AutoMobileBLOCK
Mobile automation suite of tools including an MCP and libraries for test authoring & execution
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
⚠️ PROJECT ARCHIVED AutoMobile is no longer maintained or supported by Zillow. Zillow does not provide warranties or support for this project. This repository has been archived and is read-only. For continued development and support, please see the community-maintained fork by Jason Pearson: 🔗 [https://github.com/kaeawc/auto-mobile](https://github.com/kaeawc/auto-mobile)
AutoMobile is a set of tools for mobile automation. You can use it for UI testing or as a development workflow assistant.
The first platform supported is Android with plans to extend to iOS.
How it works
- 🔧 Powerful MCP Server: AutoMobile provides comprehensive actions through MCP
tool calls with a fast observations to drive the interaction loop.
- 🗺️ Source Mapping: Combining project path config with deep view hierarchy analysis we know exactly what code is being rendered.
- ✍️ Automated Test Authoring: When used in test authoring mode AutoMobile will write tests for you. It is the only way it writes tests.
- 🧪 Test Execution - Run tests locally or on CI without extra infrastructure.
- 📱 Device Management: Multi-device support with emulator control and app lifecycle management.
All together you get a system that looks like this:
Documentation
- 💻 Installation & Getting Started - AutoMobile is [published on npm](https://www.npmjs.
7d41dcd35d58OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add auto-mobile -- npx -y [email protected]
{
"mcpServers": {
"auto-mobile": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (16)
16 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
apkanalyzer | read | APK analysis and inspection |
appPackage | read | The package name of the app to debug |
avdmanager | read | Android Virtual Device management |
d8 | read | DEX compiler |
debug-session | read | Generate a debugging session prompt for mobile app analysis |
deviceId | read | The device ID to debug on |
lint | read | Static code analysis |
profgen | read | ART profile generation |
r8 | read | Code shrinking and obfuscation |
resourceshrinker | read | Resource optimization |
retrace | read | Stack trace de-obfuscation |
screenshot2 | read | Device screenshot capture |
sdkmanager | read | SDK package management |
testTool | read | Test tool |
tool1 | read | Tool 1 |
tool2 | read | Tool 2 |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
rawPlan = yaml.load(yamlContent) as any;
gradle-wrapper.jar
print_status("Documentation will be available at: http://127.0.0.1:8000").gitmodules
.mocharc.json
return crypto.createHash("md5").update(deviceId).digest("hex");return crypto.createHash("md5").update(data).digest("hex");config_file_arg = "../../mkdocs.yml"
config_file_arg = "../../mkdocs.yml"
config_file_arg = "../../mkdocs.yml"
config_file_arg = "../../mkdocs.yml"
import { AdbUtils } from "../../utils/android-cmdline-tools/adb";@modelcontextprotocol/sdk, @types/js-yaml, @types/uuid, fs-extra, glob, jimp, js-yaml, pixelmatch
android/playground/mediaplayer/src/main/res/raw/automobile_landscape.webm
android/playground/mediaplayer/src/main/res/raw/automobile_portrait.webm
ios/playground/Playground/video.mp4
Gates applied: no_behavioural_pass.
7d41dcd35d58full audit observations/trust-audit/mcp-server/zillow__automobile.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 7d41dcd35d58 | BLOCK | D | 69 | first audit |
Questions
What is the AutoMobile MCP server?
Mobile automation suite of tools including an MCP and libraries for test authoring & execution
What tools does AutoMobile expose?
16 in total: 16 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is AutoMobile safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does AutoMobile need?
No credential environment variables were found in its source, so it appears to need none.
How does AutoMobile run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as auto-mobile at 0.0.5.
How current is this page?
The grade is for one exact copy of the source (7d41dcd35d58), read on 2026-10-07. The repository is watched and re-audited when it changes.