xcodebuildmcp
PassAudited by ClawScan on May 1, 2026.
Overview
This is a coherent instruction-only Xcode workflow skill, but it relies on powerful external MCP tools that can control simulators/devices and should be installed from a trusted source.
This skill appears benign and aligned with Xcode automation. Before using it, verify the external XcodeBuildMCP package you install, prefer a pinned trusted version, and be careful with workflows that install apps on devices, automate UI, collect logs/screenshots, or run LLDB commands.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used carelessly, the agent could change simulator or device state, run apps, capture diagnostics, or execute debugger actions as part of a user-requested development workflow.
The skill documents tools that can install and launch apps on devices and issue raw debugger commands. This is expected for Xcode debugging, but it is high-impact local/device control.
- Install: `mcp__xcodebuildmcp__install_app_device` ... - Run LLDB command: `mcp__xcodebuildmcp__debug_lldb_command`
Use this skill only with projects and devices you intend to automate, and review requests involving device installs, UI automation, cleanup, or LLDB commands before allowing them.
Installing via `latest` means the actual MCP server behavior depends on the current external package version, not only on this instruction-only skill.
The setup guidance uses an external npm package at the moving `latest` version. This is a user-directed setup step and is purpose-aligned, but the MCP server code is not included in these artifacts and can change over time.
"args": ["-y", "xcodebuildmcp@latest"]
Install XcodeBuildMCP from a trusted source, consider pinning a known version, and review the MCP server package before granting it access to local Xcode workflows.