Release v2.5.2

Release v2.5.2

Changed

• Updated the bundled AXe binary used by UI automation tools to 1.7.0.

Fixed

• Fixed a log-capture vulnerability where a crafted bundleId or custom subsystem filter could broaden simulator log streams to capture output from other apps or Apple system subsystems. Bundle IDs and subsystem filters are now validated against a strict allowlist before reaching the predicate (#407 by @sebastiondev).
• Fixed debug_attach_sim so an explicit pid overrides an inherited bundleId session default before mutual-exclusion validation (#410).

Option A — Homebrew (no Node.js required)

Install:

brew tap getsentry/xcodebuildmcp
brew install xcodebuildmcp

MCP config:

"XcodeBuildMCP": {
  "command": "xcodebuildmcp",
  "args": ["mcp"]
}

Option B — npm / npx (Node.js 18+)

Install:

npm install -g xcodebuildmcp@latest

MCP config:

"XcodeBuildMCP": {
  "command": "npx",
  "args": ["-y", "xcodebuildmcp@latest", "mcp"]
}

📦 NPM Package: https://www.npmjs.com/package/xcodebuildmcp/v/2.5.2