Host-controlled boundaries
Secure mode keeps endpoints local, ignores untrusted project configuration, blocks secret paths, and resolves symbolic links before access.
Release alpha.14 is live
MobiLoop MCP
Mobile validation loops that start on a real device and end with evidence your team can inspect.
- Platform
- Android / iOS
- Driver
- Appium 3
- Proof
- Logs + source + screen
RUN / 001
VERIFIED
00:02:14
LIVE MOBILE VALIDATION
MiniTask validation fixture
MobiLoop run consolePixel 9 / Android 16
01Device attachedPixel 9 / ready
02Session createdUiAutomator2 / healthy
03Evidence capturedscreen + XML + logs
04Release gateapproved
Actual device automation
Approval-gated actions
Security scan comparisons
Replayable evidence artifacts
The closed loop
A change is not done until the mobile run says so.
-
01
Map the app
Read the codebase, detect routes and screens, then form runnable scenarios.
-
02
Build with limits
Run only the approved lint, test, build, and install commands.
-
03
Drive the device
Use Appium against a simulator, emulator, or connected physical device.
-
04
Collect proof
Store page source, screenshots, assertions, logs, and run iterations together.
-
05
Fix and retest
Make the approved repair, compare security signals, and rerun the same path.
Guarded by default
Give the agent a test loop, not unrestricted access.
Useful mobile signals
security.scan_source reads Android and iOS configuration, credential,
transport, storage, and logging signals without adding a scanner dependency.
Every fix has a receipt
Compare scan baselines, retain redacted artifacts, and use the release gate before calling an AI-generated repair ready.
Run the release
The published server speaks MCP over stdio.
docker run --rm -i --read-only \
--tmpfs /tmp:uid=10001,gid=10001,mode=1777 \
ghcr.io/enessubass/mobiloop-mcp:0.1.0-alpha.14The image starts as a non-root process with a guarded workspace contract.
Read the container guide ->Operating reference