simframeCAUTION
Always-warm iOS Simulator frames for coding agents — read the screen in ~20ms instead of waiting on a screenshot. MCP server + CLI.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/lvlrSajjad/simframe/actions/workflows/ci.yml) [](https://www.npmjs.com/package/simframe) [](./LICENSE) [](https://glama.ai/mcp/servers/lvlrSajjad/simframe)
Eyes, hands and memory for a coding agent driving the iOS Simulator or an Android emulator. The agent reads the screen as text with tap points, runs a whole flow in one call, and remembers screens it has seen — so it stops paying a screenshot, a model round trip and a re-read for every single step.
The same app session for a fraction of the tokens. On a real React Native field app, agents did two jobs end to end, submitting for real: create a service request, and add an asset. Measured per run, 2026-10-03:
Same model, with and without simframe: 2.5× fewer tokens and 3.5× fewer calls. The Sonnet driver did everything the no-simframe run did, with 2.3× fewer tokens, half the calls and a handful of images where it took 112. It is one run per setup, so read it as a measured example, not a rate; the full write-up, including what it does not show, is in [`docs/BE
632b213dd60cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add simframe -- npx -y [email protected]
Exposed tools (20)
18 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
sim_assert | read | Check one thing about the screen and fail loudly if it is not so. Cheaper inside a sim_do flow, where a failed assert stops the remaining steps. |
sim_capture | read | Inspect or control the background capture loops: action |
sim_devices | read | List the devices simframe can drive — iOS simulators and Android emulators. |
sim_find | read | Resolve one intent to one control: |
sim_flow_run | write | Replay a saved flow by name, verifying each step. Omit |
sim_goal | read | Hand simframe a goal in words and let it drive there locally, returning only at a milestone: done (with evidence), blocked by the verify barrier, ambiguous, not found, or out of budget. Use it instead of a sequence of single taps when you know where you want to be: |
sim_goto | read | Walk to a screen simframe already knows, over edges it has already verified, with no model call per step. Names come from sim_recall or a previous map. Refuses rather than guesses when the route is unknown or the name is ambiguous — a refusal is cheap and a wrong walk is not. |
sim_launch | read | Launch or relaunch an app, optionally with launch arguments and environment variables — the way to put an app into a test mode without touching its UI. |
sim_look | read | A screenshot: ~1600 tokens, the most expensive call here. Only for what text cannot answer — layout, colour, spacing, a control the map omits. NOT for what a field contains, whether a button is enabled, or whether an action worked: sim_ui reports the first two and the flow\ |
sim_open_url | read | Open a URL or deep link on the device — the fastest way to reach a screen when the app has a link for it. |
sim_permission | destructive | Grant, revoke or reset a privacy permission for an app. Do this instead of tapping the system alert: the alert is not part of the app under test, and its buttons move between OS versions. Not every service exists on every platform — the device |
sim_recall | read | What happened recently, as text: the screens visited, the actions taken, and what each one did. Use it to re-orient after a failure instead of taking a screenshot, and to learn the screen names sim_goto accepts. |
sim_scroll_to | read | Scroll until something is in view. A control that scrolled off the bottom of a list is not missing, and this is the difference. |
sim_state | read | Cheapest possible check: a stable screen hash, whether anything changed SINCE YOUR LAST LOOK in this session, how long the screen has been still, and an ASCII map of which regions moved. A fraction of the cost of even the text screen map. Use it to poll ( |
sim_storage | read | What the app saved, as text: its UserDefaults and (for React Native) its AsyncStorage, read straight out of |
sim_strip | read | Return the last few buffered frames tiled into ONE image, oldest first — an image, so not cheap. Lets you understand a transition, animation or flicker in a single call instead of a burst of screenshots. Looks backwards in time; it does not wait. |
sim_tap | read | Tap one thing. For more than one step, use sim_do — it batches the verification and costs one round trip. Returns the screen map afterwards. |
sim_type_into | read | Focus a field and type into it. Prefer a sim_do step when this is part of a sequence. |
sim_wait | read | Wait for the screen to change, settle, or both. sim_do already settles after every step, so you rarely need this inside a flow — reach for it when something moves without you acting, like a push or a background load. Pass |
sim_wait_for | read | Block until something appears on screen, then return the screen map. Use this instead of pausing and re-reading. |
Trust audit
CAUTIONgrade C · trust 77/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (21)
console.log(`\n${totalDivergent} divergent token(s) across those pairs, by cause:`);console.log(` ("${screen.name}" read ${before} token(s) — too sparse to compare;`export const DEFAULT_HOST = 'http://127.0.0.1:11434';
const client = http2.connect(`http://127.0.0.1:${port}`);sim_permission
debug.keystore
gradle-wrapper.jar
.eslintrc.js
.prettierrc.js
.watchmanconfig
.xcode.env
const md5 = (buf) => createHash('md5').update(buf).digest('hex');const expected = crypto.createHash('sha1').update(key + WS_GUID).digest('base64');const spilled = path.join(dir, crypto.createHash('md5').update(key).digest('hex'));const accept = crypto.createHash('sha1')fs.writeFileSync(path.join(inner, crypto.createHash('md5').update('spilled').digest('hex')), big);@react-navigation/bottom-tabs, @react-navigation/native, @react-navigation/native-stack, react-native-safe-area-context, react-native-screens, @babel/core, @babel/preset-env, @babel/runtime
@modelcontextprotocol/sdk
The prediction about public APIs was right and my guess about *which* ones was wrong. The plan said capture would be the emulator’s gRPC streaming endpoint with a scrcpy-style fallback. It isn’t: the
simframe goto "home" --text '{"Email": "[email protected]", "Password": "..."}'<p>The prediction about public APIs was right and my guess about <em>which</em> ones was wrong. The plan said capture would be the emulator’s gRPC streaming endpoint with a scrcpy-style fallback
Gates applied: no_behavioural_pass.
632b213dd60cfull audit observations/trust-audit/mcp-server/lvlrsajjad__simframe.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 632b213dd60c | CAUTION | C | 77 | first audit |
Questions
What is the simframe MCP server?
Always-warm iOS Simulator frames for coding agents — read the screen in ~20ms instead of waiting on a screenshot. MCP server + CLI.
What tools does simframe expose?
20 in total: 18 read-only, 1 that write, and 1 that can delete or overwrite (sim_permission). Every one is listed on this page with its risk.
Is simframe safe to connect to an agent?
With care. The audit graded it C (77/100) and found 21 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does simframe need?
It reads SMITHERY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does simframe run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as simframe at 0.23.1.
How current is this page?
The grade is for one exact copy of the source (632b213dd60c), read on 2026-10-12. The repository is watched and re-audited when it changes.