One MCP tool set controls iOS and Android targets
Mobile MCP gives agents a common interface for mobile-device work. Its tools list devices and apps, launch or terminate an app, inspect screen elements, tap, swipe, type, press buttons, open links, take screenshots, record the screen, and retrieve crash reports. The same names cover iOS simulators, Android emulators, and physical devices.
The server prefers the native accessibility tree and returns structured elements with coordinates and properties. Screenshots and direct coordinates remain available when accessibility data is missing. Text and element metadata are cheaper for an LLM to process than a new image on every step, while a screenshot can resolve visual states the tree misses. Our checkout was 48 files and about 4,653 lines of source.
The 299 MB package is the easy part of device setup
The standard MCP configuration launches @mobilenext/mobile-mcp through npx. The README includes entries for Claude Code, Codex, Claude Desktop, Cursor, Copilot, Gemini CLI, Goose, and other clients. For a local device, the server does not require an account or API secret. Add it to the client, attach a device, then ask the agent to list available devices.
Platform dependencies decide whether that check returns anything. Android requires the SDK, adb, and an emulator or authorized USB-debugging device. An iOS simulator needs Xcode and a booted Simulator. A physical iPhone adds go-ios, WebDriverAgent, and a tunnel. Our 17-second npm install did not install or validate those system tools, so package success cannot stand in for a working device lane.
What happened when we ran it
Our sandbox installed 437 npm packages in 17 seconds and occupied 299 MB. The build completed in 9 seconds, followed by a successful 10-second test step. Npm audit reported 0 known vulnerabilities: 0 critical, 0 high, 0 moderate, and 0 low. commit 8fc2fed cleared every repository check supplied to our Node 22 lab environment.
The repository had 48 files, roughly 4,653 source lines, one CI workflow, and a tests directory. We found no Dockerfile. None is required for the documented npx path, but teams that standardize MCP servers in containers must maintain their own image. Our run did not claim a device was attached; it proves the package mechanics, build, tests, and audit result only.
Agent exploration should feed a separate regression suite
The README's examples ask an agent to navigate multi-step consumer flows, enter data, interact with apps, and report what it finds. That works for discovery, reproducing a bug, or checking an unfamiliar build. Accessibility data gives the agent named elements where an image-only tool would guess from pixels. Coordinate actions remain vulnerable to layout changes and unexpected screens.
Mobile Next draws a useful boundary in its documentation. The README describes Mobilewright as the place to turn agent-led exploration into repeatable iOS and Android tests. Appium and Maestro serve the same broader need with different APIs. If CI must produce the same evidence on every run, record the discovered flow in a test framework. The lab's 10-second passing tests cover Mobile MCP itself, not your app's behavior.
SSE needs an auth decision before it leaves localhost
Stdio keeps the server attached to a local MCP client. SSE can bind to localhost:3000 or an address such as 0.0.0.0:3000. Bearer authentication is available through MOBILEMCP_AUTH, but it is conditional. Anyone exposing the listener beyond one machine should set a strong token, restrict the network route, and confirm that the client sends the header before granting access to a real device.
Anonymous PostHog telemetry is enabled by default and can be disabled with MOBILEMCP_DISABLE_TELEMETRY=1. Nonstandard URL schemes are blocked unless MOBILEMCP_ALLOW_UNSAFE_URLS=1 is set. Keep that default for shared agents. The tool can install apps, open URLs, type text, and press controls; an untrusted prompt should not gain an unauthenticated route to those actions.
WebViews and remote iOS farms remain gaps
The roadmap labels WebView inspection, device file tools, custom app-launch arguments, device logs, and pinch gestures as planned. It marks replacement of WebDriverAgent and removal of go-ios as in progress for physical iOS devices. A buyer who needs those paths should test the current release rather than read the roadmap as a promise.
Issue 385 describes farms that expose a WebDriverAgent endpoint without making the device visible through local go-ios discovery. It says forwarding that endpoint to localhost is insufficient because the current path still expects local device information and tunnel state. Those farms need another integration; Mobile Next's commercial cloud is a separate hosted option.
Current commits and a green run support a focused trial
GitHub recorded a last push on August 30, 2026, with 6,230 stars and 60 combined open issues and pull requests. Release 1.0.2 arrived on August 9 and fixed coordinate rounding plus Android element traversal. The combined open count is not a count of confirmed defects.
Mobile MCP earns a trial for developers who already have a working device lab. Our 17-second install, passing build and tests, and zero-vulnerability npm audit remove much of the package risk. The remaining work is physical: SDKs, device authorization, iOS tunneling, network protection, and converting useful exploratory paths into deterministic tests.