High-risk tools in XcodeBazelMCP
70 of the 125 tools in XcodeBazelMCP are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
bazel_daemon_startExecuteStart or ensure the per-workspace background daemon is running. The daemon exposes a coordination socket and tracks background-operation metadata for the workspace. Note: captur...
-
bazel_daemon_stopExecuteStop the per-workspace background daemon and clear its tracked operation metadata.
-
bazel_ios_agent_debug_reproExecuteOne-shot Cursor debug repro: clear host log → build_and_run with AGENT_DEBUG_* launchEnv → optional log capture.
-
bazel_ios_boot_simulatorExecuteBoot an iOS simulator device.
-
bazel_ios_buildExecuteBuild a Bazel target with iOS-oriented defaults for simulator/device builds.
-
bazel_ios_build_and_runExecuteBuild a Bazel iOS app, install it on a simulator or physical device, and launch it. One-shot build-run cycle. Default platform is simulator; pass platform=device for physical de...
-
bazel_ios_device_build_and_runExecuteBuild a Bazel iOS app for device (arm64), install it on a connected device, and launch it.
-
bazel_ios_device_install_appExecuteInstall a previously built .app bundle onto a connected physical iOS device.
-
bazel_ios_device_launch_appExecuteLaunch an installed app on a connected physical iOS device by bundle identifier.
-
bazel_ios_device_log_startExecuteStart capturing logs from a connected physical iOS device. Tries pymobiledevice3 first (iOS 17+ via CoreDevice tunnel), falls back to idevicesyslog for older devices.
-
bazel_ios_device_log_stopExecuteStop an active device log capture and return captured output.
-
bazel_ios_device_pairExecutePair with a physical iOS device for development.
-
bazel_ios_device_stop_appExecuteTerminate a running app on a connected physical iOS device by bundle identifier.
-
bazel_ios_device_testExecuteRun Bazel iOS tests on a connected physical device. Builds with arm64 and runs via
-
bazel_ios_discover_targetsExecuteDiscover Bazel iOS app, unit/UI test, and build-test targets using bazel query.
-
bazel_ios_double_tapExecuteSimulate a double-tap at screen coordinates on the simulator.
-
bazel_ios_dragExecuteSimulate a drag gesture from one point to another on the simulator.
-
bazel_ios_install_appExecuteInstall a previously built .app bundle onto an iOS simulator.
-
bazel_ios_key_pressExecuteSend a key press event to the simulator (e.g. Return, Escape, Tab, Space, Delete, arrows, Home).
-
bazel_ios_launch_appExecuteLaunch an installed app on an iOS simulator by bundle identifier.
-
bazel_ios_lldb_attachExecuteAttach LLDB debugger to a running process by PID or process name. Returns a session ID for subsequent debug commands.
-
bazel_ios_lldb_breakpointExecuteSet a breakpoint by file+line, symbol name, or delete/list breakpoints.
-
bazel_ios_lldb_commandExecuteRun an arbitrary LLDB command. Use for advanced debugging not covered by other tools.
-
bazel_ios_lldb_detachExecuteDetach LLDB from a process and end the debug session.
-
bazel_ios_lldb_expressionExecuteEvaluate an expression in the current frame context (e.g. print a variable, call a method).
-
bazel_ios_lldb_stepExecuteStep through code: over (next line), into (enter function), or out (finish function).
-
bazel_ios_lldb_threadsExecuteList all threads or select a specific thread/frame for inspection.
-
bazel_ios_lldb_variablesExecuteInspect local variables, arguments, or all frame variables at the current stop point.
-
bazel_ios_log_capture_startExecuteStart capturing device logs from a booted simulator. Returns a capture ID.
-
bazel_ios_log_capture_stopExecuteStop a running log capture and return captured logs.
-
bazel_ios_long_pressExecuteSimulate a long press at screen coordinates on the simulator.
-
bazel_ios_open_simulatorExecuteOpen Simulator.app and optionally bring a specific device to the foreground.
-
bazel_ios_open_urlExecuteOpen a URL on a booted simulator (deep links, universal links, web URLs).
-
bazel_ios_pinchExecuteSimulate a pinch (zoom) gesture on the simulator. Requires idb for true multi-touch; without idb the CGEvent fallback only approximates with a tap.
-
bazel_ios_privacyExecuteGrant, revoke, or reset privacy permissions for an app on a simulator.
-
bazel_ios_push_notificationExecuteSend a simulated push notification to an app on a booted simulator.
-
bazel_ios_set_simulator_appearanceExecuteSet the simulator UI appearance to light or dark mode.
-
bazel_ios_set_simulator_locationExecuteSet the simulated GPS location on a booted simulator.
-
bazel_ios_set_status_barExecuteOverride the simulator status bar (time, battery, network, etc.). Useful for consistent screenshots.
-
bazel_ios_shutdown_simulatorExecuteShutdown a running iOS simulator.
-
bazel_ios_stop_appExecuteTerminate a running app on a booted simulator by bundle identifier.
-
bazel_ios_swipeExecuteSimulate a swipe gesture on the simulator.
-
bazel_ios_tapExecuteSimulate a tap at screen coordinates on the simulator.
-
bazel_ios_testExecuteRun a Bazel iOS test target with simulator and test-output defaults.
-
bazel_ios_test_coverageExecuteRun a Bazel iOS test target and collect code coverage data (lcov format).
-
bazel_ios_type_textExecuteType text into the focused field on the simulator.
-
bazel_ios_video_record_startExecuteStart recording video from a booted simulator. Returns a recording ID to stop later.
-
bazel_ios_video_record_stopExecuteStop an active video recording and finalize the file.
-
bazel_macos_buildExecuteBuild a Bazel macOS target (macos_application, macos_bundle, macos_command_line_application, etc.).
-
bazel_macos_cleanExecuteClean Bazel macOS build outputs. Equivalent to bazel_ios_clean but scoped for macOS context.
-
bazel_macos_coverageExecuteRun Bazel macOS test with coverage collection and lcov output.
-
bazel_macos_launchExecuteLaunch a previously built macOS application by its bundle path or target label.
-
bazel_macos_runExecuteBuild and launch a Bazel macOS application locally via
-
bazel_macos_stopExecuteTerminate a running macOS application by bundle ID or process name.
-
bazel_macos_testExecuteRun a Bazel macOS unit test target (macos_unit_test).
-
bazel_tvos_buildExecuteBuild a Bazel tvOS target (tvos_application, tvos_extension, etc.).
-
bazel_tvos_runExecuteBuild and launch a Bazel tvOS application via
-
bazel_tvos_testExecuteRun a Bazel tvOS unit test target (tvos_unit_test).
-
bazel_upgradeExecuteUpgrade XcodeBazelMCP to the latest version. Auto-detects install method (npm, Homebrew, source).
-
bazel_visionos_buildExecuteBuild a Bazel visionOS target (visionos_application, etc.).
-
bazel_visionos_runExecuteBuild and launch a Bazel visionOS application via
-
bazel_visionos_testExecuteRun a Bazel visionOS unit test target (visionos_unit_test).
-
bazel_watchos_buildExecuteBuild a Bazel watchOS target (watchos_application, watchos_extension, etc.).
-
bazel_watchos_runExecuteBuild and launch a Bazel watchOS application via
-
bazel_watchos_testExecuteRun a Bazel watchOS unit test target (watchos_unit_test).
-
bazel_xcode_open_device_hubExecuteOpen DeviceHub.app — the GUI device manager bundled with Xcode-beta / Xcode 27 — to inspect, pair, and interact with physical devices. Falls back with guidance when no DeviceHub...
-
swift_package_buildExecuteBuild a Swift package using
-
swift_package_resolveExecuteResolve and fetch Swift package dependencies (
-
swift_package_runExecuteBuild and run an executable target in a Swift package using
-
swift_package_testExecuteRun tests in a Swift package using
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.