Tauri PluginBLOCK
Allows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Tauri plugin and MCP server that allow AI agents such as Cursor and Claude Code to interact with and debug your Tauri application through screenshots, DOM access, input simulation, and more.
Upgrading? Behavior changes are listed in CHANGELOG.md.
Install
npm (guest-js bindings)
npm install tauri-plugin-mcp
MCP Server CLI
npm install -g tauri-plugin-mcp-server # or run directly npx tauri-plugin-mcp-server
Rust (Cargo)
Coming soon to crates.io. For now, use a git dependency:
[dependencies]
tauri-plugin-mcp = { git = "https://github.com/P3GLEG/tauri-plugin-mcp" }Tools
The MCP server exposes 19 high-level tools to AI agents:
21aaf4c4a650OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add tauri-plugin-mcp --env TAURI_MCP_AUTH_TOKEN=${TAURI_MCP_AUTH_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"tauri-plugin-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TAURI_MCP_AUTH_TOKEN": "${TAURI_MCP_AUTH_TOKEN}"
}
}
}
}Exposed tools (19)
15 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
app_bridge | read | Calls helpers the host app registered via window.__MCP_BRIDGE__.register(name, fn, description) — the sanctioned way to read app state (store snapshots) or trigger app-level actions, instead of execute_js against app internals. ALWAYS run action= |
click | read | |
dispatch_pointer | read | Dispatches a synthetic pointer/mouse gesture (full pointerdown→mousedown→pointerup→mouseup→click chains) on the EXACT element matched — no retargeting to interactive ancestors. Built for targets the click tool can |
execute_js | write | Executes arbitrary JavaScript in a webview. Returns the completion value of the code (the last expression |
inspect_element | read | |
log_mark | read | |
manage_ipc | write | Tauri IPC layer access — invoke backend commands and drive/observe events. Actions: |
manage_storage | destructive | Manages browser storage. For localStorage: get/set/remove items, clear all, or list keys. For cookies: get all cookies, get cookies for a URL, or clear all browsing data (nuclear — clears cookies, cache, and localStorage). |
manage_window | read | |
mouse_action | read | Performs non-click mouse actions. |
navigate | read | Controls webview navigation. |
press_key | read | |
query_logs | read | Query buffered logs from the Tauri app (both Rust-side log!() output and webview console.* calls). |
query_page | read | Inspects the current page. Modes: |
read_text | read | |
restart_app | write | Restarts the Tauri application and waits for it to come back online. Use when the app is in a broken state, unresponsive, or needs a fresh start. If the app is completely frozen, it will be force-killed. This is a destructive operation — all in-memory state will be lost. NOT available in dev mode ( |
take_screenshot | read | |
type_text | read | Types text into the page. Four modes: (1) Provide |
wait_for | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
return new Function(code)();
manage_storage
@modelcontextprotocol/sdk, zod, @types/node, typescript
@tauri-apps/api, @rollup/plugin-typescript, rollup, typescript, tslib
Gates applied: no_behavioural_pass, no_license.
21aaf4c4a650full audit observations/trust-audit/mcp-server/p3gleg__tauri-plugin.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 21aaf4c4a650 | BLOCK | D | 69 | first audit |
Questions
What is the Tauri Plugin MCP server?
Allows AI agents (e.g., Cursor, Claude Code) to debug within Tauri apps via screenshot capture, window management, DOM access, and simulated user inputs.
What tools does Tauri Plugin expose?
19 in total: 15 read-only, 3 that write, and 1 that can delete or overwrite (manage_storage). Every one is listed on this page with its risk.
Is Tauri Plugin safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Tauri Plugin need?
It reads TAURI_MCP_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Tauri Plugin run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as tauri-plugin-mcp at 0.3.1.
How current is this page?
The grade is for one exact copy of the source (21aaf4c4a650), read on 2026-10-07. The repository is watched and re-audited when it changes.