High-risk tools in MCP Appium Server
55 of the 110 tools in MCP Appium Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
reset-appExecuteReset the app (terminate and relaunch) associated with the current Appium session
-
xcode_reset_privacy_permissionExecuteReset privacy permission for an app
-
xcode_revoke_privacy_permissionExecuteRevoke privacy permission from an app
-
execute-adb-commandExecuteExecute a custom ADB command
-
execute-mobile-commandExecuteExecute a custom mobile command for iOS or Android
-
initialize-appiumExecuteInitialize an Appium driver session for mobile automation
-
launch-appExecuteLaunch an app on an Android device
-
launch-appium-appExecuteLaunch the app associated with the current Appium session
-
start-recordingExecuteStart recording the screen
-
stop-recordingExecuteStop recording the screen and get the recording data
-
wait-for-elementExecuteWait for an element to be visible on screen
-
xcode_launch_appExecuteLaunch an app on a simulator
-
xcode_record_videoExecuteStart recording video of a simulator (returns process info)
-
xcode_trigger_memory_warningExecuteTrigger memory warning on a simulator
-
xcode_wait_for_simulatorExecuteWait for a simulator to be ready
-
inspect-and-actExecuteInspect UI to identify element locators and then perform an action
-
inspect-and-tapExecuteInspect an element using one locator, then tap using the best available locator
-
close-appExecuteClose the app associated with the current Appium session
-
close-appiumExecuteClose the current Appium driver session
-
hide-keyboardExecuteHide the keyboard if it
-
install-appExecuteInstall an Android application APK
-
lock-deviceExecuteLock the device screen
-
long-pressExecutePerform a long press gesture on an element
-
open-notificationsExecuteOpen the notifications panel (Android only)
-
perform-element-actionExecutePerform a specific action on an element using various locator strategies
-
perform-touch-idExecuteSimulate Touch ID fingerprint (iOS only)
-
perform-w3c-gestureExecutePerform touch gestures using the W3C Actions API (more reliable than TouchAction API)
-
press-key-codeExecutePress an Android key code
-
scroll-screenExecuteScroll the screen in a specified direction
-
scroll-to-elementExecuteScroll until an element becomes visible
-
send-key-eventExecuteSend a key event to the device (e.g., HOME, BACK)
-
send-keysExecuteSend text input to a UI element
-
send-keys-by-ios-class-chainExecuteSend text to an element using iOS class chain (iOS only)
-
send-keys-by-ios-predicateExecuteSend text to an element using iOS predicate string (iOS only)
-
send-keys-to-deviceExecuteSend keys directly to the device without focusing on any element
-
set-orientationExecuteSet the device orientation
-
shake-deviceExecuteSimulate shake gesture (iOS only)
-
smart-tapExecuteIntelligently tap an element trying different locator strategies in a specific order
-
swipeExecutePerform a swipe gesture on the screen
-
switch-contextExecuteSwitch between contexts (e.g., NATIVE_APP, WEBVIEW)
-
tap-by-ios-class-chainExecuteTap on an element using iOS class chain (iOS only)
-
tap-by-ios-predicateExecuteTap on an element using iOS predicate string (iOS only)
-
tap-elementExecuteTap on a UI element identified by a selector
-
tap-element-by-textExecuteTap on an element containing specific text
-
unlock-deviceExecuteUnlock the device screen
-
xcode_boot_simulatorExecuteBoot an iOS simulator
-
xcode_grant_privacy_permissionExecuteGrant privacy permission to an app
-
xcode_install_cliExecuteInstall Xcode command line tools (requires user interaction)
-
xcode_open_urlExecuteOpen a URL on a simulator
-
xcode_push_notificationExecutePush a notification to a simulator
-
xcode_set_hardware_keyboardExecuteEnable/disable hardware keyboard for a simulator
-
xcode_set_simulator_locationExecuteSet the location of a simulator
-
xcode_shake_deviceExecuteSimulate shake gesture on a simulator
-
xcode_shutdown_simulatorExecuteShutdown an iOS simulator
-
xcode_terminate_appExecuteTerminate an app on a simulator
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.