ios-simulator-mcp
v1.5.2MCP server for interacting with the iOS simulator
36
Total
3
Critical
22
High
11
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
38: */
39: function getIdbPath() {
>>> 40: const customPath = process.env.IOS_SIMULATOR_MCP_IDB_PATH;
41: if (customPath) {
42: // Expand tilde if presentReport false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
462: // Determine the default directory from env var or fallback to ~/Downloads
463: let defaultDir = path_1.default.join(os_1.default.homedir(), "Downloads");
>>> 464: const customDefaultDir = process.env.IOS_SIMULATOR_MCP_DEFAULT_OUTPUT_DIR;
465: if (customDefaultDir) {
466: // also expand tilde for the custom directory pathReport false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
62: }
63: // Read filtered tools from environment variable
>>> 64: const FILTERED_TOOLS = process.env.IOS_SIMULATOR_MCP_FILTERED_TOOLS?.split(",").map((tool) => tool.trim()) || [];
65: // Function to check if a tool is filtered
66: function isToolFiltered(toolName) {Report false positiveDecoded base64 content: J�b�'���ӭ�즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: {"command":"npx","args":["-y","ios-simulator-mcp"]}
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r�����������
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r����{���q�?
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��ݡ�?�{-jYZ�*'
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveNode.js child process spawning
Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.
7: const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
8: const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
>>> 9: const child_process_1 = require("child_process");
10: const util_1 = require("util");
11: const zod_1 = require("zod");Report false positiveNode.js child process spawning
Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.
13: const os_1 = __importDefault(require("os"));
14: const fs_1 = __importDefault(require("fs"));
>>> 15: const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
16: /**
17: * Strict UDID/UUID pattern: 8-4-4-4-12 hexadecimal characters (e.g. 37A360EC-75F9-4AEC-8EFA-10F4A58D8CCA)Report false positiveNode.js child process spawning
Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.
572: const outputFile = ensureAbsolutePath(output_path ?? defaultFileName);
573: // Start the recording process
>>> 574: const recordingProcess = (0, child_process_1.spawn)("xcrun", [
575: "simctl",
576: "io",Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: z��h��:蹹^�(�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (5.0 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.9 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.9 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (5.0 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positivePossible Base64-encoded payload (long encoded string)
Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.
1: # iOS Simulator MCP Server
2:
>>> 3: [](https://cursor.com/install-mcp?name=ios-simulator&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImlvcy1zaW11bGF0b3ItbWNwIl19) [](https://www.npmjs.com/package/ios-simulator-mcp)
4:
5: A Model Context Protocol (MCP) server for interacting with iOS simulators. This server allows you to interact with iOS simulators by getting information about them, controlling UI interactions, and inspecting UI elements.Report false positiveScan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 25, 2026 | critical | 36 | 5 | 0.00s |
| Feb 24, 2026 | critical | 36 | 5 | 0.00s |