ModelsAtlas
Explore
Atlas / MCP servers / arenukvern / Flutter Inspector

Flutter InspectorBLOCK

mcp/arenukvern/flutter-inspector
MCP server by arenukvern · ai · cli tools · dart · Audited 2026-10-02
⚑ Report / re-scanSource ↗

MCP Toolkit for Flutter AI Agent Driven Development (MCP/CLI + custom client side tools) - via closed feedback loop (visual & semantic snapshot) and high client side customization adaptable for any Flutter app. Nowadays it is often called as agentic harness.

Verdict
BLOCK
Grade
D
Trust score
65 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
382
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://mcptoplist.com/server/glama%2FArenukvern%2Fmcp_flutter)

Inspect and drive a running Flutter app from your AI assistant.

[](https://skills.sh/arenukvern/mcpflutter) [](https://pub.dev/packages/mcptoolkit) [](https://github.com/Arenukvern/mcpflutter/actions/workflows/contractgates.yml) [](https://github.com/Arenukvern/mcpflutter/actions/workflows/intentcalleval.yml) [](https://github.com/Arenukvern/mcpflutter/actions/workflows/skillassetsdrift.yml) [](https://docs.page/arenukvern/mcpflutter/) [](https://deepwiki.com/Arenukvern/mcpflutter) [](https://opensource.org/licenses/MIT) [](https://flutter.dev) [](https://smithery.ai/server/@Arenukvern/mcpflutter) [](https://registry.modelcontextprotocol.io/v0/servers/io.github.Arenukvern%2Fflutter-mcp-toolkit/versions) [![All Contributors](https://img.shields.io/github/all-contributors/Arenukvern/mcp_flutter?color=

Read from source at commit cbd510e12087OBSERVED · 2026-10-02
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (oci)
claude mcp add flutter-mcp-toolkit:5.1.0 -- docker run -i --rm ghcr.io/arenukvern/flutter-mcp-toolkit:5.1.0:None
03

Trust audit

BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (12 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (25)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
tool/evals/run_dogfood_eval.sh:29
webmcp_verify=false
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHPrompt injection · prompt.persistence · CWE-94, CWE-1427
plugin/skills/flutter-mcp-toolkit-setup/SKILL.md:79
Binary missing or not on PATH. Rebuild and add to PATH:
Why it matters. instructs the agent to persist itself in the user's environment
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills/flutter-mcp-boundary-audit
.cursor/skills/flutter-mcp-boundary-audit
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills/flutter-mcp-toolkit-dogfood-iterations
.cursor/skills/flutter-mcp-toolkit-dogfood-iterations
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills/flutter-mcp-toolkit-maintain-macos
.cursor/skills/flutter-mcp-toolkit-maintain-macos
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills/flutter-mcp-toolkit-maintain-web
.cursor/skills/flutter-mcp-toolkit-maintain-web
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills/flutter-mcp-toolkit-repo-maintainer
.cursor/skills/flutter-mcp-toolkit-repo-maintainer
Why it matters. link not followed
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp_server_dart/lib/src/capabilities/visual_capture/web_cdp_discovery.dart:74
/// Fetches Chrome DevTools target list from `http://127.0.0.1:{port}/json/list`.
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp_server_dart/lib/src/capabilities/visual_capture/web_cdp_discovery.dart:82
Uri.parse('http://127.0.0.1:$port/json/list'),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp_server_dart/lib/src/skill_assets.g.dart:2268
6. **Two browsers** — chrome-devtools MCP profile ≠ Flutter-launched Chrome unless you attach with `--browser-url=http://127.0.0.1:<cdpPort>`.
MEDIUMSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
.agents/skills/mcp-harness-repo-maintainer/SKILL.md:142
1. Released adopter or CI path: `curl -fsSL https://raw.githubusercontent.com/Arenukvern/skill_steward/main/install.sh | bash`, then `steward <command>`.
LOWInventory / provenance · inv.hidden_file · CWE-1104
.all-contributorsrc
.all-contributorsrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.clinerules
.clinerules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.markdownlint.json
.markdownlint.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.release-please-manifest.json
.release-please-manifest.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.skills.json.example
.skills.json.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.agents/skills/mcp-harness-repo-maintainer/evals/cases/adoption-promotion-trigger.yaml:9
path: ../../docs/evidence/h3-h5-adoption-promotion-packet-2026-06-10.mdx
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.agents/skills/mcp-harness-repo-maintainer/evals/cases/adoption-promotion-trigger.yaml:16
path: ../../docs/evidence/h3-h5-adoption-promotion-packet-2026-06-10.mdx
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.agents/skills/mcp-harness-repo-maintainer/evals/cases/adoption-promotion-trigger.yaml:19
path: ../../packages/steward_cli/README.md
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.agents/skills/mcp-harness-repo-maintainer/evals/cases/capability-classification-trigger.yaml:9
path: ../../docs/evidence/adoption-run-v2-template.mdx
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.agents/skills/mcp-harness-repo-maintainer/evals/cases/capability-classification-trigger.yaml:11
path: ../../docs/evidence/mcp-flutter-runtime-text-input-capability-proof-2026-06-10.mdx
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
decisions/0007_web_headful_tab_capture.mdx:55
4. **HTTP verify** — `GET http://127.0.0.1:{port}/json/list`, select `type: page`,
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp_server_dart/test/flutter_tool_machine_discovery_test.dart:58
'/path/to/dart development-service --vm-service-uri=http://127.0.0.1:55571/jafDCsl7Cz4=/ --bind-address=127.0.0.1 --bind-port=0',
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
mcp_server_dart/README.md:480
[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=flutter-mcp-toolkit&config=eyJjb21tYW5kIjoiL3BhdGgvdG8veW91ci9jbG9uZWQvbWNwX2ZsdXR0ZXIvbWN
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
.agents/skills/release-changelog-harness/references/binary-release-contract.md:42
curl -fsSL https://raw.githubusercontent.com/OWNER/REPO/main/install.sh | bash

Gates applied: no_behavioural_pass.

Audited 2026-10-02 · audit v0.4.1 · source sha cbd510e12087full audit observations/trust-audit/mcp-server/arenukvern__flutter-inspector.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-02cbd510e12087BLOCKD65first audit
05

Questions

What is the Flutter Inspector MCP server?

MCP Toolkit for Flutter AI Agent Driven Development (MCP/CLI + custom client side tools) - via closed feedback loop (visual & semantic snapshot) and high client side customization adaptable for any Flutter app. Nowadays it is often called as agentic harness.

Is Flutter Inspector safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (65/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Flutter Inspector need?

No credential environment variables were found in its source, so it appears to need none.

How does Flutter Inspector run?

It speaks stdio, so it runs as a local process your client starts.

How current is this page?

The grade is for one exact copy of the source (cbd510e12087), read on 2026-10-02. The repository is watched and re-audited when it changes.

Advertisement