xc-mcp

The server executes external `xcrun simctl` and `idb` commands via `child_process.exec` and `child_process.spawn`. While comprehensive input validation and shell escaping (`isSafePath`, `isValidBundleId`, `isValidUdid`) are implemented to mitigate command injection, the inherent nature of wrapping powerful command-line tools poses a risk if these mitigations were bypassed or found to be incomplete. The server uses `StdioServerTransport`, limiting external network attack surface, and persistence is to local, user-controlled directories, reducing broader system compromise risk. No hardcoded secrets or 'eval' statements were found.