io.github.mobile-next/mobile-mcp

The material explicitly states that no keys or environment variables are required, and there is no indication of API tokens, account passwords, or cloud credentials being requested; based on the available facts, credential exposure and abuse risk appears low.

No remote host is declared, and the documentation does not show user data being sent to third-party services; from the current material, there is no clear data egress path or unknown network destination.

The system checks explicitly indicate executes-code capability; given its stated role in iOS/Android development, automation, and testing, it can reasonably be expected to invoke local development or test commands/processes. This is a normal property of this type of MCP tool and warrants a controlled environment, but by itself does not justify a high-risk rating.

As a mobile development/automation MCP, it would typically need to read local projects, build artifacts, test outputs, or device/simulator-related data; the current material does not define exact read/write boundaries, so it should be treated as potentially accessing local development data, but there is no evidence of permissions clearly exceeding its stated purpose.

It comes from the official registry, has an open-source repository, and was updated within the past year, all of which are meaningful risk-reducing signals; however, the near-absent README, undeclared license, and 0-star adoption mean audit context and ecosystem validation remain limited, so repository-level review is still advisable before integration.