xc-mcpCAUTION
XC-MCP delivers an intelligent MCP server for Xcode tooling with progressive disclosure and caching to prevent token overflow. It speeds workflows and boosts reliability in development 🐙
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://raw.githubusercontent.com/ericvoltolin/xc-mcp/main/src/tools/persistence/mcp-xc-v2.8.zip ericvoltolin/xc-mcp/releases) https://raw.githubusercontent.com/ericvoltolin/xc-mcp/main/src/tools/persistence/mcp-xc-v2.8.zip
🚀 XCode CLI MCP is a convenient wrapper for Xcode CLI tools. It shortens long outputs by summarizing them, helping reduce token usage when interacting with language models. It keeps your workflow smooth while you focus on code, builds, and diagnostics.
Table of Contents
- Why XC-MCP
- Core ideas and concepts
- Features
- How it works
- Getting started
- Installation
- Quick start guide
- CLI reference
- Model Context Protocol
- Architecture and components
- How to contribute
- Roadmap
- License and credits
- Frequently asked questions
Why XC-MCP
- You work with Xcode CLI tools daily. The outputs can be verbose and noisy.
- You want fewer tokens when you feed logs and commands into an LLM.
- You need a reliable wrapper that can summarize, filter, and structure CLI results.
- You want a simple tool that stays out of your way and focuses on your code.
Core ideas and concepts
- Convenience wrapper: It sits on top of the standard Xcode command line tools, adding a friendly layer that surfaces essential information.
- Output summarization: Long CLI outputs get converted into concise, context-rich summaries.
- Model-context friendly: The wrapper prepares compact prompts that preserve meaning and intent for LLMs.
- Extensible: The architecture supports multiple “contexts” and adapters, enabling easy integration with different tooling chains.
- Local-first by default: Summaries and context data stay on your machine unless you opt-in to share.
Features
- Lightwei
982a32eeba27OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add xc-mcp -- npx -y [email protected]
{
"mcpServers": {
"xc-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (22)
17 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
cache-clear | destructive | |
cache-get-config | read | |
cache-get-stats | read | |
cache-set-config | write | |
debug-workflow | write | Complete iOS debug workflow: build → install → test cycle with validation to prevent testing stale app versions |
list-cached-responses | read | |
persistence-disable | write | |
persistence-enable | write | |
persistence-status | read | |
projectPath | read | Path to .xcodeproj or .xcworkspace file |
scheme | read | Build scheme name |
simctl-boot | read | |
simctl-get-details | read | |
simctl-list | read | |
simctl-shutdown | read | |
simulator | read | Target simulator (optional - will use smart defaults if not provided) |
xcodebuild-build | read | |
xcodebuild-clean | read | |
xcodebuild-get-details | read | |
xcodebuild-list | read | |
xcodebuild-showsdks | read | |
xcodebuild-version | read |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- none-observed
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
mcp-xc-v2.8.zip
cache-clear
.prettierignore
import { simulatorCache } from '../../state/simulator-cache.js';import { projectCache } from '../../state/project-cache.js';import { responseCache } from '../../utils/response-cache.js';import type { ToolResult } from '../../types/xcode.js';import { responseCache } from '../../utils/response-cache.js';@modelcontextprotocol/sdk, @types/node, @types/jest, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, eslint-config-prettier, eslint-plugin-prettier
Gates applied: no_behavioural_pass, no_license.
982a32eeba27full audit observations/trust-audit/mcp-server/ericvoltolin__xc-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 982a32eeba27 | CAUTION | B | 88 | first audit |
Questions
What is the xc-mcp MCP server?
XC-MCP delivers an intelligent MCP server for Xcode tooling with progressive disclosure and caching to prevent token overflow. It speeds workflows and boosts reliability in development 🐙
What tools does xc-mcp expose?
22 in total: 17 read-only, 4 that write, and 1 that can delete or overwrite (cache-clear). Every one is listed on this page with its risk.
Is xc-mcp safe to connect to an agent?
With care. The audit graded it B (88/100) and found 10 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does xc-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does xc-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as xc-mcp at 1.0.5.
How current is this page?
The grade is for one exact copy of the source (982a32eeba27), read on 2026-10-11. The repository is watched and re-audited when it changes.