Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

XcodeBuild MCP server

by cameroncooke/xcodebuildmcpMIT licenceAudited 21 Sep 2026 · source 51987d327c73

npm xcodebuildmcp 2.7.0stdio★ 6,408
✕BLOCKGrade D · 64/100 · 21 Sep 2026 · 51987d3
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (64/100). It exposes 4 tools: 4 read, 0 write and 0 destructive. The audit recorded 19 findings (0 critical, 5 high, 1 medium, 12 low). Maintainer's description: A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “XcodeBuild MCP server (cameroncooke/xcodebuildmcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/cameroncooke/xcodebuild-2

Why this is BLOCK. The audit found 0 critical and 5 high findings; the most severe is Code injection at src/utils/axe-helpers.ts:204. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called XcodeBuild. You are viewing cameroncooke/xcodebuildmcp. Compare all 2 →

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score64/100✕BLOCK D
0 critical5 high1 medium12 low1 info

19 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared7 observations
  • NetworkDeclared7 observations
  • ShellDeclared6 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (19)

Sorted by severity

HIGHCode injectioncode.eval_exec · src/utils/axe-helpers.ts:204
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const res = await exec([axePath, '--version'], 'AXe Version', true);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.tool_poisoning · src/snapshot-tests/__fixtures__/cli/text/project-scaffolding/scaffold-ios--success.txt:12
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
HIGHPrompt injectionprompt.tool_poisoning · src/snapshot-tests/__fixtures__/cli/text/project-scaffolding/scaffold-macos--success.txt:12
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
HIGHPrompt injectionprompt.tool_poisoning · src/snapshot-tests/__fixtures__/mcp/text/project-scaffolding/scaffold-ios--success.txt:8
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
HIGHPrompt injectionprompt.tool_poisoning · src/snapshot-tests/__fixtures__/mcp/text/project-scaffolding/scaffold-macos--success.txt:8
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
MEDIUMObfuscation / stealthobf.base64_blob · src/snapshot-tests/preflight/xcode-state.ts:6
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
'YnBsaXN0MDDUAQIDBAUGBwpYJHZlcnNpb25ZJGFyY2hpdmVyVCR0b3BYJG9iamVjdHMSAAGGoF8QD05TS2V5ZWRBcmNoaXZlctEICVRyb290gAGnCwwVFhwdHlUkbnVsbNMNDg8QEhRXTlMua2V5c1pOUy5vYmplY3RzViRjbGFzc6ERgAKhE4ADgAZcQWN0aXZlU2N
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .axe-version
F-13 Inventory / provenanceCWE-1104Layer L0
.axe-version
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .prettierignore
F-13 Inventory / provenanceCWE-1104Layer L0
.prettierignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .prettierrc.js
F-13 Inventory / provenanceCWE-1104Layer L0
.prettierrc.js
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.eval_exec · src/utils/__tests__/generate-version-validation.test.ts:58
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
expect(() => new Function(generated)).not.toThrow();
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · src/utils/__tests__/generate-version-validation.test.ts:69
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
expect(() => new Function(code)).not.toThrow();
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · benchmarks/claude-ui/run-directory.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { runDirectory } from '../../src/benchmarks/claude-ui/run-directory.ts';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · benchmarks/claude-ui/run.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { main } from '../../src/benchmarks/claude-ui/harness.ts';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.js:90
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../utils/index.js',
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.js:91
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../../utils/index.js',
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.js:94
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../utils/index.ts',
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · README.md:6
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
[![npm version](https://badge.fury.io/js/xcodebuildmcp.svg)](https://badge.fury.io/js/xcodebuildmcp) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licen
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@clack/prompts, @modelcontextprotocol/sdk, @sentry/node, bplist-parser, chokidar, glob, uuid, yaml
Why
28 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOInventory / provenanceinv.oversize · assets/banner.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/banner.png
Why
1326338 bytes not read
Fix
—

Tools it exposes

4 declared in source · 0 destructive

4 read0 write0 destructive
ToolWhat it doesRisk
AlphaNo description in the sourceread
BetaNo description in the sourceread
GammaNo description in the sourceread
TriggerChangeNo description in the sourceread

Safer alternatives

All mobile development servers →
Apple Doc✓SAFE

mightydillah/apple-doc-mcp

MCP server providing seamless access to Apple Developer Documentation with smart search and wildcard support

6 readGrade B
Ai✓SAFE

fluttersdk/ai

Teach your AI assistant Wind UI, Magic Framework and more, across every major coding tool. Skills, a Claude Code marketplace and a hosted MCP server.

2 readGrade B
DroidMind✓SAFE

hyperb1iss/droidmind

Control your Android devices with AI using Model Context Protocol

8 readGrade B

Audit history

  1. ✕BLOCK D 64 / 100

    Source changed, verdict held · 51987d327c73

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about XcodeBuild MCP server

What is the XcodeBuild MCP server?
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
What tools does XcodeBuild expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is XcodeBuild safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (64/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does XcodeBuild need?
It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does XcodeBuild run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as xcodebuildmcp at 2.7.0.
How current is this page?
The grade is for one exact copy of the source (51987d327c73), read on 2026-09-21. The repository is watched and re-audited when it changes.
Which XcodeBuild MCP server is the right one?
2 unrelated servers share the name “XcodeBuild”; compare them side by side before you install.
I already installed XcodeBuild. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • cameroncooke/xcodebuildmcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 51987d327c73Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.