Drive the iOS Simulator via semantic accessibility-tree snapshots. Sub-200ms, no WebDriverAgent.
Copy the AI prompt to install this server into Claude Code, Cursor, or another agent β or use 1-click editor setup below.
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag β we're steadily working through the catalog.
π‘ Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Inspect callable tools, capabilities, and parameters exposed to AI agents by Ios Sim MCP.
list_simulatorsList simulators with UDID, state, OS version
use_simulatorPick a specific UDID (auto-selected if only one is booted)
snapshotCapture the AX tree, assign refs `e1..eN`, return compact text rendering. Filters: `interactive` (default), `actionable`, `all
findSearch the snapshot by `id` (AXUniqueId), `label`, `labelContains`, `role`, `actionable
tapTap by `{ref}`, `{id}`, or `{x,y}`. Optional `duration` makes it a long-press
type_textType into the focused field. Optional `{ref}` or `{id}` taps-then-types. Auto-routes through paste when the dylib is loaded for byte-perfect input β no iOS autocorrect, no first-letter capitalization. `via: "keystroke"` forces the typing path; `via: "paste"` forces the paste path
An MCP server that drives the iOS Simulator the way Chrome's DevTools MCP drives a browser: semantic accessibility-tree snapshots with stable element refs, sub-200ms operations, and no screenshot-and-eyeball-coordinates loops.
Built because every existing iOS-simulator automation tool either crawls (Appium, screenshot-based agents) or requires pre-written scripts. This one lets an LLM drive a simulator interactively β find an element by label or ID, tap it by ref, wait for the UI to settle, repeat β at roughly the speed a human would.
Most existing iOS-sim MCPs work by taking a screenshot, asking the model to identify coordinates, then tapping pixels. That's slow (image bytes in context), expensive (vision tokens), and fragile (any layout shift breaks it).
iOS apps already expose a structured accessibility tree β the same one VoiceOver uses. If you query that tree, you get every interactive element with its label, role, AX identifier, frame, and enabled state. You can find what you want semantically, refer to it by a stable ref, and act on it directly. That's what Chrome MCP does for the DOM, and it's what this does for UIView hierarchies in the iOS Simulator.
Three layers, two shipping today:
| Layer | Status | Tech | What it gives you |
|---|---|---|---|
| 1 β AX tree + actions | β shipping | idb (Facebook's CoreSimulator bridge) | snapshot, find, tap, type, swipe, scroll, launch, screenshot β all ~100ms |
| 2a β Dylib proof-of-life | β shipping | DYLD_INSERT_LIBRARIES via SIMCTL_CHILD_* | constructor runs in the target app before main(); logs lifecycle via os_log |
| 2b β In-process RPC | β shipping | Unix socket + JSON-Lines | round-trip into a running app at ~1ms per call |
| 2c β View introspection | β shipping | Main-thread UIView walk | view_tree, view_hit_test β class hierarchy, frames, responder chains, VC annotations |
| 2d β Network interception | β shipping | URLProtocol + URLSessionConfiguration swizzle | capture every HTTP request/response (headers, bodies, timing) inside the app β no cert install, no mitmproxy |
| 2e β JS eval | β shipping | JSContext + JSExport bridges | eval_js({code}) with app / key_window() / defaults / pasteboard / bundle / process / view-finder helpers β Chrome's Runtime.evaluate equivalent |
| 2f β Network stubbing | β shipping | Same URLProtocol, synthesized response | register canned responses by URL substring + optional method; supports custom status/headers/body + delay_ms for slow-network simulation |
| 3 β System logs | β shipping | xcrun simctl spawn log stream | streaming os_log into a 5000-line ring buffer |
idb talks directly to CoreSimulator's private framework β no WebDriverAgent, no HTTP hop into the simulator process β which is why the per-call latency is closer to a local subprocess than to a network round trip.
idb (brew tap facebook/fb && brew install idb-companion && pipx install fb-idb)curl -fsSL https://bun.sh/install | bash)xcrun simctl boot <udid> or open it in Xcode)npx will fetch the package on first run. Verify:
Layer 2 dylib ships prebuilt as a universal binary (arm64 + x86_64) β works on both Apple Silicon and Intel Macs out of the box.
Then register:
Grok MCP spawn PATH is often just /usr/bin:/bin. Bare bun fails with:
Failed to spawn MCP server 'ios-sim': No such file or directory (os error 2)
Use the absolute bun binary in ~/.grok/config.toml:
Or:
Restart the Grok session after changing MCP config. Verify: grok mcp list should show ios-sim connected (not failed).
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
Or, if installed from source, point at the local path:
Quit and reopen Claude Desktop.
It's a standard stdio MCP server. Run bun run src/server.ts and pipe JSON-RPC. See test/smoke.ts for a working client example.
| Tool | What it does |
|---|---|
list_simulators | List simulators with UDID, state, OS version |
use_simulator | Pick a specific UDID (auto-selected if only one is booted) |
snapshot | Capture the AX tree, assign refs e1..eN, return compact text rendering. Filters: interactive (default), actionable, all |
find | Search the snapshot by id (AXUniqueId), label, labelContains, role, actionable |
tap | Tap by {ref}, {id}, or {x,y}. Optional duration makes it a long-press |
type_text | Type into the focused field. Optional {ref} or {id} taps-then-types. Auto-routes through paste when the dylib is loaded for byte-perfect input β no iOS autocorrect, no first-letter capitalization. via: "keystroke" forces the typing path; via: "paste" forces the paste path |
paste_text | Byte-perfect text via UIPasteboard + first-responder paste:. Requires the dylib injected. The right answer for emails, passwords, OAuth tokens, anything case-sensitive |
view_tree | Walk the running app's UIView hierarchy on the main thread. Reports class names, frames in window coords, alpha/hidden/interactive, text content, and annotates view-controller boundaries. Strictly richer than snapshot β sees custom-drawn views, transient overlays, SwiftUI internals. Filter by class_filter / ax_id_contains / text_contains. Requires dylib injected |
view_hit_test | "What view actually receives a tap at (x,y)?" Returns the topmost view plus the full responder chain up to UIApplication. The right debugging tool when a tap isn't doing what you expect. Requires dylib injected |
network_start / network_stop / network_status | Install/remove an URLProtocol interceptor + swizzle URLSessionConfiguration so every URLSession-based HTTP request flowing through the app is recorded. Options: max_records, max_body_bytes, filter_url_substring. Requires dylib injected |
network_tail | Return the most recent N captured records. Default: one line per request (id, method, status, timing, sizes, URL). full=true includes headers + body previews inline. Page forward via since_id |
network_get_body | Fetch the full request or response body (up to max_body_bytes, default 256KB) for a specific record id. Returns base64 + UTF-8 decode for text bodies |
network_clear | Drop the ring buffer and all retained bodies |
network_self_test | Fire an HTTP request from inside the app to verify the capture path end-to-end |
network_stub / network_stubs / network_unstub / network_unstub_all | Register canned HTTP responses by URL substring (+ optional method). Synthesizes status/headers/body without forwarding; delay_ms simulates slow networks. Stubbed requests still appear in network_tail with stubbed:true |
eval_js | Run arbitrary JavaScript in a persistent JSContext inside the injected app. Bridged globals: app, key_window(), all_windows(), defaults, pasteboard, bundle, process, notif_center, first_responder(), find_view_by_ax_id, find_view_by_class, find_vc_by_class, post_notification, cls, log. State persists across calls. Requires dylib injected |
eval_js_reset | Drop the JSContext and rebuild bridges on next eval β forgets your defined vars/fns |
key | Press a key by name (RETURN, ESC, DELETE, TAB, SPACE, F1βF12, arrows) or raw HID code |
button | Hardware button: HOME, LOCK, SIDE_BUTTON, SIRI, APPLE_PAY |
swipe | Swipe between two refs/ids/points. Optional duration and delta |
scroll | Reader-perspective scroll: down reveals content below. Optional anchor element |
launch_app | Launch by bundle id. Optional foreground_if_running terminates first |
terminate_app | Terminate by bundle id |
screenshot | PNG to disk or inline. Use sparingly β the AX tree is faster and richer |
await_quiescent | Block until the AX-tree hash is identical for stable_ms (default 250) or timeout_ms (default 5000). Use after launches and navigation instead of sleep |
log_start / log_tail / log_stop / log_clear | Stream os_log into a 5000-line ring buffer. Filter by bundle_id substring, level, or NSPredicate |
Factual signals from GitHub, npm, and our automated checks β not a rating.
No reviews yet β be the first to share how this listing worked for you.
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
[](https://allmcps.com/mcp/ios-sim-mcp)<a href="https://allmcps.com/mcp/ios-sim-mcp"><img src="https://allmcps.com/api/badge/ios-sim-mcp?style=directory" alt="Ios Sim MCP on AllMCPs" /></a>