    "newCommandTimeout": {
      "default": 300,
      "description": "Appium command timeout in seconds",
      "type": "number",
      "minimum": 0
    },
    "trace": {
      "description": "Enable trace recording — produces a Playwright-compatible zip saved to .trace/ on close_session, playable at player.vibium.dev.",
      "type": "boolean"
    },
    "attach": {
      "description": "Attach to existing Chrome instead of launching",
      "type": "boolean"
    },
    "attachConfig": {
      "description": "Chrome remote debugging connection (attach mode only, defaults: port 9222, host localhost)",
      "type": "object",
      "properties": {
        "port": {
          "default": 9222,
          "type": "number"
        },
        "host": {
          "default": "localhost",
          "type": "string"
        }
      }
    },
    "webdriverConfig": {
      "description": "Existing W3C WebDriver endpoint connection (provider: \"external\" only). Defaults to 127.0.0.1:4445/.",
      "type": "object",
      "properties": {
        "protocol": {
          "default": "http",
          "type": "string"
        },
        "hostname": {
          "default": "127.0.0.1",
          "type": "string"
        },
        "port": {
          "default": 4445,
          "type": "number"
        },
        "path": {
          "default": "/",
          "type": "string"
        }
      }
    },
    "appiumConfig": {
      "description": "Appium server connection (local provider only)",
      "type": "object",
      "properties": {
        "host": {
          "type": "string"
        },
        "port": {
          "type": "number"
        },
        "path": {
          "type": "string"
        },
        "protocol": {
          "type": "string"
        }
      }
    },
    "region": {
      "default": "eu-central-1",
      "description": "Sauce Labs region (default: eu-central-1). Only used with provider: \"saucelabs\".",
      "type": "string",
      "enum": [
        "us-west-1",
        "eu-central-1",
        "apac-southeast-1"
      ]
    },
    "tunnel": {
      "description": "Enable local tunnel routing (cloud providers only, default: false). true = auto-start tunnel before session and stop on close. \"external\" = tunnel already running externally.",
      "anyOf": [
        {
          "type": "string",
          "const": "external"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "tunnelName": {
      "description": "Tunnel identifier name. With tunnel: \"external\" this must match the running tunnel. With tunnel: true a unique name is auto-generated if not provided.",
      "type": "string"
    },
    "browserstackLocal": {
      "description": "Deprecated: use \"tunnel\" instead. Enable BrowserStack Local tunnel routing.",
      "anyOf": [
        {
          "type": "string",
          "const": "external"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "saucelabsLocal": {
      "description": "Deprecated: use \"tunnel\" instead. Enable Sauce Connect tunnel routing.",
      "anyOf": [
        {
          "type": "string",
          "const": "external"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "testmuLocal": {
      "description": "Deprecated: use \"tunnel\" instead. Enable TestMu Tunnel routing.",
      "anyOf": [
        {
          "type": "string",
          "const": "external"
        },
        {
          "type": "boolean"
        }
      ]
    },
    "navigationUrl": {
      "description": "URL to navigate to after starting",
      "type": "string"
    },
    "capabilities": {
      "description": "Additional capabilities to merge. For Electron, configure the official service under \"wdio:electronServiceOptions\" (for example appBinaryPath, appEntryPoint, appArgs, logDir, or captureRendererLogs).",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    }
  },
  "required": [
    "platform"
  ]
}
Annotations
{
  "title": "Start Session",
  "destructiveHint": false
}
——
swipePerforms a full-screen swipe gesture. Direction is content movement — "up" scrolls content upward (finger moves down). For browser scrolling use scroll; for dragging a specific element use drag_and_drop. No error if content cannot scroll further. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "direction": {
      "type": "string",
      "enum": [
        "up",
        "down",
        "left",
        "right"
      ],
      "description": "Swipe direction"
    },
    "duration": {
      "description": "Swipe duration in milliseconds (default: 500)",
      "type": "number",
      "minimum": 100,
      "maximum": 5000
    },
    "percent": {
      "description": "Percentage of screen to swipe (0-1, default: 0.5 for up/down, 0.95 for left/right)",
      "type": "number",
      "minimum": 0,
      "maximum": 1
    }
  },
  "required": [
    "direction"
  ]
}
Annotations
{
  "title": "Swipe Screen",
  "destructiveHint": false
}
——
switch_contextSwitches between native and webview automation contexts in a hybrid mobile app. In NATIVE_APP context, use accessibility IDs; in WEBVIEW_* context, use CSS/XPath. Changes persist for all subsequent commands. Accepts context name or 1-based index. Use get_contexts to discover available targets. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "context": {
      "type": "string",
      "description": "Context name to switch to (e.g., \"NATIVE_APP\", \"WEBVIEW_com.example.app\", or use index from wdio://session/current/contexts resource)"
    }
  },
  "required": [
    "context"
  ]
}
Annotations
{
  "title": "Switch Context",
  "destructiveHint": false,
  "idempotentHint": true
}
——
switch_frameSwitches WebDriver frame context into an iframe by CSS/XPath selector, or back to top-level if selector is omitted. Changes persist — all subsequent click_element, set_value, get_elements calls operate within the switched frame until you switch back. Waits up to 5s for the iframe. Browser-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "selector": {
      "description": "CSS/XPath selector for the iframe element. Omit to switch back to the top-level frame.",
      "type": "string"
    }
  }
}
Annotations
{
  "title": "Switch Frame",
  "destructiveHint": false,
  "idempotentHint": true
}
——
switch_tabFocuses a browser tab by window handle or 0-based index. All subsequent tool calls operate on the active tab. Provide handle OR index — use get_tabs to find them. Browser-only; use switch_context for mobile webviews.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "handle": {
      "description": "Window handle to switch to",
      "type": "string"
    },
    "index": {
      "description": "0-based tab index to switch to",
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    }
  }
}
Annotations
{
  "title": "Switch Browser Tab",
  "destructiveHint": false,
  "idempotentHint": true
}
——
tap_elementTaps a matched element via element.tap() or at absolute screen coordinates (x, y). No scroll-into-view or wait — element must already be visible on screen. Use instead of click_element on iOS where element.click() is ignored. Provide selector OR both x and y. Mobile-only.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "selector": {
      "description": "Element selector (CSS, XPath, accessibility ID, or UiAutomator)",
      "type": "string"
    },
    "x": {
      "description": "X coordinate for screen tap (if no selector provided)",
      "type": "number"
    },
    "y": {
      "description": "Y coordinate for screen tap (if no selector provided)",
      "type": "number"
    }
  }
}
Annotations
{
  "title": "Tap Element",
  "destructiveHint": false
}
——
trigger_electron_deeplinkTriggers a deeplink through the active Electron application. The Electron session must be started with electronDeeplinkScheme matching the URL scheme. Packaged binaries are required for deeplinks on Windows and Linux.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Deeplink URI to trigger through the Electron service."
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "title": "Trigger Electron Deeplink",
  "destructiveHint": true
}
——
upload_appUpload a local .apk or .ipa to a cloud provider (BrowserStack, Sauce Labs, TestMu, TestingBot, or Digital.ai). Returns the app URL for use in start_session.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "browserstack",
        "saucelabs",
        "testmu",
        "testingbot",
        "digitalai"
      ],
      "description": "Cloud provider"
    },
    "path": {
      "type": "string",
      "description": "Absolute path to the .apk or .ipa file"
    },
    "customId": {
      "description": "Optional custom ID for the app (used to reference it later)",
      "type": "string"
    },
    "region": {
      "default": "eu-central-1",
      "description": "Sauce Labs region (default: eu-central-1)",
      "type": "string",
      "enum": [
        "us-west-1",
        "eu-central-1",
        "apac-southeast-1"
      ]
    }
  },
  "required": [
    "provider",
    "path"
  ]
}
Annotations
{
  "title": "Upload App to Cloud Provider",
  "destructiveHint": false
}
——

Resources 17

Resource templates 3

Prompts 0

Changes from previous version

No completed comparison is available.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: a90a50f4abdd9e0f6d0c08e4168c36e27eacd44583f3034155e9094c2dda0eb7

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.