Atlas / MCP servers / fortemate / vega-vvd-driver

vega-vvd-driverCAUTION

mcp/fortemate/vega-vvd-driver

Drive the Vega Virtual Device from scripts and AI agents: remote keys, screenshots, video with sound, frame capture and an MCP server. Unofficial; not affiliated with Amazon.

Verdict
CAUTION
Grade
B
Trust score
88 /100
Exposed tools
7 6r · 1w · 0d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Drive the Vega Virtual Device from scripts and AI agents: press remote keys, take screenshots, record video with sound, wait for the screen to change and check the TV safe area. A Node library, the vvd command and an MCP server.

Unofficial. Not made, endorsed or supported by Amazon. Amazon, Fire TV and Vega are trademarks of Amazon.com, Inc. or its affiliates.

Why

The Vega SDK's vega command installs and launches apps on the Vega Virtual Device (VVD), but has no command to press a remote key or take a screenshot. On a Fire TV Stick, the device's own gwsi-tool-screenshooter takes one through vega exec vda shell, but the VDA reference notes that the VVD doesn't support it. Amazon's Appium Vega driver does both, and much more: it runs UI tests that find elements, on the VVD and on a Fire TV Stick. It needs an Appium 2 server, the driver package and the device's automation toolkit switched on, with Node 22 or earlier.

This driver is for lighter jobs on the VVD: a key press or a screenshot from a shell script, a video with sound, every frame of an animation, and an AI coding agent that can see what it built. It talks to the Android emulator that the VVD is built on, through the emulator's own gRPC API and console, so there is nothing to install on the device and no server to run.

Its methods were worked out while building Dice Chess for Fire TV: scripts drove whole sessions with nobody at the emulator, took every screenshot of the game's gallery, checked its move animations frame by frame and recorded its demo video. The obstacles on the way are in that project's friction log for Amazon, as FL-08, FL-09 and FL-28.

Appium or this driver?

Read from source at commit 308351f58598OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add vega-vvd-driver -- npx -y @fortemate/[email protected]
claude-desktop
{
  "mcpServers": {
    "vega-vvd-driver": {
      "command": "npx",
      "args": [
        "-y",
        "@fortemate/[email protected]"
      ]
    }
  }
}
03

Exposed tools (7)

6 read · 1 write · 0 destructive.

ToolRiskDescription
check_safe_arearead
enable_grpcwrite
list_devicesread
press_keysread
record_videoread
screenshotread
wait_for_changeread
04

Trust audit

CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (7)

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/console.test.ts:9
const TOKEN = 'console-token-for-tests';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/fakeEmulator.ts:26
export const TOKEN = 'fake-token-for-tests';
LOWInventory / provenance · inv.hidden_file · CWE-1104
.coderabbit.yaml
.coderabbit.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierrc.json
.prettierrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/mcp.test.ts:164
['http://127.0.0.1:9/take.mp4', /local path, not a URL/],
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@grpc/grpc-js, @grpc/proto-loader, @modelcontextprotocol/sdk, zod, @types/node, prettier, typescript
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 308351f58598full audit observations/trust-audit/mcp-server/fortemate__vega-vvd-driver.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11308351f58598CAUTIONB88first audit
06

Questions

What is the vega-vvd-driver MCP server?

Drive the Vega Virtual Device from scripts and AI agents: remote keys, screenshots, video with sound, frame capture and an MCP server. Unofficial; not affiliated with Amazon.

What tools does vega-vvd-driver expose?

7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is vega-vvd-driver safe to connect to an agent?

With care. The audit graded it B (88/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does vega-vvd-driver need?

No credential environment variables were found in its source, so it appears to need none.

How does vega-vvd-driver run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @fortemate/vega-vvd-driver at 0.2.2.

How current is this page?

The grade is for one exact copy of the source (308351f58598), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement