@mobilenext/mobile-mcp 0.0.48 → 0.0.50

package/README.md

@@ -7,24 +7,15 @@ This server allows Agents and LLMs to interact with native iOS/Android applicati
   <a href="https://github.com/mobile-next/mobile-mcp">
     <img src="https://img.shields.io/github/stars/mobile-next/mobile-mcp" alt="Mobile Next Stars" />
   </a>
-  <a href="https://github.com/mobile-next/mobile-mcp">
-    <img src="https://img.shields.io/github/contributors/mobile-next/mobile-mcp?color=green" alt="Mobile Next Downloads" />
-  </a>
   <a href="https://www.npmjs.com/package/@mobilenext/mobile-mcp">
     <img src="https://img.shields.io/npm/dm/@mobilenext/mobile-mcp?logo=npm&style=flat&color=red" alt="npm" />
   </a>
   <a href="https://github.com/mobile-next/mobile-mcp/releases">
     <img src="https://img.shields.io/github/release/mobile-next/mobile-mcp" />
   </a>
-  <a href="https://github.com/mobile-next/mobile-mcp/blob/main/LICENSE">
-    <img src="https://img.shields.io/badge/license-Apache 2.0-blue.svg" alt="Mobile MCP is released under the Apache-2.0 License" />
-  </a>
   <a href="https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3F%7B%22name%22%3A%22mobile-mcp%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40mobilenext%2Fmobile-mcp%40latest%22%5D%7D">
     <img src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20Server&color=0098FF" alt="Install in VS Code" />
   </a>
-</h4>
-
-<h4 align="center">
   <a href="https://github.com/mobile-next/mobile-mcp/wiki">
     <img src="https://img.shields.io/badge/documentation-wiki-blue" alt="wiki" />
   </a>

package/lib/server.js

@@ -18,6 +18,9 @@ const png_1 = require("./png");
 const image_utils_1 = require("./image-utils");
 const mobilecli_1 = require("./mobilecli");
 const mobile_device_1 = require("./mobile-device");
+const utils_1 = require("./utils");
+const ALLOWED_SCREENSHOT_EXTENSIONS = [".png", ".jpg", ".jpeg"];
+const ALLOWED_RECORDING_EXTENSIONS = [".mp4"];
 const getAgentVersion = () => {
     const json = require("../package.json");
     return json.version;
@@ -348,6 +351,10 @@ const createMcpServer = () => {
         device: zod_1.z.string().describe("The device identifier to use. Use mobile_list_available_devices to find which devices are available to you."),
         url: zod_1.z.string().describe("The URL to open"),
     }, { destructiveHint: true }, async ({ device, url }) => {
+        const allowUnsafeUrls = process.env.MOBILEMCP_ALLOW_UNSAFE_URLS === "1";
+        if (!allowUnsafeUrls && !url.startsWith("http://") && !url.startsWith("https://")) {
+            throw new robot_1.ActionableError("Only http:// and https:// URLs are allowed. Set MOBILEMCP_ALLOW_UNSAFE_URLS=1 to allow other URL schemes.");
+        }
         const robot = getRobotFromDevice(device);
         await robot.openUrl(url);
         return `Opened URL: ${url}`;
@@ -386,8 +393,10 @@ const createMcpServer = () => {
     });
     tool("mobile_save_screenshot", "Save Screenshot", "Save a screenshot of the mobile device to a file", {
         device: zod_1.z.string().describe("The device identifier to use. Use mobile_list_available_devices to find which devices are available to you."),
-        saveTo: zod_1.z.string().describe("The path to save the screenshot to"),
+        saveTo: zod_1.z.string().describe("The path to save the screenshot to. Filename must end with .png, .jpg, or .jpeg"),
     }, { destructiveHint: true }, async ({ device, saveTo }) => {
+        (0, utils_1.validateFileExtension)(saveTo, ALLOWED_SCREENSHOT_EXTENSIONS, "save_screenshot");
+        (0, utils_1.validateOutputPath)(saveTo);
         const robot = getRobotFromDevice(device);
         const screenshot = await robot.getScreenshot();
         node_fs_1.default.writeFileSync(saveTo, screenshot);
@@ -463,9 +472,13 @@ const createMcpServer = () => {
     });
     tool("mobile_start_screen_recording", "Start Screen Recording", "Start recording the screen of a mobile device. The recording runs in the background until stopped with mobile_stop_screen_recording. Returns the path where the recording will be saved.", {
         device: zod_1.z.string().describe("The device identifier to use. Use mobile_list_available_devices to find which devices are available to you."),
-        output: zod_1.z.string().optional().describe("The file path to save the recording to. If not provided, a temporary path will be used."),
+        output: zod_1.z.string().optional().describe("The file path to save the recording to. Filename must end with .mp4. If not provided, a temporary path will be used."),
         timeLimit: zod_1.z.coerce.number().optional().describe("Maximum recording duration in seconds. The recording will stop automatically after this time."),
     }, { destructiveHint: true }, async ({ device, output, timeLimit }) => {
+        if (output) {
+            (0, utils_1.validateFileExtension)(output, ALLOWED_RECORDING_EXTENSIONS, "start_screen_recording");
+            (0, utils_1.validateOutputPath)(output);
+        }
         getRobotFromDevice(device);
         if (activeRecordings.has(device)) {
             throw new robot_1.ActionableError(`Device "${device}" is already being recorded. Stop the current recording first with mobile_stop_screen_recording.`);

package/lib/utils.js

@@ -1,7 +1,15 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validatePackageName = validatePackageName;
 exports.validateLocale = validateLocale;
+exports.validateFileExtension = validateFileExtension;
+exports.validateOutputPath = validateOutputPath;
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_fs_1 = __importDefault(require("node:fs"));
 const robot_1 = require("./robot");
 function validatePackageName(packageName) {
     if (!/^[a-zA-Z0-9._]+$/.test(packageName)) {
@@ -13,3 +21,60 @@ function validateLocale(locale) {
         throw new robot_1.ActionableError(`Invalid locale: "${locale}"`);
     }
 }
+function getAllowedRoots() {
+    const roots = [
+        node_os_1.default.tmpdir(),
+        process.cwd(),
+    ];
+    // macOS /tmp is a symlink to /private/tmp, add both to be safe
+    if (process.platform === "darwin") {
+        roots.push("/tmp");
+        roots.push("/private/tmp");
+    }
+    return roots.map(r => node_path_1.default.resolve(r));
+}
+function isPathUnderRoot(filePath, root) {
+    const relative = node_path_1.default.relative(root, filePath);
+    if (relative === "") {
+        return false;
+    }
+    if (node_path_1.default.isAbsolute(relative)) {
+        return false;
+    }
+    if (relative.startsWith("..")) {
+        return false;
+    }
+    return true;
+}
+function validateFileExtension(filePath, allowedExtensions, toolName) {
+    const ext = node_path_1.default.extname(filePath).toLowerCase();
+    if (!allowedExtensions.includes(ext)) {
+        throw new robot_1.ActionableError(`${toolName} requires a ${allowedExtensions.join(", ")} file extension, got: "${ext || "(none)"}"`);
+    }
+}
+function resolveWithSymlinks(filePath) {
+    const resolved = node_path_1.default.resolve(filePath);
+    const dir = node_path_1.default.dirname(resolved);
+    const filename = node_path_1.default.basename(resolved);
+    try {
+        return node_path_1.default.join(node_fs_1.default.realpathSync(dir), filename);
+    }
+    catch {
+        return resolved;
+    }
+}
+function validateOutputPath(filePath) {
+    const resolved = resolveWithSymlinks(filePath);
+    const allowedRoots = getAllowedRoots();
+    const isWindows = process.platform === "win32";
+    const isAllowed = allowedRoots.some(root => {
+        if (isWindows) {
+            return isPathUnderRoot(resolved.toLowerCase(), root.toLowerCase());
+        }
+        return isPathUnderRoot(resolved, root);
+    });
+    if (!isAllowed) {
+        const dir = node_path_1.default.dirname(resolved);
+        throw new robot_1.ActionableError(`"${dir}" is not in the list of allowed directories. Allowed directories include the current directory and the temp directory on this host.`);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mobilenext/mobile-mcp",
   "mcpName": "io.github.mobile-next/mobile-mcp",
-  "version": "0.0.48",
+  "version": "0.0.50",
   "description": "Mobile MCP",
   "repository": {
     "type": "git",