io.github.hoainho/podium-mcp

Est-ce que io.github.hoainho/podium-mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.hoainho/podium-mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Versions auditées & empreintes

Vérifiez la version que vous utilisez : son empreinte doit correspondre à celle listée ici — sinon vous n'utilisez pas la version auditée.

⚠ La dernière version publiée (0.5.0) n'a pas encore été auditée. Un nouveau pentest est programmé ; les verdicts ci-dessous portent sur les versions listées.

Vous utilisez ce serveur ? Suivez-le (créez un compte) pour être alerté dès qu'une nouvelle version paraît ou que le verdict change.

Les 51 outils

• podium_health≈ 114 tokens

  Returns health status of the podium-mcp server and toolchain availability. Scope: iOS (simulator + real device), Android (emulator + real via adb), game-engine (Unity/GL via AltTester), and no-vision canvas/WebGL automation. macOS + Xcode required; adb for Android, an instrumented build for engine tools.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "podium_health", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• device_list≈ 120 tokens

  Returns a merged inventory of available iOS simulators (udid, name, state, runtime) plus any adb-detected Android devices. If adb is absent, the android section reports availability: false instead of failing. NOTE: Android entries are detection-only — podium's automation tools (tap/inspect/etc.) currently target iOS simulators.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "device_list", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• device_boot≈ 112 tokens

  Boots an iOS simulator by UDID. Waits up to 30 seconds for the boot command to complete. Idempotent: booting an already-booted device returns ok with alreadyBooted:true.

  Paramètres, retour & exemple (1)

  Paramètres

  • udid · string · requis
    Simulator UDID (from device_list)

  Exemple d'appel

  {"name": "device_boot", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_install≈ 114 tokens

  Installs an app on an iOS simulator. Accepts a path to a .app directory or a .zip archive.

  Paramètres, retour & exemple (2)

  Paramètres

  • path · string · requis
    Path to the .app directory or .zip file to install
  • udid · string · requis
    Simulator UDID

  Exemple d'appel

  {"name": "app_install", "arguments": {"path": "texte", "udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_launch≈ 104 tokens

  Launches an app on an iOS simulator by bundle ID.

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • bundleId · string · requis
    App bundle identifier (e.g. com.example.MyApp)

  Exemple d'appel

  {"name": "app_launch", "arguments": {"udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_terminate≈ 101 tokens

  Terminates a running app on an iOS simulator by bundle ID.

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • bundleId · string · requis
    App bundle identifier

  Exemple d'appel

  {"name": "app_terminate", "arguments": {"udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• screenshot≈ 146 tokens

  Takes a screenshot of an iOS simulator. Returns the saved file path and byte size. Does NOT return base64 to keep payload small. saveTo defaults to a .png file in os.tmpdir().

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • saveTo · string · optionnel
    Destination file path (must end .png or .jpg). Defaults to a tmp file.

  Exemple d'appel

  {"name": "screenshot", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• open_url≈ 104 tokens

  Opens a URL on an iOS simulator (deep-links, https:// etc.).

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    URL to open on the simulator
  • udid · string · requis
    Simulator UDID

  Exemple d'appel

  {"name": "open_url", "arguments": {"url": "texte", "udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_location≈ 175 tokens

  Sets the simulated GPS location on a running iOS simulator. Codifies the QA geo-spinner fix: use this to unblock location-gated features during QA testing without moving the physical device.

  Paramètres, retour & exemple (3)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • latitude · number · requis
    Latitude in decimal degrees
  • longitude · number · requis
    Longitude in decimal degrees

  Exemple d'appel

  {"name": "set_location", "arguments": {"udid": "texte", "latitude": 1, "longitude": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_list≈ 102 tokens

  Returns the list of installed apps on a booted iOS simulator. Includes bundle ID, display name, and application type (User/System).

  Paramètres, retour & exemple (1)

  Paramètres

  • udid · string · requis
    Simulator UDID (from device_list)

  Exemple d'appel

  {"name": "app_list", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_uninstall≈ 110 tokens

  Uninstalls an app from an iOS simulator by bundle ID.

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • bundleId · string · requis
    App bundle identifier to uninstall (e.g. com.example.MyApp)

  Exemple d'appel

  {"name": "app_uninstall", "arguments": {"udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• screen_size≈ 98 tokens

  Returns the pixel dimensions of a booted iOS simulator screen by taking a temp screenshot and reading its pixel dimensions with sips.

  Paramètres, retour & exemple (1)

  Paramètres

  • udid · string · requis
    Simulator UDID

  Exemple d'appel

  {"name": "screen_size", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• orientation_get≈ 113 tokens

  Returns the current orientation of a booted iOS simulator. Queries the native backend (mobilecli) when available for an exact answer; otherwise derives it from the screenshot aspect ratio.

  Paramètres, retour & exemple (1)

  Paramètres

  • udid · string · requis
    Simulator UDID

  Exemple d'appel

  {"name": "orientation_get", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• record_start≈ 138 tokens

  Starts a screen recording on a booted iOS simulator. The recording runs in a detached background process. Call record_stop to finalize and retrieve the file.

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • saveTo · string · optionnel
    Destination file path (must end .mp4). Defaults to a tmp file.

  Exemple d'appel

  {"name": "record_start", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• record_stop≈ 106 tokens

  Stops the active screen recording for an iOS simulator. Sends SIGINT to flush the video file, waits for the file size to stabilize, and returns the path and size.

  Paramètres, retour & exemple (1)

  Paramètres

  • udid · string · requis
    Simulator UDID

  Exemple d'appel

  {"name": "record_stop", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• inspect_screen≈ 295 tokens

  Returns the current view hierarchy for a booted iOS simulator (podium's target platform). Uses idb's flat accessibility tree when idb is installed (fast), else maestro hierarchy. Defaults to compact:true — a flattened list of only the nodes that carry text / accessibility labels / resource-ids (dramatically smaller than the raw tree). Pass compact:false for the full nested hierarchy. LIMITATION: WebView (WKWebView/WebView) content is opaque — the hierarchy shows a single WebView node with no children. Web-rendered buttons, inputs, and labels are invisible to this tool. For WebView apps, identify elements visually via screenshot then calculate logical-point coordinates (screenshot pixels ÷ device scale factor, typically ÷3 on 3× Retina).

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator / device UDID (from device_list)
  • compact · boolean · optionnel
    Return a flattened list of meaningful nodes only (default true). false = full nested tree.

  Exemple d'appel

  {"name": "inspect_screen", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tap_on≈ 498 tokens

  Tap, double-tap, or long-press an element on screen via an ephemeral Maestro flow. Target by text (regex), accessibility id, or absolute x/y coordinates. bundleId is REQUIRED — Maestro needs it for the appId flow header. WebView caution: text/id selectors only resolve native accessibility nodes. Web-rendered elements inside WKWebView are invisible — tap_on will report COMPLETED but nothing is tapped. Use x+y coordinates instead for WebView content.

  Paramètres, retour & exemple (12)

  Paramètres

  • x · number · optionnel
    X coordinate in logical points (numeric only; percent strings are not supported)
  • y · number · optionnel
    Y coordinate — required when x is provided
  • id · string · optionnel
    Accessibility ID of the element
  • long · boolean · optionnel
    Use longPressOn instead of tapOn
  • text · string · optionnel
    Element text or regex. Matches the FULL label/value case-insensitively (anchored ^…$); an invalid regex falls back to a substring match.
  • udid · string · requis
    Simulator / device UDID
  • index · integer · optionnel
    Zero-based index when multiple elements match
  • double · boolean · optionnel
    Use doubleTapOn instead of tapOn
  • bundleId · string · requis
    App bundle identifier (e.g. com.example.MyApp). Required by Maestro.
  • noLaunch · boolean · optionnel
    Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
  • timeoutMs · integer · optionnel
    Flow timeout in ms (default 30 000)
  • longDurationMs · integer · optionnel
    Hold duration for long press in ms (max 10 000)

  Exemple d'appel

  {"name": "tap_on", "arguments": {"udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• input_text≈ 282 tokens

  Types text into the currently-focused element via an ephemeral Maestro flow. Set submit:true to press Enter after typing. Note: Android does not support Unicode via inputText. WebView caveat: inputText injects at the native buffer level — React onChange/onChangeText never fires. For WebView forms use mobile-mcp mobile_type_keys (real keystroke simulation) instead.

  Paramètres, retour & exemple (6)

  Paramètres

  • text · string · requis
    Text to type
  • udid · string · requis
    Simulator / device UDID
  • submit · boolean · optionnel
    Press Enter after typing (default false)
  • bundleId · string · requis
    App bundle identifier
  • noLaunch · boolean · optionnel
    Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
  • timeoutMs · integer · optionnel
    Flow timeout in ms

  Exemple d'appel

  {"name": "input_text", "arguments": {"text": "texte", "udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• swipe≈ 295 tokens

  Swipes in a direction or between two coordinates via an ephemeral Maestro flow. direction is always required; startX/startY/endX/endY are optional overrides expressed as percentage strings (e.g. '10%,50%') or pixel values.

  Paramètres, retour & exemple (9)

  Paramètres

  • endX · string · optionnel
    End X
  • endY · string · optionnel
    End Y
  • udid · string · requis
    Simulator / device UDID
  • startX · string · optionnel
    Start X (e.g. '10%' or '120')
  • startY · string · optionnel
    Start Y
  • bundleId · string · requis
    App bundle identifier
  • noLaunch · boolean · optionnel
    Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
  • direction · string · requis · up | down | left | right
    Swipe direction
  • timeoutMs · integer · optionnel
    Flow timeout in ms

  Exemple d'appel

  {"name": "swipe", "arguments": {"udid": "texte", "bundleId": "texte", "direction": "up"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• press_key≈ 265 tokens

  Presses a hardware or system key via an ephemeral Maestro flow on the iOS simulator. Note: back/power/tab are Android key events and have no effect on iOS — they remain in the enum for a future Android backend. Valid keys: enter, home, lock, backspace, volume up, volume down, back, power, tab

  Paramètres, retour & exemple (5)

  Paramètres

  • key · string · requis · enter | home | lock | backspace | volume up | volume down | back | power
    Key to press
  • udid · string · requis
    Simulator / device UDID
  • bundleId · string · requis
    App bundle identifier
  • noLaunch · boolean · optionnel
    Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
  • timeoutMs · integer · optionnel
    Flow timeout in ms

  Exemple d'appel

  {"name": "press_key", "arguments": {"key": "enter", "udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• orientation_set≈ 258 tokens

  Sets the screen orientation on an iOS simulator via an ephemeral Maestro flow. bundleId is required (Maestro needs it for the appId flow header). Valid values: PORTRAIT, LANDSCAPE_LEFT, LANDSCAPE_RIGHT, UPSIDE_DOWN

  Paramètres, retour & exemple (5)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • value · string · requis · PORTRAIT | LANDSCAPE_LEFT | LANDSCAPE_RIGHT | UPSIDE_DOWN
    Target orientation: PORTRAIT | LANDSCAPE_LEFT | LANDSCAPE_RIGHT | UPSIDE_DOWN
  • bundleId · string · requis
    App bundle identifier
  • noLaunch · boolean · optionnel
    Skip the implicit launchApp attach step (default false). Set true when an open modal or navigation state must not be disturbed.
  • timeoutMs · integer · optionnel
    Flow timeout in ms

  Exemple d'appel

  {"name": "orientation_set", "arguments": {"udid": "texte", "value": "PORTRAIT", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tap_with_fallback≈ 423 tokens

  Sends a raw coordinate tap via the native backend (idb if installed, else a Maestro tapOn-point fallback). Useful for WKWebView game overlays where visual position differs from the DOM hit-test position. The Maestro fallback needs an app context: pass bundleId, or the foreground app is auto-detected. VERIFICATION: 'ok' is decided primarily by a change in the native accessibility element set before/after the tap (stable under animation/video). When no native backend is present it falls back to a screenshot byte-size delta (weak — animation can flip it). The result's `oracle` field reports which was used ('a11y-change' | 'screenshot-bytesize' | 'unverified'). For WebView-rendered targets the a11y tree won't change → oracle:'unverified'; confirm via webview_inspect. offsetStep defaults to 0 (

  Paramètres, retour & exemple (6)

  Paramètres

  • x · number · requis
    X coordinate in logical points
  • y · number · requis
    Y coordinate in logical points
  • udid · string · requis
    Simulator / device UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (ignored when idb is present). Auto-detected if omitted.
  • maxRetries · integer · optionnel
    Maximum tap attempts (default 3)
  • offsetStep · number · optionnel
    Opt-in Y offset step in px applied per retry (default 0 = always tap the exact point; no blind walk).

  Exemple d'appel

  {"name": "tap_with_fallback", "arguments": {"x": 1, "y": 1, "udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• notification_bar_clear≈ 217 tokens

  Attempts to dismiss the React Native debug notification bar that sometimes appears at the bottom of the screen and intercepts taps. Taps the debug icons area at (50, 850) via the native backend (idb, else Maestro) and takes a before/after screenshot. NOTE: the (50,850) tap point is a device-specific heuristic, and 'cleared' is decided by a screenshot byte-size delta — a best-effort signal, not a guarantee (see tap_with_fallback caveat).

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (ignored when idb is present). Auto-detected if omitted.

  Exemple d'appel

  {"name": "notification_bar_clear", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• run_steps≈ 1299 tokens

  Execute an ordered batch of UI actions in ONE call via the native backend (idb/mobilecli, sub-second; Maestro fallback per step). Eliminates per-gesture MCP round-trips for fast continuous flows (login, navigation, form fill). Step actions: tap {x,y} · tapText {text|id} · type {text,submit} · key · swipe · waitFor {text,timeoutMs} · assertVisible {text} · waitMs · screenshot. Prefer `waitFor` over `waitMs` to act the instant the UI is ready instead of sleeping. WebView note: web-rendered text is invisible to tapText — use tap {x,y} for it; `type` uses real keystrokes so React onChange fires. Stops at the first failed step unless stopOnError:false. bundleId is only needed for the Maestro fallback (auto-detected otherwise). When to use: pick run_steps for >2 known sequential gestures (login,

  Paramètres, retour & exemple (5)

  Paramètres

  • udid · string · requis
    Simulator / device UDID (from device_list)
  • steps · array · requis
    Ordered list of actions to perform.
  • bundleId · string · optionnel
    App bundle id for Maestro fallbacks (auto-detected from the foreground app if omitted).
  • stepDelayMs · integer · optionnel
    Optional fixed delay inserted after every step (default 0).
  • stopOnError · boolean · optionnel
    Stop at the first failed step (default true). false = run all and report each.

  Exemple d'appel

  {"name": "run_steps", "arguments": {"udid": "texte", "steps": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• run_flow≈ 414 tokens

  Execute one or more Maestro flows on a device. Provide exactly one of: yaml (inline YAML string), files (array of flow file paths), or dir (directory path). includeTags and excludeTags are only applicable when using dir. When to use: run_flow gives the full Maestro vocabulary (assertions, conditionals, loops, retries); for a simple sequence of taps/types prefer run_steps, and for one gesture use the individual tools. TRUST BOUNDARY: Maestro flows can run arbitrary JS (evalScript) and local files (runScript/files/dir), so treat run_flow input as locally-executable code.

  Paramètres, retour & exemple (8)

  Paramètres

  • dir · string · optionnel
    Directory containing .yaml flow files
  • env · object · optionnel
    Environment variables passed to the flow
  • udid · string · requis
    Simulator / device UDID (from device_list)
  • yaml · string · optionnel
    Inline Maestro YAML flow string (preferred for exploration)
  • files · array · optionnel
    Array of .yaml flow file paths
  • timeoutMs · integer · optionnel
    Flow timeout in milliseconds (default 120 000)
  • excludeTags · array · optionnel
    Exclude flows tagged with these tags (dir mode only)
  • includeTags · array · optionnel
    Only run flows tagged with these tags (dir mode only)

  Exemple d'appel

  {"name": "run_flow", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• export_flow≈ 1105 tokens

  Exports a run_steps action sequence to a reusable Maestro flow (the engineer→QA bridge). Selector-based steps (tapText by id/text, key, swipe-by-direction, waitFor, assertVisible, screenshot) transpile cleanly. The lossy steps — coordinate tap/swipe, focused-field type, regex tapText — are emitted as commented '# TODO[unstable]' lines plus a warnings[] list, never as silently divergent YAML. Fix the TODOs to make the flow durable regression.

  Paramètres, retour & exemple (2)

  Paramètres

  • steps · array · requis
    The run_steps action array to transpile
  • bundleId · string · requis
    App bundle id for the flow's appId header

  Exemple d'appel

  {"name": "export_flow", "arguments": {"steps": [], "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• cheat_sheet≈ 86 tokens

  Returns the bundled Maestro flow script cheat sheet (offline copy). Consult this before authoring unfamiliar Maestro commands, required args, nested properties, conditionals, or multi-screen flows.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "cheat_sheet", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• metro_apps≈ 124 tokens

  Lists React Native apps currently connected to a Metro bundler inspector. Returns CDP-style targets (id, title, webSocketDebuggerUrl). Returns a structured error if Metro is not running on the given port.

  Paramètres, retour & exemple (1)

  Paramètres

  • port · integer · optionnel
    Metro dev server port (default 8081)

  Exemple d'appel

  {"name": "metro_apps", "arguments": {"port": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• metro_logs≈ 290 tokens

  Reads console logs from a React Native app via the Metro CDP debugger. If webSocketDebuggerUrl is omitted, auto-discovers via metro_apps and uses the first connected app. Reports which app was chosen. Pass saveTo to also write the console timeline to a file for evidence (e.g. attach to a bug).

  Paramètres, retour & exemple (5)

  Paramètres

  • port · integer · optionnel
    Metro port for auto-discovery (default 8081)
  • saveTo · string · optionnel
    Optional file path; writes the console timeline (one line per entry: [level ts] text) for evidence.
  • maxLogs · integer · optionnel
    Maximum number of log entries to return (default 100, keeps most recent)
  • durationMs · integer · optionnel
    How long to collect logs in milliseconds (default 3000)
  • webSocketDebuggerUrl · string · optionnel
    CDP WebSocket URL from metro_apps. Omit to auto-discover.

  Exemple d'appel

  {"name": "metro_logs", "arguments": {"port": 1, "saveTo": "texte", "maxLogs": 1, "durationMs": 1, "webSocketDebuggerUrl": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• metro_network≈ 430 tokens

  Captures network requests from a React Native app via the Metro CDP debugger (Network domain). If webSocketDebuggerUrl is omitted, auto-discovers via metro_apps and uses the first connected app. Pairs requestWillBeSent with responseReceived by requestId (method, url, status, headers, timing). format:'har' emits a valid HAR 1.2 log (HAR-lite — no response bodies yet) you can open in Chrome DevTools → Import HAR; pass saveTo to write the .har file. Sensitive headers (authorization/cookie/…) are REDACTED by default — set redact:false to keep them (don't commit unredacted HAR: it leaks tokens).

  Paramètres, retour & exemple (7)

  Paramètres

  • port · integer · optionnel
    Metro port for auto-discovery (default 8081)
  • format · string · optionnel · json | har
    Output format: 'json' (default, structured entries) or 'har' (HAR 1.2 log).
  • redact · boolean · optionnel
    Mask sensitive headers (authorization/cookie/set-cookie/…). Default true.
  • saveTo · string · optionnel
    Optional file path to write the output (a .har file when format:'har').
  • durationMs · integer · optionnel
    How long to capture network activity in milliseconds (default 3000)
  • maxEntries · integer · optionnel
    Maximum request entries to return (default 100, keeps most recent)
  • webSocketDebuggerUrl · string · optionnel
    CDP WebSocket URL from metro_apps. Omit to auto-discover.

  Exemple d'appel

  {"name": "metro_network", "arguments": {"port": 1, "format": "json", "redact": true, "saveTo": "texte", "durationMs": 1, "maxEntries": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• metro_state≈ 278 tokens

  Reads app state from a React Native app by evaluating a JS expression in its runtime via the Metro CDP debugger (Runtime.evaluate, returnByValue). Default expression reads a globally-exposed Redux store; override `expression` to read any in-app value. The app must expose the value on a global the runtime can reach. Auto-discovers the ws via metro_apps when omitted.

  Paramètres, retour & exemple (4)

  Paramètres

  • port · integer · optionnel
    Metro port for auto-discovery (default 8081)
  • timeoutMs · integer · optionnel
    Evaluation timeout in ms (default 5000)
  • expression · string · optionnel
    JS expression to evaluate (default: a globally-exposed Redux store's getState()). e.g. "store.getState().user" or "globalThis.__APP_STATE__".
  • webSocketDebuggerUrl · string · optionnel
    CDP WebSocket URL from metro_apps. Omit to auto-discover.

  Exemple d'appel

  {"name": "metro_state", "arguments": {"port": 1, "timeoutMs": 1, "expression": "texte", "webSocketDebuggerUrl": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• crash_list≈ 188 tokens

  Lists crash reports (.ips/.crash) from ~/Library/Logs/DiagnosticReports — plus the simulator's own container DiagnosticReports when udid is given — sorted newest first. Filter by processName (case-insensitive substring) and/or sinceHours.

  Paramètres, retour & exemple (3)

  Paramètres

  • udid · string · optionnel
    Simulator UDID — also scans that sim's container DiagnosticReports
  • sinceHours · number · optionnel
    Only include crashes from the last N hours
  • processName · string · optionnel
    Case-insensitive substring to filter by process name

  Exemple d'appel

  {"name": "crash_list", "arguments": {"udid": "texte", "sinceHours": 1, "processName": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• crash_get≈ 168 tokens

  Reads a crash report by its id (filename from crash_list). For .ips files returns a parsed JSON header and the report body (first ~8000 chars, truncated flag set if longer). Pass the same udid used for crash_list to also resolve sim-container reports. Path-traversal-safe.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    Crash report filename (id from crash_list)
  • udid · string · optionnel
    Simulator UDID — also looks in that sim's container DiagnosticReports

  Exemple d'appel

  {"name": "crash_get", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• app_state≈ 157 tokens

  Checks whether an app is installed and/or running on an iOS simulator. installed: exact bundle-id match against the parsed simctl listapps output; running: matches the launchctl UIKitApplication:<bundleId> label on a token boundary (no prefix false positives).

  Paramètres, retour & exemple (2)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • bundleId · string · requis
    App bundle identifier (e.g. com.example.MyApp)

  Exemple d'appel

  {"name": "app_state", "arguments": {"udid": "texte", "bundleId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• webview_inspect≈ 312 tokens

  Lists embedded WebViews (WKWebView) on a booted simulator and, for the selected one, resolves a CSS selector to DOM elements WITH absolute on-screen tap coordinates. This is the answer to the 'WebView content is opaque' limitation of the coordinate tools: instead of eyeballing a screenshot, get tapX/tapY for a real DOM element and feed it straight into tap_on. Defaults to interactive elements when no selector is given. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

  Paramètres, retour & exemple (4)

  Paramètres

  • max · integer · optionnel
    Maximum elements to return (default 100)
  • udid · string · requis
    Simulator / device UDID (from device_list)
  • selector · string · optionnel
    CSS selector (default: 'button, a, input, textarea, [role=button]')
  • webviewId · string · optionnel
    Target WebView id (from a prior call). Omit to auto-select the first visible WebView.

  Exemple d'appel

  {"name": "webview_inspect", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• webview_eval≈ 237 tokens

  Evaluates a JavaScript expression in a WebView's page context and returns the result. Use it to read web-app state (location.href, store values, feature flags, on-screen balances) or to assert conditions against the live DOM. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

  Paramètres, retour & exemple (3)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select the first visible WebView.
  • expression · string · requis
    JavaScript expression to evaluate, e.g. "location.href" or "document.querySelectorAll('button').length"

  Exemple d'appel

  {"name": "webview_eval", "arguments": {"udid": "texte", "expression": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• webview_navigate≈ 220 tokens

  Drives a WebView's navigation: goto a URL, or back / forward / reload. Requires the app's WKWebView to be inspectable (isInspectable=true) — on by default in debug/staging builds, frequently disabled in production App Store builds.

  Paramètres, retour & exemple (4)

  Paramètres

  • url · string · optionnel
    Destination URL (required when action is 'goto')
  • udid · string · requis
    Simulator / device UDID
  • action · string · requis · goto | back | forward | reload
    Navigation action. 'goto' requires url.
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select the first visible WebView.

  Exemple d'appel

  {"name": "webview_navigate", "arguments": {"udid": "texte", "action": "goto"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• webview_network≈ 523 tokens

  Captures HTTP traffic made INSIDE a WebView (fetch + XMLHttpRequest) and exports it as JSON or a redacted HAR 1.2 log. This is the network-debugging path for WebView-based apps — RN shells that host their UI in a WKWebView, where the API calls run in the web layer so metro_network (CDP Network domain) captures nothing. It injects a fetch/XHR recorder into the page, captures for durationMs while you drive the app, then returns request/response metadata (url, method, status, headers, timing). Only requests made AFTER capture starts are recorded. format:'har' emits a valid HAR 1.2 log (HAR-lite — no response bodies) openable in Chrome DevTools → Import HAR; pass saveTo to write the .har file. Sensitive headers (authorization/cookie/…) and request bodies are REDACTED by default — set redact:fa

  Paramètres, retour & exemple (7)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • format · string · optionnel · json | har
    Output format: 'json' (default, structured entries) or 'har' (HAR 1.2 log).
  • redact · boolean · optionnel
    Mask sensitive headers (authorization/cookie/…) and request bodies. Default true.
  • saveTo · string · optionnel
    Optional file path to write the output (a .har file when format:'har').
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select the first visible WebView.
  • durationMs · integer · optionnel
    How long to capture (ms) while you drive the app (default 5000)
  • includeResources · boolean · optionnel
    Also include the browser's retroactive Performance Resource Timing list — EVERY request the document made since navigation, including ones that fired before capture started (URL + timing + size, but no headers/body). Default true. Set false for fetch/XHR only (with full headers + bodies).

  Exemple d'appel

  {"name": "webview_network", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• assert_visible≈ 292 tokens

  Asserts an element/text is visible, via the oracle ladder (WebView-DOM > native a11y > Maestro). Passes only when a capable oracle confirms presence; if the surface is a WebView whose DOM can't be read (isInspectable=false), returns an 'unverifiable' error instead of a false pass. Provide text (any surface) or selector (WebView).

  Paramètres, retour & exemple (6)

  Paramètres

  • text · string · optionnel
    Visible text to match (native a11y / WebView innerText)
  • udid · string · requis
    Simulator UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (native surface)
  • contains · boolean · optionnel
    Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
  • selector · string · optionnel
    CSS selector — WebView surfaces only
  • timeoutMs · integer · optionnel
    Poll budget (default 3000)

  Exemple d'appel

  {"name": "assert_visible", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• assert_text≈ 201 tokens

  Asserts the given text is visible on screen (by-text shorthand for assert_visible). Same oracle ladder + unverifiable handling.

  Paramètres, retour & exemple (5)

  Paramètres

  • text · string · requis
    Visible text to assert
  • udid · string · requis
    Simulator UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (native surface)
  • contains · boolean · optionnel
    Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
  • timeoutMs · integer · optionnel

  Exemple d'appel

  {"name": "assert_text", "arguments": {"text": "texte", "udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• assert_not_visible≈ 280 tokens

  Asserts an element/text is ABSENT. FAILS CLOSED: if absence cannot be verified (e.g. a WebView whose DOM is unreadable — native a11y is blind to web content), returns an 'unverifiable' error rather than a false pass. Passes only when a capable oracle confirms absence.

  Paramètres, retour & exemple (6)

  Paramètres

  • text · string · optionnel
    Visible text to match (native a11y / WebView innerText)
  • udid · string · requis
    Simulator UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (native surface)
  • contains · boolean · optionnel
    Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
  • selector · string · optionnel
    CSS selector — WebView surfaces only
  • timeoutMs · integer · optionnel
    Confirmation budget (default 1500)

  Exemple d'appel

  {"name": "assert_not_visible", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wait_for_element≈ 248 tokens

  Polls until an element/text is visible (via the oracle ladder), or fails on timeout. Use to act the instant the UI is ready instead of a blind sleep.

  Paramètres, retour & exemple (6)

  Paramètres

  • text · string · optionnel
    Visible text to match (native a11y / WebView innerText)
  • udid · string · requis
    Simulator UDID
  • bundleId · string · optionnel
    App bundle id for the Maestro fallback (native surface)
  • contains · boolean · optionnel
    Substring match for text (default false = exact full-string on native a11y). WebView innerText is always substring.
  • selector · string · optionnel
    CSS selector — WebView surfaces only
  • timeoutMs · integer · optionnel
    Wait budget (default 10000)

  Exemple d'appel

  {"name": "wait_for_element", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• validate_flow≈ 494 tokens

  Returns a trustworthy, evidenced verdict on whether a just-implemented flow works. Runs your visibility assertions through the oracle ladder (WebView-DOM > native a11y > Maestro; fail-closed on unverifiable) AND auto-checks app health: no recent crash, no error-level Metro logs, no failed (≥400) network requests. ok=true only when ALL assertions pass AND all applicable auto-checks are clean — never a bare 'looks ok'. State the expected outcome as assertions; this tool makes the AI's 'it works' auditable.

  Paramètres, retour & exemple (8)

  Paramètres

  • udid · string · requis
    Simulator UDID
  • bundleId · string · optionnel
    App bundle id (Maestro fallback)
  • checkLogs · boolean · optionnel
    Auto-check error-level console logs (default true)
  • metroPort · integer · optionnel
    Metro port for log/network checks (default 8081)
  • assertions · array · optionnel
    Expected-outcome assertions (≥1 recommended)
  • checkCrashes · boolean · optionnel
    Auto-check recent crashes (default true)
  • checkNetwork · boolean · optionnel
    Auto-check failed network requests (default true)
  • sinceSeconds · integer · optionnel
    Crash-recency window in seconds (default 120)

  Exemple d'appel

  {"name": "validate_flow", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• engine_inspect≈ 209 tokens

  Lists game-engine (Unity/GL) objects matching a selector, each with absolute screen coordinates for tapping — DOM-like addressing with NO vision. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

  Paramètres, retour & exemple (3)

  Paramètres

  • by · string · optionnel · name | path | component | text | id
    Selector kind (default: name)
  • udid · string · requis
    Device UDID / Android serial
  • value · string · requis
    Selector value (object name, hierarchy path, component, or text)

  Exemple d'appel

  {"name": "engine_inspect", "arguments": {"udid": "texte", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• engine_tap≈ 178 tokens

  Taps a game-engine object resolved by selector (engine-reported screen coords, no vision). Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

  Paramètres, retour & exemple (3)

  Paramètres

  • by · string · optionnel · name | path | component | text | id
  • udid · string · requis
    Device UDID / Android serial
  • value · string · requis
    Selector value identifying the object to tap

  Exemple d'appel

  {"name": "engine_tap", "arguments": {"udid": "texte", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• engine_swipe≈ 190 tokens

  Swipes between two screen coordinates inside a game-engine view. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

  Paramètres, retour & exemple (6)

  Paramètres

  • toX · number · requis
  • toY · number · requis
  • udid · string · requis
    Device UDID / Android serial
  • fromX · number · requis
  • fromY · number · requis
  • durationMs · integer · optionnel
    Swipe duration in ms (default 300)

  Exemple d'appel

  {"name": "engine_swipe", "arguments": {"toX": 1, "toY": 1, "udid": "texte", "fromX": 1, "fromY": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• engine_call≈ 255 tokens

  Invokes a C# component method on a game-engine object by reflection — the engine analog of firing a DOM event handler. Requires an AltTester-instrumented build (dev/staging) with the in-app server running — production App Store builds are not instrumented. Uses no screenshots/vision.

  Paramètres, retour & exemple (6)

  Paramètres

  • by · string · optionnel · name | path | component | text | id
  • udid · string · requis
    Device UDID / Android serial
  • value · string · requis
    Selector value identifying the object
  • method · string · requis
    Method name to invoke
  • component · string · requis
    Component (script) name, e.g. ScoreController
  • parameters · array · optionnel
    Method parameters (default none)

  Exemple d'appel

  {"name": "engine_call", "arguments": {"udid": "texte", "value": "texte", "method": "texte", "component": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• canvas_inspect≈ 275 tokens

  Lists canvas/WebGL objects (Pixi/Konva/Fabric/Phaser/Three/Babylon) as DOM-like elements with tap-ready coordinates — NO screenshot/vision. Optionally filter by selector (name/id/text/type/role). Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

  Paramètres, retour & exemple (4)

  Paramètres

  • by · string · optionnel · name | id | text | type | role | path
    Selector kind to filter by (omit to list all)
  • udid · string · requis
    Simulator / device UDID (from device_list)
  • value · string · optionnel
    Selector value (required when 'by' is given)
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select the first visible one.

  Exemple d'appel

  {"name": "canvas_inspect", "arguments": {"udid": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• canvas_resolve≈ 254 tokens

  Resolves a fuzzy intent (e.g. "close", "settings", "✕") to a ranked, EVIDENCED canvas target without tapping — the 'close brain'. Returns the best match, all candidates with reasons, and a fail-closed confidentEnough flag (false when two targets tie). NO vision. Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

  Paramètres, retour & exemple (3)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • intent · string · requis
    What you want to act on, e.g. "close", "play", "settings"
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select.

  Exemple d'appel

  {"name": "canvas_resolve", "arguments": {"udid": "texte", "intent": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• canvas_tap≈ 279 tokens

  Resolves an intent to a single canvas target and TAPS it at absolute screen coordinates — the native-like 'close this' for canvas UIs. Fail-closed: if no confident, unambiguous match exists it does NOT tap and returns the candidates so you can disambiguate. NO vision. Requires an inspectable WKWebView (isInspectable=true; debug/staging) hosting a canvas/WebGL framework (Pixi/Konva/Fabric/Phaser/Three/Babylon) with its root reachable (commonly on window, or Pixi's __PIXI_APP__). NO screenshots/vision — fails closed otherwise.

  Paramètres, retour & exemple (4)

  Paramètres

  • udid · string · requis
    Simulator / device UDID
  • intent · string · requis
    What to tap, e.g. "close", "play", or an exact object name
  • bundleId · string · optionnel
    App bundle id (only used for the Maestro tap fallback)
  • webviewId · string · optionnel
    Target WebView id. Omit to auto-select.

  Exemple d'appel

  {"name": "canvas_tap", "arguments": {"udid": "texte", "intent": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• podium_token_report≈ 284 tokens

  Quantifies Podium's token savings: for an N-step flow, computes input tokens for Podium's no-vision structured flow vs a screenshot/vision loop, the savings ratio, and the fixed per-request tool-definition overhead. Heuristic estimates (~4 chars/token text, ~750 px/token image) — deterministic, no network.

  Paramètres, retour & exemple (5)

  Paramètres

  • steps · integer · optionnel
    Flow length (default 8)
  • toolCount · integer · optionnel
    Registered tool count for the overhead estimate (default 51)
  • elementsPerStep · integer · optionnel
    Structured elements returned per step (default 20)
  • screenshotWidth · integer · optionnel
    Vision-loop screenshot width px (default 1179)
  • screenshotHeight · integer · optionnel
    Vision-loop screenshot height px (default 2556)

  Exemple d'appel

  {"name": "podium_token_report", "arguments": {"steps": 1, "toolCount": 1, "elementsPerStep": 1, "screenshotWidth": 1, "screenshotHeight": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

podium-mcp@0.4.0