by conorluddy
iOS development ClaudeCode plugin for mindful token and context usage. Contains modular MCPs that group various Xcode/IDB tools based on your current workflow.
# Add to your Claude Code skills
git clone https://github.com/conorluddy/xclaude-pluginGuides for using ai agents skills like xclaude-plugin.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@vitest/coverage-v8: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T15:54:50.135Z",
"npmAuditRan": true,
"pipAuditRan": true
}xclaude-plugin is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by conorluddy. iOS development ClaudeCode plugin for mindful token and context usage. Contains modular MCPs that group various Xcode/IDB tools based on your current workflow. It has 173 GitHub stars.
xclaude-plugin returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/conorluddy/xclaude-plugin" and add it to your Claude Code skills directory (see the Installation section above).
xclaude-plugin is primarily written in TypeScript. It is open-source under conorluddy on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh xclaude-plugin against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
/plugin marketplace add conorluddy/xclaude-plugin
Modular iOS development automation for Claude Code
Build, test, and automate iOS apps through natural conversation with Claude. 8 workflow-specific MCP servers with 24 tools across Xcode, Simulator, and IDB.
Enable only what you need. Each MCP is purpose-built for specific workflows, keeping your context window lean. Plus, our tools intelligently encapsulate Xcode output (errors, test results, build logs) so Claude processes structured JSON instead of raw 50+ line logsβsaving significant tokens and enabling faster feedback loops.
/plugin marketplace add conorluddy/xclaude-plugin
/plugin install xclaude-plugin
/plugin marketplace add /path/to/xclaude-plugin
/plugin install xclaude-plugin
Just installed? Enable xc-build and xc-launch for rapid development:
1. In Claude settings, enable "xc-build" and "xc-launch" MCPs
2. Ask Claude: "Build and run MyApp on iPhone 15"
3. Done! β¨
That's it. xc-build + xc-launch gives you a composable development loop: build with xc-build, then install & launch with xc-launch. Claude orchestrates the two-step workflow. If you need other workflows (testing, setup, UI automation), see Choosing the Right MCP below.
If you're upgrading from an earlier version, note these breaking changes:
xc-build-and-launch β xc-launchWhat changed:
xcode_build_and_launch monolithic tool (with skip_build flag), plus xcode_build, xcode_clean, xcode_list (moved to xc-build)simulator_install_app and simulator_launch_appWhy: The monolithic xcode_build_and_launch tool coupled build, install, and launch into a single operation. The new architecture separates build concerns (xc-build) from simulator lifecycle (xc-launch), enabling:
skip_build code smellAction required:
.mcp.json configuration:
- "xc-build-and-launch": {
- "command": "node",
- "args": ["${CLAUDE_PLUGIN_ROOT}/mcp-servers/xc-build-and-launch/dist/index.js"]
+ "xc-launch": {
+ "command": "node",
+ "args": ["${CLAUDE_PLUGIN_ROOT}/mcp-servers/xc-launch/dist/index.js"]
Previous versions:
v0.3.0: xc-run β xc-build-and-launchv0.3.0: xc-compile β xc-build, xc-hybrid β xc-allSee .mcp.json.example for the current configuration.
IMPORTANT: Enable ONE MCP at a time for optimal token efficiency. Choose based on your current workflow:
β xc-build # Build validation, errors, clean? (~600 tokens)
β xc-launch # Simulator lifecycle: install + launch? (~400 tokens)
β xc-interact # Testing UI with app already built? (~900 tokens)
β xc-ai-assist # AI-driven UI iteration? (~1400 tokens)
β xc-setup # First time setup? (~800 tokens)
β xc-testing # Running test suites? (~1200 tokens)
β xc-meta # Maintenance tasks? (~700 tokens)
β xc-all # Complex workflow needing everything? (~3500 tokens)
π‘ Tip: Enable xc-build + xc-launch together for development loop (~1000 tokens total)
Scenario 1: Build and fix errors
Enable: xc-build (~600 tokens)
"Build the project and show me the errors"
β Uses xcode_build with automatic error extraction
β Returns up to 10 errors for quick fixes
β 87% less tokens than old architecture!
Scenario 2: Rapid development - build and run
Enable: xc-build + xc-launch (~1000 tokens)
"Build and run MyApp on iPhone 15"
β Claude orchestrates: build (xc-build) β install & launch (xc-launch)
β Composable two-server workflow
β Better error recovery (retry individual steps)
β Perfect for iterative development
Scenario 3: Testing UI flows (app already built)
Enable: xc-interact (~900 tokens)
"Tap the Login button, then check if the profile screen appears"
β Queries accessibility tree (3-4x faster than screenshots)
β Taps elements by coordinates
β Validates UI state without rebuilding
Scenario 4: AI-driven UI iteration
Enable: xc-ai-assist (~1400 tokens)
"Update the button color to blue, rebuild, and show me a screenshot"
β Modifies code, builds, captures screenshot
β Complete workflow in one MCP
β Includes visual feedback (screenshots)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Shared Tool Library (24 tools) β
β ββ Xcode (6): build, build+run, clean, test, list, version β
β ββ Simulator (12): boot, install, screenshot, etc.β
β ββ IDB (6): describe, tap, input, gesture, etc. β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Tools imported by MCP servers β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β 8 Workflow-Specific MCP Servers β
β ββ xc-build: 3 tools (~600 tokens) β
β ββ xc-launch: 2 tools (~400 tokens) β
β ββ xc-interact: 6 tools (~900 tokens) β
β ββ xc-ai-assist: 7 tools (~1400 tokens) β
β ββ xc-setup: 5 tools (~800 tokens) β
β ββ xc-testing: 6 tools (~1200 tokens) β
β ββ xc-meta: 6 tools (~700 tokens) β
β ββ xc-all: 24 tools (~3500 tokens) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββ
For Users:
For Developers:
any usage)| MCP | Tools | Token Cost | Use When |
|---|---|---|---|
| xc-build | 3 | ~600 | Build validation with clean/scheme discovery |
| xc-launch | 2 | ~400 | Simulator lifecycle: install and launch app |
| xc-interact | 6 | ~900 | Testing UI flows with app already built |
| MCP | Tools | Token Cost | Use When |
|---|---|---|---|
| xc-ai-assist | 7 | ~1400 | AI UI iteration with visual feedback |
| xc-setup | 5 | ~800 | Initial setup, environment validation |
| xc-testing | 6 | ~1200 | Running test suites + UI automation |
| xc-meta | 6 | ~700 | Maintenance, housekeeping, environment checks |
| MCP | Tools | Token Cost | Use When |
|---|---|---|---|
| xc-all | 23 | ~3500 | Complex workflows needing everything |
Pro tip: Don't enable multiple MCPs simultaneously - tool duplication will increase token usage! Use xc-all instead for multi-workflow sessions.
Quick reference to find which MCP has the tools you need:
| Tool | xc-build | xc-launch | xc-interact | xc-ai-assist | xc-setup | xc-testing | xc-meta | xc-all | |------|:--------:|