| FMRS | 54 / 100 · D | 79 / 100 · B |
|---|
| Reliability | 8 / 20 | 12 / 20 |
|---|
| Security and permissions | 7 / 20 | 16 / 20 |
|---|
| Maintenance | 12 / 20 | 18 / 20 |
|---|
| Documentation | 14 / 20 | 18 / 20 |
|---|
| Setup experience | 13 / 20 | 15 / 20 |
|---|
| Best for | - Teams with a debuggable, running Flutter/React Native/Electron/Tauri/mobile/web app who want natural-language E2E testing instead of writing test scripts
- Developers who want to drive exploratory testing directly from an MCP client like Claude Desktop, Cursor, Windsurf, or Copilot
- Scenarios where low-token UI understanding (accessibility-tree snapshots instead of screenshots) matters for cost
| - Developers auditing NPM dependencies within AI workflows
- Teams performing supply chain security assessments
- Users of Claude Desktop, Cursor, or VS Code
|
|---|
| Not for | - Teams that require a tool maintained by an official upstream vendor (e.g. Flutter, Google, Anthropic) — this is a third-party project maintained by ai-dashboad
- Restricted environments that cannot integrate a platform SDK into the app or cannot install local npm/CLI tooling
- Situations requiring the production-proven maturity and community scale of established tools like Playwright or Appium
| - Projects outside the NPM ecosystem (e.g., pure Python/Go)
- Environments without network access to deps.dev, OSV.dev, and the npm registry
- Scenarios requiring maintenance by an official upstream vendor
|
|---|
| Required permissions | - Local execution permission to launch and run the `flutter-skill` executable over stdio
- Connection and control permissions over the app/browser instance under test (tap, type, screenshot, read widget tree, etc.)
- Access to runtime data such as app logs, console messages, and network requests
- Network port listening permission when using the HTTP `serve` mode (configurable via `--port`/`--host` or environment variables)
| - Network access to the NPM registry and external services (deps.dev, OSV.dev, OpenSSF, npms.io, GitHub)
- Read access to workspace lockfiles (pnpm-lock.yaml, package-lock., yarn.lock) for cache invalidation
|
|---|
| Risks and side effects | - This is a third-party open-source implementation, not maintained by Flutter, Google, or Anthropic — the source material does not describe any audit, signing, or supply-chain security process
- The tools can perform arbitrary interactions (tap, type, execute JavaScript via `eval`, inject login sessions, etc.); if driven by a malicious or manipulated prompt, they could take unintended or destructive actions against the app under test
- Tools like `eval` execute arbitrary JavaScript in the page context, and `mock_api`/`intercept_requests` can alter network behavior — restrict use to trusted development/test environments
- The manifest version (0.9.36) indicates the project is still pre-1.0 and its interface may change
| - Third-party READMEs and changelogs are untrusted external content; they are wrapped in tags with _meta flags but should still be handled cautiously
- Depends on availability and accuracy of external services
- Batch requests are capped at 25 packages to prevent registry enumeration; larger sets require batching
- Third-party open source project, not officially maintained by NPM or Anthropic
|
|---|
| Supported clients | Claude Desktop, Cursor, Windsurf, VSCode Copilot, Cline, Continue, OpenClaw | Claude Desktop, VS Code, Cursor |
|---|
| Tools | 100 | 19 |
|---|