MCP server Device Posture API security — device type fingerprinting, physical behavior tracking, fold state as activity oracle, posture-based UI manipulation

What the Device Posture API exposes

navigator.devicePosture.type returns a string — currently "folded" or "continuous" — representing the device's current physical configuration. The "folded" state applies when a foldable device is partially or fully folded; "continuous" applies when it is fully open or the device is not foldable. A change event fires on navigator.devicePosture whenever the posture transitions.

This API requires no permission. It is accessible synchronously via navigator.devicePosture.type from any script on the page — including MCP client-side code, third-party scripts, and MCP tools executing in the browser context. There is no way for the user to revoke or deny access to posture information, no indicator that posture is being read, and no rate limiting on the change event.

Device type fingerprinting from posture + screen geometry

A non-foldable device always reports navigator.devicePosture.type === "continuous". A device that ever reports "folded" is unambiguously a foldable. Combined with screen.width, screen.height, window.visualViewport, and the env(fold-width) CSS environment variable, the exact foldable model is identifiable with high precision:

// Device Posture fingerprinting — no permission required

function fingerPrintFoldable() {
  if (!navigator.devicePosture) return { isFoldable: false };

  const posture = navigator.devicePosture.type;
  const screenW = screen.width;
  const screenH = screen.height;
  const pixelRatio = window.devicePixelRatio;

  // Samsung Galaxy Z Fold 6 (unfolded): 1812×2176 logical, DPR 2.625
  // Samsung Galaxy Z Fold 6 (folded):    904×2176 logical
  // Samsung Galaxy Z Flip 6 (open):      1080×2640 logical
  // Samsung Galaxy Z Flip 6 (folded):    748×2640 logical
  // Microsoft Surface Duo 2 (unfolded):  1344×1892 logical, DPR 2.5
  // Motorola Razr+ (open):              1080×2640 logical

  const models = [
    { model: 'Galaxy Z Fold 6 (unfolded)', w: 1812, h: 2176, dpr: 2.625, posture: 'continuous' },
    { model: 'Galaxy Z Fold 6 (folded)',   w: 904,  h: 2176, dpr: 2.625, posture: 'folded' },
    { model: 'Galaxy Z Flip 6 (open)',     w: 1080, h: 2640, dpr: 3.0,   posture: 'continuous' },
    { model: 'Galaxy Z Flip 6 (folded)',   w: 748,  h: 2640, dpr: 3.0,   posture: 'folded' },
    { model: 'Surface Duo 2 (unfolded)',   w: 1344, h: 1892, dpr: 2.5,   posture: 'continuous' },
  ];

  for (const candidate of models) {
    if (Math.abs(screenW - candidate.w) < 10 &&
        Math.abs(screenH - candidate.h) < 10 &&
        Math.abs(pixelRatio - candidate.dpr) < 0.1 &&
        posture === candidate.posture) {
      return { isFoldable: true, model: candidate.model, posture };
    }
  }

  return {
    isFoldable: posture === 'folded' || (posture === 'continuous' && 'devicePosture' in navigator),
    posture,
    screenW, screenH, pixelRatio
  };
}

// This fingerprint persists across sessions and survives cookie/localStorage clearing
// because it reflects hardware characteristics, not stored state

Fold state transitions as a physical behavior oracle

The change event on navigator.devicePosture fires in real time when the user physically folds or unfolds their device. The timestamps and sequence of these transitions encode physical behavior: a user who unfolds their phone and opens an application is beginning a focused work session; a user who folds mid-session is transitioning (putting the device in a pocket, switching to a different mode, attending to something in the physical environment). The cadence of fold/unfold cycles over a longer session encodes usage patterns at the level of physical context switches.

// Fold transition behavioral tracking — fired in real time, no permission

const postureLog = [];

if (navigator.devicePosture) {
  // Capture initial state
  postureLog.push({
    state: navigator.devicePosture.type,
    timestamp: Date.now(),
    event: 'initial'
  });

  navigator.devicePosture.addEventListener('change', () => {
    postureLog.push({
      state: navigator.devicePosture.type,
      timestamp: Date.now(),
      event: 'transition'
    });

    // Observable patterns:
    // - User folds 30s after opening app: likely interrupted, context switch
    // - User unfolds after 45 minutes: returning from pocket, resuming session
    // - Rapid fold/unfold: checking notifications, testing the device
    // - Never folds during session: desktop/laptop equivalent usage context
  });
}

// Exfiltrate postureLog at session end or periodically
// The sequence reveals physical context switches correlated with application activity

Posture-conditioned UI manipulation

A malicious MCP tool can use posture state to conditionally render different UI elements depending on whether the device is folded or unfolded — displaying legitimate-looking UI when the device is flat and a surveillance dashboard is likely visible, but switching to a different configuration when the device is folded (and typically held in one hand, with a smaller display). This enables a class of screen-orientation-conditioned deception attacks where the UI the user sees depends on their physical device configuration.

More practically, MCP clients that adjust their UI layout for folded vs unfolded modes (a common responsive design pattern for foldable devices) should audit whether posture state influences security-relevant UI elements: consent dialogs, permission prompts, or tool result displays. A consent dialog rendered incorrectly in folded mode (buttons off-screen, text truncated, action buttons overlapping) can be exploited by a malicious tool that triggers consent requests only when the device is folded.

// VULNERABLE: security-relevant UI rendered differently based on posture
// without ensuring the folded layout is equally clear

navigator.devicePosture?.addEventListener('change', () => {
  if (navigator.devicePosture.type === 'folded') {
    // Folded mode — compressed layout
    // PROBLEM: if a consent dialog is currently shown, the folded layout
    // may push the "Deny" button off-screen, leaving only "Allow" visible
    applyFoldedLayout();
  } else {
    applyFullLayout();
  }
});

// CORRECT: security-relevant dialogs (permission grants, consent) are
// posture-independent — always render with both options fully visible
// Test consent UI in folded mode explicitly before shipping foldable support

SkillAudit findings for Device Posture API misuse