Expo Android — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Expo Android (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Android emulator automation via ADB.
Verify adb:
adb devicesClaude Desktop, one-click: download expo-android.mcpb from the latest release and drag it into Settings → Extensions. You can leave both fields empty — adb is auto-detected and the only connected device is used by default.
Via npm:
npm install -g @fndchagas/expo-android
# or
npx -y @fndchagas/expo-androiddoctor to validate adb + device selection.inspect, tapElement, inputText, etc.Example:
await client.callTool({ name: 'expo-android.doctor', arguments: {} });
await client.callTool({
name: 'expo-android.inspect',
arguments: { onlyInteractive: true, maxElements: 200 },
});claude mcp add expo-android \
--env ADB_PATH="$HOME/Library/Android/sdk/platform-tools/adb" \
--env ADB_SERIAL="auto" \
-- npx -y @fndchagas/expo-androidcodex mcp add expo-android \
--env ADB_PATH="$HOME/Library/Android/sdk/platform-tools/adb" \
--env ADB_SERIAL="auto" \
-- npx -y @fndchagas/expo-androidOr edit ~/.codex/config.toml:
[mcp_servers.expo-android]
command = "npx"
args = ["-y", "@fndchagas/expo-android"]
env = { ADB_PATH = "/Users/you/Library/Android/sdk/platform-tools/adb", ADB_SERIAL = "emulator-5554" }Serial selection priority: serial param (per tool call) → setDevice override → ADB_SERIAL env → auto (if only one device).
| Variable | Default | Description |
|---|---|---|
ADB_PATH | adb | Path to adb executable |
ADB_SERIAL | optional | Device serial to target (auto to clear and auto-detect) |
ADB_TIMEOUT_MS | 15000 | Timeout for adb commands |
ADB_MAX_BUFFER_MB | 10 | Max output buffer size |
ADB_DEBUG | 0 | Log adb diagnostics to stderr |
MCP_TRANSPORT | stdio | Transport: stdio, http, or both |
PORT | 7332 | HTTP port when using http/both |
The server starts even when adb is missing — tools return the ADB executable not found error until adb becomes reachable (run doctor to diagnose). To fix it, set ADB_PATH or export an SDK path:
export ADB_PATH="$HOME/Library/Android/sdk/platform-tools/adb"
# or
export ANDROID_HOME="$HOME/Library/Android/sdk"If multiple devices are connected, set ADB_SERIAL to the target device. You can also run setDevice at runtime:
await client.callTool({
name: 'expo-android.setDevice',
arguments: { serial: 'emulator-5554' },
});If you update PATH or SDK variables, restart the MCP process so it can pick up the new environment.
npm run build
npm testTool names are plain identifiers (e.g. tap); your MCP client prefixes them with the server name you registered.
devices — list connected devices and emulators.doctor — validate adb availability and show connected devices.setDevice — override the active device serial for this MCP process.inspect — UI dump parsed into elements with a summary (screenshot optional).screenshot — capture a screenshot only (base64 or file path).findElement — return elements that match search criteria.tapElement — find an element and tap its center.waitForElement — wait until an element appears (optionally with state checks).assertElement — verify element existence and state.tap — tap at x/y coordinates.swipe — swipe between coordinates.longPress — press and hold at coordinates.inputText — type text in the focused field.keyEvent — send Android key events (e.g., BACK, HOME).openApp — launch an app by package name.listPackages — list installed package names.installExpoGo — download the pinned Expo Go APK and install it via adb install -r (the url override only accepts official github.com/expo/expo-go-releases URLs).Every tool declares MCP annotations (readOnlyHint/destructiveHint), so clients can auto-approve inspection tools and gate the ones that drive the device.
These tools accept flexible search inputs: findElement, tapElement, waitForElement, assertElement.
Common fields:
text, textContainscontentDesc, contentDescContainsresourceId, resourceIdContainsclassnormalizeWhitespace, caseInsensitiveconst result = await client.callTool({
name: 'expo-android.inspect',
arguments: { onlyInteractive: true, includeScreenshot: false, maxElements: 200 },
});Inspect options:
includeScreenshot (default: false)screenshotMode: base64 or pathscreenshotPath: optional file path when using pathmaxElements: limit elements returnedincludeElements: return elements or summary onlyawait client.callTool({
name: 'expo-android.doctor',
arguments: {},
});await client.callTool({
name: 'expo-android.tapElement',
arguments: { text: 'Search', serial: 'emulator-5554' },
});await client.callTool({
name: 'expo-android.tapElement',
arguments: { text: 'Private account' },
});await client.callTool({
name: 'expo-android.waitForElement',
arguments: { text: 'Save', timeout: 10000, shouldBeClickable: true },
});
await client.callTool({
name: 'expo-android.assertElement',
arguments: { text: 'Private account', shouldBeChecked: true },
});~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.