Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/debugswift/xcodebazelmcp/device-and-uinpx skills add DebugSwift/XcodeBazelMCP --skill device-and-uigit clone --depth 1 https://github.com/DebugSwift/XcodeBazelMCPWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.01933 |
| Opus 5 | $0.00023 | $0.00966 |
| Sonnet 5 | $0.00009 | $0.00387 |
| Haiku 4.5 | $0.00005 | $0.00193 |
Grade B, and why
device-and-ui scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
2. **Screenshot & log tools depend on `libimobiledevice` or `pymobiledevice3`**, which cannot access the CoreDevice tunnel without `sudo pymobiledevice3 remote tunneld` running in a separate terminal. How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Device & UI Automation
Physical Device Commands (via xcrun devicectl)
All physical-device interactions use Apple's CoreDevice framework through xcrun devicectl. This is the only reliable CLI for iOS 17+ / macOS 15+ (Sonoma/Tahoe) devices.
Tool Summary
| Tool | Core function | Status |
|---|---|---|
bazel_ios_list_devices |
listDevices() → devicectl list devices |
✅ Stable |
bazel_ios_device_info |
deviceInfo() → devicectl device info details |
✅ Stable |
bazel_ios_device_build_and_run |
Build + install + launch chain | ✅ Stable |
bazel_ios_device_install_app |
installAppOnDevice() → devicectl device install app |
✅ Stable |
bazel_ios_device_launch_app |
launchAppOnDevice() → devicectl device process launch |
✅ Stable |
bazel_ios_device_stop_app |
terminateAppOnDevice() → lookup PID via apps+procs, then devicectl device process terminate --pid |
✅ Stable |
bazel_ios_device_screenshot |
screenshotDevice() → pymobiledevice3 > idevicescreenshot -n > idevicescreenshot |
⚠️ See connectivity notes |
bazel_ios_device_log_start/stop |
startDeviceLogCapture() → pymobiledevice3 > idevicesyslog |
⚠️ See connectivity notes |
bazel_ios_device_test |
bazel test with --test_arg=--destination id=<UDID> |
✅ Stable |
bazel_ios_device_pair/unpair |
devicectl manage pair/unpair |
✅ Stable |
bazel_ios_device_list_pairs |
devicectl list devices |
✅ Stable |
Device Connectivity & iOS 17+ Limitations
Starting with iOS 17 and macOS 15 (Sonoma), Apple replaced the legacy lockdownd/usbmuxd protocol with CoreDevice (remoted). This affects third-party tools:
| Transport | devicectl |
idevicescreenshot |
idevicesyslog |
pymobiledevice3 |
|---|---|---|---|---|
| USB cable | ✅ | ❌ Invalid service (iOS 17+) | ❌ Cannot connect | ❌ needs tunneld |
| Wi-Fi/Network | ✅ | ❌ Device not found | ❌ Device not found | ❌ needs tunneld |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 129 lines · 47 tokens per session scan B bcd1ce3e8559
device-and-ui is a skill published in the GitHub repository DebugSwift/XcodeBazelMCP (7 stars, last pushed 1mo ago), licensed MIT. It adds 47 tokens to every session and 1,933 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
benchmark
Run performance + quality benchmarks. ASR reports WER, RTF, process memory, and throughput across engines/variants. Arguments include asr, tts, vad, diarize, asr-quick.
review-pr
Review a pull request for conceptual fit, architecture impact, adversarial failure modes, security risk, docs impact, regression risk, test coverage, and merge readiness. Use when asked to review a PR, check whether a PR is safe to merge, decide if more tests are needed, perform adversarial or security review, or…
test
Run tests. Use after code changes to validate. Arguments: unit (default, no GPU), e2e (with models), filter name, or all.
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
boutique-store
Create and use Boutique Store for Swift data persistence, including initialization, @Stored controllers, CRUD operations, operation chaining, and granular event monitoring. Use when persisting arrays of items, building data controllers, or working with Boutique's Store type.
boutique-stored-values
Persist individual values with Boutique's @StoredValue (UserDefaults) and @SecurelyStoredValue (Keychain), including set, reset, toggle, bindings, keypath setters, array and dictionary helpers, and async observation. Use when storing preferences, settings, feature flags, or sensitive data like auth tokens.