react-native-ai-devtoolsBLOCK
Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://registry.modelcontextprotocol.io/?q=com.execbro%2Fexecbro)
Give your AI assistant eyes and hands into your running React Native app. Like Chrome DevTools — but for AI agents.
Build, debug, and verify features end-to-end — without leaving the chat.
ExecBro is the runtime bridge between your AI coding assistant and your running React Native app — exposing MCP tools to read logs and network, inspect component state, capture screenshots, tap the UI, and run JS. Zero config, no SDK or code changes required to start — and installing the optional SDK is recommended for the most robust log and network capture.
Get started
- Setup ExecBro as an MCP server for your agent of choice
- Setup UI automation helpers
- Install the SDK in your React Native app — optional, but recommended for the most robust log, network, and state experience
- Authorize and link to the web dashboard — optional, for usage stats and session history
- Start your React Native app (
npm start/expo start) - Ask your AI assistant in plain language — e.g. "Connect to the simulator and investigate what caused the error on the screen"
See your usage — execbro.com
Log in at [execbro.com](https://execbro.com) to see your ExecBro activity rendered back to you: which tools you use most, tool error rates, and your session history — so you can spot flaky tools, track usage over time, and understand how your agent drives the app across sessions. It's built from the same anonymous telemetry described in [Telemetry & Privacy](#t
481463626f36OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add execbro -- npx -y [email protected]
Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
dev | read | |
ios_button | read | |
lock | read | Engage the touch lock |
resetPrefs | read |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
skippedReason: "verify=false",
explanation: "Verification skipped (verify=false).",
skippedReason: "screenshot=false, verify=false",
explanation: "Verification skipped (screenshot=false and verify=false)."
skippedReason: "verify=false",
"and run `sudo xcode-select -s /Applications/Xcode.app/Contents/Developer`. " +
if (existsSync("/etc/machine-id")) {return readFileSync("/etc/machine-id", "utf-8").trim();session = http2.connect(`http://127.0.0.1:${bridge.port}`);bridge: { port: 8554, token: "dG9rZW4rd2l0aC9iYXNlNjQ9", avdName: "Pixel 9" },const TOKEN = "opaque-session-id-abcdefgh";
const TOKEN = "opaque-session-id-abcdefgh";
const TOKEN = "captured-token-abcdefghijkl";
const apiKey = "phc_snUX9TpjAwNhosPMxAY7D89ijESyrQzucAi9qbPJptPY";
expect(redactSecrets("key sk_live_51H8xKzAbCdEfGhIjKlMnOp here")).toContain("[secret:stripe_app]");const run = new Function("globalThis", source + "; return (" + expr + ");");expect(() => new Function("return " + src.replace(/^\(function/, "(function"))).not.toThrow();const run = new Function("state", "fetch", "globalThis", "return " + src + ";");const run = new Function("state", "fetch", "globalThis", "return " + src + ";");const parses = (js: string) => () => new Function(`return ${js};`);return join(logDir, `${basename(cwd)}-${createHash("sha1").update(cwd).digest("hex").slice(0, 8)}.log`);fingerprint: createHash("sha1").update(`js|${entry.seq}`).digest("hex"),if (!head) return createHash("sha1").update(`${deviceKey}|empty`).digest("hex");return createHash("sha1").update(JSON.stringify(parts)).digest("hex");import { getInterceptorScript, buildMockPushScript } from "../../core/networkInterceptor.js";Gates applied: no_behavioural_pass.
481463626f36full audit observations/trust-audit/mcp-server/igorzheludkov__execbro.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 481463626f36 | BLOCK | F | 50 | first audit |
Questions
What is the react-native-ai-devtools MCP server?
Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots
What tools does react-native-ai-devtools expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is react-native-ai-devtools safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (50/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does react-native-ai-devtools need?
It reads BUILD_TOKEN and BUILD_TOKEN_TARGET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does react-native-ai-devtools run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as execbro at 2.16.1.
How current is this page?
The grade is for one exact copy of the source (481463626f36), read on 2026-10-11. The repository is watched and re-audited when it changes.