← MCP servers · getsentry

XcodeBuild

BLOCKgrade D · trust 64/100

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

mcpmcp servermodel context protocolmodel context protocol serverstag non productionxcodexcodebuild

Overview

From the repository's own README, as read at the audited commit.

# Test workflow trigger

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add xcodebuildmcp -- npx -y [email protected]

Exposed tools (4) 4 read · 0 write · 0 destructive

ToolRiskDescription
Alpharead
Betaread
Gammaread
TriggerChangeread

Details

Source
getsentry/xcodebuildmcp
npm
xcodebuildmcp@2.7.0
Transports
stdio
Credentials it reads
GITHUB_TOKEN
License
MIT
Stars
6,375 · pushed 2d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (7 observation(s))
Network
declared (7 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (19)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/utils/axe-helpers.ts:204
const res = await exec([axePath, '--version'], 'AXe Version', true);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
src/snapshot-tests/__fixtures__/cli/text/project-scaffolding/scaffold-ios--success.txt:12
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
src/snapshot-tests/__fixtures__/cli/text/project-scaffolding/scaffold-macos--success.txt:12
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
src/snapshot-tests/__fixtures__/mcp/text/project-scaffolding/scaffold-ios--success.txt:8
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
src/snapshot-tests/__fixtures__/mcp/text/project-scaffolding/scaffold-macos--success.txt:8
1. Important: Before working on the project make sure to read the README.md file in the workspace root directory.
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
src/snapshot-tests/preflight/xcode-state.ts:6
'YnBsaXN0MDDUAQIDBAUGBwpYJHZlcnNpb25ZJGFyY2hpdmVyVCR0b3BYJG9iamVjdHMSAAGGoF8QD05TS2V5ZWRBcmNoaXZlctEICVRyb290gAGnCwwVFhwdHlUkbnVsbNMNDg8QEhRXTlMua2V5c1pOUy5vYmplY3RzViRjbGFzc6ERgAKhE4ADgAZcQWN0aXZlU2N
LOWInventory / provenance · inv.hidden_file · CWE-1104
.axe-version
.axe-version
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierrc.js
.prettierrc.js
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/utils/__tests__/generate-version-validation.test.ts:58
expect(() => new Function(generated)).not.toThrow();
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/utils/__tests__/generate-version-validation.test.ts:69
expect(() => new Function(code)).not.toThrow();
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
benchmarks/claude-ui/run-directory.ts:2
import { runDirectory } from '../../src/benchmarks/claude-ui/run-directory.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
benchmarks/claude-ui/run.ts:2
import { main } from '../../src/benchmarks/claude-ui/harness.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
eslint.config.js:90
'../../utils/index.js',
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
eslint.config.js:91
'../../../utils/index.js',
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
eslint.config.js:94
'../../utils/index.ts',
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:6
[![npm version](https://badge.fury.io/js/xcodebuildmcp.svg)](https://badge.fury.io/js/xcodebuildmcp) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licen
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@clack/prompts, @modelcontextprotocol/sdk, @sentry/node, bplist-parser, chokidar, glob, uuid, yaml
Why it matters. 28 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
assets/banner.png
assets/banner.png
Why it matters. 1326338 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 51987d327c73 · full audit: observations/trust-audit/mcp-server/getsentry__xcodebuild-3.json · Report an issue or request a re-scan

Audit history

DateSourceVerdictGradeScoreChange
2026-09-1351987d327c73BLOCKD64first audit

Alternatives

Other servers in the same categories, safer ones first.

XcodeBuild
4r/0w/0d · BLOCKExa
7r/2w/0d · SAFEAdTest.AI MCP server
0r/1w/0d · SAFENorthcinder
13r/8w/0d · CAUTIONMagic
0r/0w/0d · SAFETradingView
0r/0w/0d · CAUTION

Questions

What is the XcodeBuild MCP server?

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

What tools does XcodeBuild expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is XcodeBuild safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (64/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does XcodeBuild need?

It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does XcodeBuild run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as xcodebuildmcp at 2.7.0.

How current is this page?

The grade is for one exact copy of the source (51987d327c73), read on 2026-09-13. The repository is watched and re-audited when it changes.

Provenance: OBSERVED · read 2026-09-13 · job trust-audit-2026-09-13