Atlas / MCP servers / conorluddy / xClaude iOS Development

xClaude iOS DevelopmentBLOCK

Name: xClaude iOS Development
Author: conorluddy

mcp/conorluddy/xclaude-ios-development

MCP server by conorluddy · agentic · agentic workflow · claude · Audited 2026-10-06

iOS development ClaudeCode plugin for mindful token and context usage. Contains modular MCPs that group various Xcode/IDB tools based on your current workflow.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

24 18r · 4w · 2d

Transport

stdio

License

MIT

Stars

182

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Note: This was built back when MCPs used to take up a bunch of context even when unused. The idea was that you could quickly toggle modular plugins on and off as you needed them. Since then MCP has evolved to use very little context when not in use - so I'm not maintaining this any more. You can use my xc-mcp or ios-simulator-skill repos instead to do the same thing.

/plugin marketplace add conorluddy/xclaude-plugin

Modular iOS development automation for Claude Code

Build, test, and automate iOS apps through natural conversation with Claude. 8 workflow-specific MCP servers with 24 tools across Xcode, Simulator, and IDB.

Enable only what you need. Each MCP is purpose-built for specific workflows, keeping your context window lean. Plus, our tools intelligently encapsulate Xcode output (errors, test results, build logs) so Claude processes structured JSON instead of raw 50+ line logs—saving significant tokens and enabling faster feedback loops.

Features

🎯 Modular Architecture

8 workflow-specific MCP servers (600-3500 tokens each)
Enable only what you need - Ultra-minimal to full-featured
23 shared tools across Xcode, Simulator, and IDB
Single source of truth - tools defined once, imported by MCPs

🔥 Surgical MCPs (Ultra-Focused)

xc-build (~600 tokens) - Build validation, errors, clean, list schemes
xc-launch (~400 tokens) - Simulator app lifecycle: install and launch
xc-interact (~900 tokens) - Pure UI interaction, no build

📦 Core Workflow MCPs

xc-ai-assist (~1400 tokens) - Build + UI automation + screenshots
xc-setup (~800 tokens) - Environment configuration and validation
xc-testing (~1200 tokens) - Test execution + UI flows
xc-meta (~700 tokens) - Project maintenance and housekeep

Read from source at commit a7f496a2a696OBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add xclaude-plugin -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "xclaude-plugin": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (24)

18 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`idb_check_quality`	read	Check accessibility data quality (use before deciding on screenshot)
`idb_describe`	read	Query UI accessibility tree
`idb_find_element`	read	Search UI elements by label or identifier (semantic search)
`idb_gesture`	read	Perform swipe gestures or hardware button presses
`idb_input`	read	Type text or press keys in simulator
`idb_tap`	read	Tap at UI coordinates
`simulator_boot`	read	Boot a simulator device
`simulator_create`	write	Create a new simulator device
`simulator_delete`	destructive	Delete a simulator device
`simulator_get_app_container`	read	Get app container filesystem path
`simulator_health_check`	read	Validate iOS development environment
`simulator_install_app`	write	Install app on simulator
`simulator_launch_app`	read	Launch app on simulator
`simulator_list`	read	List available iOS simulators
`simulator_openurl`	read	Open URL or deep link in simulator
`simulator_screenshot`	read	Capture simulator screenshot
`simulator_shutdown`	read	Shutdown a running simulator
`simulator_terminate_app`	destructive	Terminate a running app on simulator
`xcode_build`	read	Build Xcode project for iOS apps. Check project
`xcode_build_and_launch`	write	Build, install, and launch iOS app on simulator. Check project
`xcode_clean`	read	Clean Xcode build artifacts
`xcode_list`	read	List Xcode schemes and targets
`xcode_test`	write	Run Xcode test suite for iOS apps. Check project
`xcode_version`	read	Get Xcode version information

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (23)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

mcp-servers/xc-ai-assist/dist/index.js:16

atob( ... new Function(

Why it matters. decodes a payload and executes it

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

mcp-servers/xc-all/dist/index.js:16

atob( ... new Function(

Why it matters. decodes a payload and executes it

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

mcp-servers/xc-build/dist/index.js:16

atob( ... new Function(

Why it matters. decodes a payload and executes it

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

mcp-servers/xc-interact/dist/index.js:16

atob( ... new Function(

Why it matters. decodes a payload and executes it

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

mcp-servers/xc-launch/dist/index.js:16

atob( ... new Function(

Why it matters. decodes a payload and executes it

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

simulator_delete, simulator_terminate_app

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.mcp.json.example

.mcp.json.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.xcplugin.example

.xcplugin.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

mcp-servers/__tests__/tools/idb/check-quality.test.ts:6

import { idbCheckQuality } from "../../../shared/tools/idb/check-quality.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

mcp-servers/__tests__/tools/idb/check-quality.test.ts:7

import * as commandUtils from "../../../shared/utils/command.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

mcp-servers/__tests__/tools/idb/check-quality.test.ts:9

vi.mock("../../../shared/utils/command", async () => {

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

mcp-servers/__tests__/tools/idb/check-quality.test.ts:10

const actual = await vi.importActual("../../../shared/utils/command");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

mcp-servers/__tests__/tools/idb/describe.test.ts:6

import { idbDescribe } from "../../../shared/tools/idb/describe.js";

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

mcp-servers/package.json

@types/node, esbuild, typescript

Why it matters. 3 dependency range(s) float