A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
This report summarizes scanner evidence for getsentry/XcodeBuildMCP, a TypeScript project with 6,531 GitHub stars. SynthScan examined 242,484 lines of code across 1778 source files, recording 778 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 3.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 748 finding(s).
Are imports declared and package/API names verified? 16 finding(s).
Are wrappers, guards, and repeated structures necessary? 717 finding(s).
Which changes need focused human review? 778 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 778 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 66 | def identify_security_findings( | CODE |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 157 | def _has_sweep_complete_comment(issue_url: str) -> bool: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 266 | def update_findings_with_pr_links(sweep_dir: str) -> None: | CODE |
| LOW | scripts/repro-mcp-lifecycle-leak.ts | 165 | async function runGracefulStdinIteration(closeDelayMs: number): Promise<IterationResult> { | CODE |
| LOW | scripts/repro-mcp-lifecycle-leak.ts | 201 | async function runParentHardExitIteration(closeDelayMs: number): Promise<IterationResult> { | CODE |
| LOW | src/doctor-cli.ts | 15 | function shouldUseNonRedactedOutput(argv: string[]): boolean { | CODE |
| LOW | src/test-utils/mock-executors.ts | 34 | export function createMockCommandResponse( | CODE |
| LOW | src/test-utils/mock-executors.ts | 147 | export function createCommandMatchingMockExecutor( | CODE |
| LOW | src/test-utils/mock-executors.ts | 215 | export function createMockInteractiveSpawner( | CODE |
| LOW | src/test-utils/mock-executors.ts | 297 | export function createMockFileSystemExecutor( | CODE |
| LOW | src/test-utils/mock-executors.ts | 337 | export function createNoopFileSystemExecutor(): FileSystemExecutor { | CODE |
| LOW | src/test-utils/mock-executors.ts | 427 | export function createNoopInteractiveSpawner(): InteractiveSpawner { | CODE |
| LOW | src/test-utils/mock-executors.ts | 443 | export function createMockEnvironmentDetector( | CODE |
| LOW | src/test-utils/test-helpers.ts | 42 | export function createMockToolHandlerContext(): { | CODE |
| LOW | src/test-utils/test-helpers.ts | 187 | export function expectPendingBuildResponse( | CODE |
| LOW | src/core/structured-output-schema.ts | 99 | function collectAndRewriteCommonRefs(value: unknown, pendingDefs: Set<string>): unknown { | CODE |
| LOW | src/core/structured-output-schema.ts | 206 | function inlineRegistrationSchemaResource(schema: JsonObject): { | CODE |
| LOW | src/core/structured-output-schema.ts | 244 | function getMcpOutputSchemaForRegistrationJson(ref: StructuredOutputSchemaRef): JsonObject { | CODE |
| LOW | src/core/structured-output-schema.ts | 275 | export function getMcpOutputSchemaForRegistration(ref: StructuredOutputSchemaRef): McpOutputSchema { | CODE |
| LOW | src/core/resource-root.ts | 9 | export function resetResourceRootCacheForTests(): void { | CODE |
| LOW | src/core/resource-root.ts | 56 | function getExecutableResourceRoot(): string | null { | CODE |
| LOW | src/core/resource-root.ts | 93 | export function getStructuredOutputSchemasDir(): string { | CODE |
| LOW | src/core/manifest/load-manifest.ts | 251 | export function getWorkflowMetadataFromManifest(): Record< | CODE |
| LOW | src/core/__tests__/structured-output-schema.test.ts | 15 | function expectNoExternalCommonRefs(schema: JsonObject): void { | CODE |
| LOW | src/core/__tests__/structured-output-schema.test.ts | 28 | function stripRegistrationResourceEnvelope(schema: JsonObject): JsonObject { | CODE |
| LOW | src/visibility/exposure.ts | 19 | export function isWorkflowAvailableForRuntime( | CODE |
| LOW | src/visibility/exposure.ts | 33 | export function isWorkflowEnabledForRuntime( | CODE |
| LOW | src/visibility/exposure.ts | 50 | export function isToolAvailableForRuntime(tool: ToolManifestEntry, runtime: RuntimeKind): boolean { | CODE |
| LOW | src/visibility/exposure.ts | 112 | export function getDefaultEnabledWorkflows( | CODE |
| LOW | src/visibility/exposure.ts | 133 | export function isResourceAvailableForRuntime( | CODE |
| LOW | src/visibility/exposure.ts | 147 | export function isResourceExposedForRuntime( | CODE |
| LOW | src/snapshot-tests/json-harness.ts | 9 | export async function createMcpJsonSnapshotHarness( | CODE |
| LOW | src/snapshot-tests/tool-manifest-resolver.ts | 14 | export function resolveSnapshotToolManifest( | CODE |
| LOW | src/snapshot-tests/xcode-ide-availability.ts | 6 | export function isXcodeIdeBridgeAvailable(): boolean { | CODE |
| LOW | src/snapshot-tests/xcode-ide-availability.ts | 22 | export async function listAvailableXcodeIdeBridgeToolNames(): Promise<Set<string>> { | CODE |
| LOW | src/snapshot-tests/mcp-tool-contract-fixtures.ts | 116 | export function expectMcpToolContractFixtures( | CODE |
| LOW | src/snapshot-tests/fixture-io.ts | 279 | export function expectResultMatchesFixture( | CODE |
| LOW | src/snapshot-tests/fixture-io.ts | 310 | export function createResultFixtureMatcher( | CODE |
| LOW | src/snapshot-tests/output-parsers.ts | 35 | export function extractAppPathFromSnapshotOutput(output: string): string { | CODE |
| LOW | src/snapshot-tests/output-parsers.ts | 48 | export function extractAppPathFromSnapshotResult(result: SnapshotResult): string { | CODE |
| LOW | src/snapshot-tests/output-parsers.ts | 57 | export function extractProcessIdFromSnapshotOutput(output: string): number { | CODE |
| LOW | src/snapshot-tests/output-parsers.ts | 70 | export function extractProcessIdFromSnapshotResult(result: SnapshotResult): number { | CODE |
| LOW | src/snapshot-tests/codex-031-input-schema.ts | 7 | function deserializeToolInputSchema(value: unknown): JsonObject { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 165 | function isSystemDebugStackLocation(displayLocation: string): boolean { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 174 | function normalizeDebugStackDisplayLocation(displayLocation: string): string { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 220 | function normalizeDebugStackFrames(items: unknown[]): unknown[] { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 244 | function normalizeBuildSettingsEntryKey(key: string): string { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 252 | function normalizeBuildSettingsEntryValue( | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 352 | function normalizeDiagnosticTestFailure(item: unknown): unknown { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 367 | function normalizeDiagnosticTestFailures(items: unknown[]): unknown[] { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 377 | function isSpringBoardHomeCompactCapture(value: Record<string, unknown>): boolean { | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 390 | function normalizeSpringBoardHomeCompactCapture( | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 493 | function normalizeXcodeBridgeCallEnvelope( | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 515 | export function normalizeStructuredEnvelope( | CODE |
| LOW | src/snapshot-tests/json-normalize.ts | 535 | export function formatStructuredEnvelopeFixture( | CODE |
| LOW | src/snapshot-tests/json-schema-validation.ts | 214 | function assertLocalReferencesResolve(value: unknown, root: unknown, label: string): void { | CODE |
| LOW | src/snapshot-tests/json-schema-validation.ts | 250 | function validateRegisteredOutputSchema( | CODE |
| LOW | src/snapshot-tests/json-schema-validation.ts | 310 | export function createStructuredFixtureSchemaValidator(): StructuredFixtureSchemaValidator { | CODE |
| LOW | src/snapshot-tests/normalize.ts | 141 | function normalizeDoctorProcessTree(text: string): string { | CODE |
| LOW | src/snapshot-tests/normalize.ts | 148 | function trimVolatileDebugStackPrefix(text: string): string { | CODE |
| 643 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .agents/skills/warden-sweep/references/patch-prompt.md | 15 | ### Step 1: Understand the code | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/references/patch-prompt.md | 18 | ### Step 2: Apply a minimal fix | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/references/patch-prompt.md | 21 | ### Step 3: Write tests | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/references/patch-prompt.md | 29 | ### Step 4: Self-review | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/references/patch-prompt.md | 38 | ### Step 5: Commit | COMMENT |
| LOW | .agents/skills/warden-sweep/references/patch-prompt.md | 50 | ### Step 6: Output | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 358 | # Step 1: Identify security findings | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 366 | # Step 2: Label security PRs | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 374 | # Step 3: Update finding reports with PR links | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 378 | # Step 4: Copy security finding reports (after PR links are added) | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 381 | # Step 5: Generate summary and report | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 385 | # Step 6: Update tracking issue with PR results | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 389 | # Step 7: Update manifest | COMMENT |
| LOW⚡ | skills/mobilebuildmcp/SKILL.md | 24 | ## Step 1: Establish Session Context | COMMENT |
| LOW⚡ | skills/mobilebuildmcp/SKILL.md | 32 | ## Step 2: Understand Workflow-Scoped Tool Availability | COMMENT |
| LOW⚡ | skills/mobilebuildmcp/SKILL.md | 38 | ## Step 3: Report Context Clearly | COMMENT |
| LOW | skills/mobilebuildmcp-cli/SKILL.md | 10 | ## Step 1: Ensure the CLI Exists | COMMENT |
| LOW | skills/mobilebuildmcp-cli/SKILL.md | 32 | ## Step 2: Use Help-First Discovery | COMMENT |
| LOW | skills/mobilebuildmcp-cli/SKILL.md | 44 | ## Step 3: Keep Execution Minimal | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 358 | # Step 1: Identify security findings | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 366 | # Step 2: Label security PRs | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 374 | # Step 3: Update finding reports with PR links | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 378 | # Step 4: Copy security finding reports (after PR links are added) | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 381 | # Step 5: Generate summary and report | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 385 | # Step 6: Update tracking issue with PR results | COMMENT |
| LOW⚡ | .agents/skills/warden-sweep/scripts/organize.py | 389 | # Step 7: Update manifest | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/warden/references/config-schema.md | 17 | maxTurns = 50 # Max agentic turns per hunk | CODE |
| MEDIUM | …ut/mobilebuildmcp.output.scaffold-result/2.schema.json | 3 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outpu | CODE |
| MEDIUM | …ut/mobilebuildmcp.output.scaffold-result/1.schema.json | 3 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outpu | CODE |
| MEDIUM | …s/session-defaults-enabled/scaffold_macos_project.json | 96 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.out | CODE |
| MEDIUM | …cts/session-defaults-enabled/scaffold_ios_project.json | 117 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.out | CODE |
| MEDIUM | …/session-defaults-disabled/scaffold_macos_project.json | 96 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.out | CODE |
| MEDIUM | …ts/session-defaults-disabled/scaffold_ios_project.json | 117 | "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.out | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/warden-sweep/scripts/index_prs.py | 21 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/index_prs.py | 26 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/extract_findings.py | 18 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 27 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/find_reviewers.py | 19 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/generate_report.py | 16 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/create_issue.py | 20 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 23 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 35 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/_utils.py | 2 | CODE | |
| LOW | benchmarks/claude-ui/parse_claude_conversation.py | 12 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/cli/commands/__tests__/upgrade.test.ts | 153 | // ── Pure helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/cli/commands/__tests__/upgrade.test.ts | 452 | // ── Command flow ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/cli/commands/__tests__/upgrade.test.ts | 891 | // ── Canonical latest release lookup ─────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/warden-sweep/scripts/extract_findings.py | 38 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/extract_findings.py | 111 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 122 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 201 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 228 | CODE | |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 400 | CODE | |
| LOW | benchmarks/claude-ui/parse_claude_conversation.py | 108 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/warden-sweep/scripts/extract_findings.py | 106 | print(f"Error reading {log_path}: {e}", file=sys.stderr) | CODE |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 321 | except Exception as e: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 86 | except Exception: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 118 | except Exception: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 312 | except Exception as e: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 345 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 287 | # Check if PR section already appended | COMMENT |
| LOW | scripts/release.sh | 347 | # Check if working directory is clean outside release-managed files | COMMENT |
| LOW | scripts/release.sh | 402 | # Check if package.json already has this version (from previous attempt) | COMMENT |
| LOW | scripts/bundle-axe.sh | 55 | # Check if build succeeded | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .agents/skills/warden-sweep/scripts/_utils.py | 98 | except (subprocess.TimeoutExpired, FileNotFoundError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/mcp/tools/ui-automation/screenshot.ts | 124 | print("\\(b["Width"] as? Int ?? 0),\\(b["Height"] as? Int ?? 0)") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tools/ui-automation/__tests__/runtime-snapshot.test.ts | 34 | AXValue: 'user@example.com', | CODE |
| LOW | …tools/ui-automation/__tests__/runtime-snapshot.test.ts | 67 | value: 'user@example.com', | CODE |
| LOW | src/mcp/tools/ui-automation/__tests__/type_text.test.ts | 69 | { simulatorId, elementRef: 'e1', text: 'user@example.com' }, | CODE |
| LOW | src/mcp/tools/ui-automation/__tests__/type_text.test.ts | 88 | ['/mocked/axe/path', 'type', 'user@example.com', '--udid', simulatorId], | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 172 | def update_tracking_issue(sweep_dir: str) -> None: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 266 | def update_findings_with_pr_links(sweep_dir: str) -> None: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/organize.py | 325 | def update_manifest(sweep_dir: str) -> None: | CODE |
| LOW | .agents/skills/warden-sweep/scripts/scan.py | 384 | def update_manifest_phase(sweep_dir: str, phase: str, status: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ample_projects/iOS/MCPTestUITests/MCPTestUITests.swift | 1 | import XCTest | COMMENT |