xcodebuildmcp

Security Findings (38)

• HighExcessive Permission Surface ×5

  • debug_continue:tool declares exec permission
  • debug_lldb_command:tool declares exec permission
  • sim_statusbar:tool declares network permission
  • swift_package_run:tool declares exec permission
  • swift_package_stop:tool declares exec permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• MediumExcessive Permission Surface ×29

  • debug_breakpoint_add:tool declares fs permission
  • debug_breakpoint_remove:tool declares fs permission
  • build_device:tool declares fs permission
  • clean:tool declares fs permission
  • discover_projs:tool declares fs permission
  • get_app_bundle_id:tool declares fs permission
  • install_app_device:tool declares fs permission
  • test_device:tool declares fs permission
  • test_device:tool declares env permission
  • build_macos:tool declares fs permission
  • build_run_macos:tool declares fs permission
  • get_mac_app_path:tool declares fs permission
  • get_mac_bundle_id:tool declares fs permission
  • launch_mac_app:tool declares fs permission
  • test_macos:tool declares fs permission
  • test_macos:tool declares env permission
  • scaffold_ios_project:tool declares fs permission
  • scaffold_macos_project:tool declares fs permission
  • session-set-defaults:tool declares fs permission
  • build_run_sim:tool declares fs permission
  • build_sim:tool declares fs permission
  • install_app_sim:tool declares fs permission
  • record_sim_video:tool declares fs permission
  • test_sim:tool declares fs permission
  • test_sim:tool declares env permission
  • swift_package_build:tool declares fs permission
  • swift_package_clean:tool declares fs permission
  • swift_package_run:tool declares fs permission
  • swift_package_test:tool declares fs permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• LowDoS Resilience — Missing Rate Limit / Timeout ×3

  • debug_continue:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • sim_statusbar:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • swift_package_stop:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  Rule: AS-011Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.
• LowExcessive Permission Surface

  scaffold_ios_project:input schema exposes 11 properties (threshold: 10)

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.