mobile-dev-mcp

The server's core functionality relies on executing external commands (ADB, xcrun). However, robust input validation is implemented for all user-provided parameters (device IDs, package names, UDIDs, log filters, ports) before they are used in `execAsync` calls, significantly mitigating shell injection risks. The system strictly adheres to a 'read-only' design, meaning it does not perform actions that modify device state (e.g., taps, installs, inputs), which is verified in tests and documentation. The license cache uses HMAC signing with a machine-specific secret to prevent tampering. While inherent risks exist with running external binaries and relying on an external license validation API, these are well-mitigated and standard for this type of tool.