
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
ios-mcp-server
Advanced tools
MCP server for iOS Simulator control with native touch injection and UI tree reading
MCP server for controlling iOS Simulators. Gives AI assistants the ability to see, interact with, and debug iOS apps — taking screenshots, tapping elements, reading the UI tree, and automating testing workflows.
Built with native touch injection and native UI tree reading for accurate, reliable automation that doesn't interfere with your machine.
npm Package | GitHub | Issues
Most iOS Simulator MCP servers work by sending mouse clicks to the Simulator window through macOS, then reading the Simulator's window frame through the macOS Accessibility API. This means:
This server takes a different approach:
tap_and_wait combines tap + settle + UI tree in one round tripxcode-select --install)That's it. No Accessibility permissions, no special configuration.
claude mcp add --scope user ios -- npx -y ios-mcp-server
This registers the server globally so it's available in all projects. Use --scope project instead to limit it to the current project.
Add to your Claude Desktop config file (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"ios": {
"command": "npx",
"args": ["-y", "ios-mcp-server"]
}
}
}
Add to your VS Code settings (.vscode/settings.json):
{
"mcp": {
"servers": {
"ios": {
"command": "npx",
"args": ["-y", "ios-mcp-server"]
}
}
}
}
Add to your Cursor MCP config (~/.cursor/mcp.json):
{
"mcpServers": {
"ios": {
"command": "npx",
"args": ["-y", "ios-mcp-server"]
}
}
}
Add to your Windsurf MCP config (~/.codeium/windsurf/mcp_config.json):
{
"mcpServers": {
"ios": {
"command": "npx",
"args": ["-y", "ios-mcp-server"]
}
}
}
Add to your project's .mcp.json (checked into version control so your team gets it too):
{
"mcpServers": {
"ios": {
"command": "npx",
"args": ["-y", "ios-mcp-server"]
}
}
}
git clone https://github.com/martingeidobler/ios-mcp-server.git
cd ios-mcp-server
npm install
npm run build
claude mcp add --scope user ios -- node /path/to/ios-mcp-server/dist/index.js
| Tool | Description |
|---|---|
list_devices | List available iOS Simulators and their state |
list_simulators | List available simulator device types (iPhone, iPad models) |
boot_simulator | Boot a simulator by name or UDID (waits up to 60s) |
| Tool | Description |
|---|---|
screenshot | Take screenshot for visual analysis. Optional save_path to save to disk |
get_ui_tree | Get UI element hierarchy with bounds, labels, identifiers, and state |
| Tool | Description |
|---|---|
tap | Tap at screen coordinates (device points) |
tap_element | Tap element by identifier, label, or value |
tap_and_wait | Tap element, wait for UI to settle, return new UI tree — single round trip |
long_press | Long press at coordinates (context menus, drag handles) |
double_tap | Double tap at coordinates (zoom in, double-tap interactions) |
multi_tap | Tap N times at coordinates with configurable interval |
tap_sequence | Execute a sequence of steps: tap, long press, swipe, type, key press, and pause |
type_text | Type text into focused input |
press_key | Press key (home, lock, enter, tab, delete, arrows, volume, shake, rotate) |
swipe | Swipe gesture between coordinates |
scroll_to_element | Scroll until element is visible |
wait_for_element | Wait for element to appear (with timeout) |
| Tool | Description |
|---|---|
launch_app | Launch app by bundle ID |
terminate_app | Terminate a running app |
install_app | Install .app bundle |
uninstall_app | Uninstall app by bundle ID |
get_current_app | Get foreground app info |
simctl_run | Run a command inside the Simulator |
| Tool | Description |
|---|---|
get_logs | Get log output, filterable by bundle ID, log level, and time |
clear_logs | Set log baseline (call before reproducing a bug for clean output) |
get_device_info | Get name, model, iOS version, screen size |
pull_file | Pull a file from an app's container |
| Tool | Description |
|---|---|
open_url | Open a URL or deep link in the Simulator |
send_push | Send a push notification to an app |
set_permission | Grant, revoke, or reset app permissions |
set_status_bar | Override status bar display (time, battery, signal) |
"Clear the logs, launch com.example.app, navigate to the settings screen, tap Save, then show me the logs and a screenshot"
Claude will: clear_logs → launch_app → tap_element → get_logs(bundle_id="com.example.app", level="error") → screenshot(save_path="./bugs/settings-crash.png")
"Navigate through the login flow and verify each screen matches the designs"
Claude will use screenshot + get_ui_tree to see and understand each screen, tap_element/type_text to interact, and its vision capabilities to compare against mockups or descriptions.
"Install the app, launch it, and tap through the main screens to check nothing crashes"
Claude will: install_app → launch_app → navigate with tap_element → get_logs(level="error") to check for errors after each screen.
"Open the deep link myapp://profile/123 and verify the profile screen loads"
Claude will: open_url(url="myapp://profile/123") → get_ui_tree to verify the profile screen elements → screenshot for visual confirmation.
"Send a push notification to the app and verify the notification appears"
Claude will: send_push(bundle_id="com.example.app", title="Hello", body="Test notification") → screenshot to see the notification.
The server communicates over stdio using the Model Context Protocol. Under the hood it uses three mechanisms:
xcrun simctl — device management, app lifecycle, screenshots, logs, and simulator commandssimtouch binary — compiled from Objective-C on first use, sends touch events directly to the Simulator's HID system via IndigoHID/CoreSimulator private frameworks. No mouse involvement.simtree binary — compiled from Objective-C on first use, reads the iOS app's accessibility tree via AXPTranslation/CoreSimulator. Returns real iOS element data, not macOS Simulator window chrome.Both native binaries are compiled automatically on first use and cached. The source files (native/simtouch.m, native/simtree.m) ship with the package; only Xcode command line tools are needed.
MCP Client (Claude Code, Desktop, VS Code, etc.)
↕ stdio (MCP protocol)
iOS MCP Server (Node.js)
↕ ↕ ↕
xcrun simctl simtouch simtree
↕ ↕ ↕
iOS Simulator IndigoHID AXPTranslation
(CoreSimulator) (CoreSimulator)
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
MIT - see LICENSE.
FAQs
MCP server for iOS Simulator control with native touch injection and UI tree reading
We found that ios-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.