iOS Sim MCP

Return the last N lines from the log buffer (default 100). Requires log_start first.

Drop all captured records and their bodies. Does not change running state.

Fetch the full request or response body for a captured record. Bodies up to max_body_bytes (default 256KB) are retained per record; larger bodies were truncated at capture time and the response will mark truncated=true. Returns base64 plus a UTF-8 decode when the body is text.

Fire a real HTTP request from inside the injected app to validate the capture path end-to-end. Useful when the host app makes no network calls of its own during a smoke test. Requires network_start first.

Start capturing HTTP traffic from the injected app's URLSession-based code. Installs an URLProtocol subclass + swizzles +defaultSessionConfiguration / +ephemeralSessionConfiguration so requests made via Alamofire, URLRequest, SwiftUI AsyncImage, or any URLSession-based client are recorded into an in-process ring buffer. Existing URLSessions constructed before start are NOT retro-fitted. Requires dylib injected.

Report whether capture is running, how many records are held, and current config (max_records, max_body_bytes, filter).

Stop capturing HTTP traffic. The ring buffer is preserved until network_clear; you can keep calling network_tail on captured records after stopping.

Register an HTTP stub. When an outgoing request's URL contains `url_substring` (and matches `method` if given), the dylib synthesizes a canned response (status, headers, body) instead of forwarding. Stubbed requests still appear in network_tail with `stubbed:true` and `stub_id`. First-match-wins by insertion order. `body` is a UTF-8 string; pass `body_base64` for binary. `delay_ms` simulates slow networks (response is held back that long before client sees it). Persists until network_unstub / network_unstub_all.

List currently registered HTTP stubs (id, url_substring, method filter, status, body preview, delay, when added). Raw body bytes are not returned — call network_get_body on a captured record if you need the actual body delivered.

Return the most recent N captured records (default 50). Each record shows id, method, status, timing, sizes, URL. Pass full=true to include headers + body previews inline; otherwise call network_get_body({id}) to fetch a specific full body. Use since_id to page forward from a previous tail.

Remove a single HTTP stub by id (as returned from network_stub / network_stubs).

Remove all HTTP stubs.

Deliver a URL to the simulator via `xcrun simctl openurl`. Routes through the host OS's URL dispatcher, so http(s) URLs open in Safari and custom-scheme URLs (e.g. myapp://oauth/callback?code=...) are delivered to the registered app's URL handler. Primary use: short-circuit an out-of-process auth flow (ASWebAuthenticationSession / SFSafariViewController) by handing the OAuth callback URL directly to the app, then stub the token-endpoint response with network_stub. Also useful for deep-link testing.

Byte-perfect text input via UIPasteboard + first-responder paste:. Requires the Layer 2 dylib injected and a text field already focused (call tap first). No iOS autocorrect, no capitalization, no smart-quote replacement — what you pass is exactly what the field receives. Use for emails, passwords, OAuth tokens, anything case-sensitive.

Capture a screenshot. If 'path' is provided, saves PNG and returns the path. Otherwise saves to a temp file and returns both the path and the image inline. Use sparingly — the AX tree is faster and richer for control flow.

Scroll a scrollable view. Direction is reader-perspective: 'down' reveals content below (finger drags up); 'up' reveals content above. Optional 'ref' or 'id' to anchor the gesture on a specific scrollable; otherwise uses screen center. 'distance' px (default 300). Default 0.4s duration ensures iOS treats it as a pan, not a tap.

Capture the simulator's accessibility tree and return it with stable refs (e1, e2, ...). Subsequent tap/type/swipe accept refs. Default filter 'interactive' hides decorative containers; use 'all' for everything, 'actionable' for only tappable controls. Always call this before acting on UI.

Swipe from one point to another. Pass from_ref/from_id or from_x+from_y AND to_ref/to_id or to_x+to_y. Optional duration (seconds) and delta (px step).

Tap an element. Pass one of: {ref} from latest snapshot, {id} for AXUniqueId, or {x,y} for raw coordinates. Optional 'duration' (seconds) makes it a long-press.

Terminate an app by bundle id.

Type text into the focused field. Pass ref/id to tap a field first. Newlines/tabs aren't interpreted — use the key tool for RETURN/TAB. via='paste' (default 'auto') routes through the Layer 2 dylib's UIPasteboard so input arrives byte-perfect: no iOS autocorrect, no first-letter capitalization, no shifted-symbol translation — critical for emails, passwords, anything case-sensitive. 'auto' uses paste when the bundle has a connected dylib client, otherwise falls back to keystrokes. 'keystroke' forces idb's text command (typing-like, triggers autocorrect).

Select a specific simulator by UDID for subsequent calls. If only one is booted, auto-selection happens on first action — you only need this when multiple are booted.

Look up a view by AXUniqueId or class name and return its text content (UILabel.text / UIButton.currentTitle / UITextField.text / UITextView.text), plus accessibility label/value as fallback context. Faster than view_tree when you just need 'what does this control say right now?'. Requires the dylib injected.

Ask the running app what view sits topmost at (x,y) in window coords, plus the full responder chain up to UIApplication. The right tool for 'tap at (201,406) isn't doing what I expect' — you see exactly which view receives the hit, whether it's userInteractionEnabled, and what view controllers are in the chain. Requires the dylib injected.

Set the text on a UILabel / UITextField / UITextView / any view that responds to setText:. Bypasses focus + keyboard entirely. Use to seed test data directly into a non-focused field, or to programmatically change a label's text mid-test. Requires the dylib injected.

Walk the running app's UIView hierarchy on the main thread and return a compact text rendering. Strictly richer than snapshot: catches custom-drawn views, transient overlays, things SwiftUI synthesizes that AX flattens; reports actual class names (UIButton vs _UIRoundedRectButton), exact frames in window coords, alpha/hidden/userInteractionEnabled, and annotates which views are a UIViewController's root. Requires the dylib injected (launch_app({inject: true})). Filter the output via class_filter / ax_id_contains / text_contains to scope down before the model has to read it.

Click an element inside a WKWebView. Calls element.click() when available, otherwise dispatches a synthesized MouseEvent. selector is a CSS selector. Returns {ok, tag, id, text, rect}. Requires the dylib injected.

Run JavaScript in a WKWebView via -[WKWebView evaluateJavaScript:completionHandler:]. The JS runs in the page context — has full DOM access (document, window, etc.) and CAN'T see ObjC bridges. Returns {ok, kind, value} for JSON-able results, or {ok:false, exception} on JS error. Pick the web view by index (from webview_list) or ax_id; defaults to the first visible one. Requires the dylib injected.

Fill a form field inside a WKWebView. Uses the React/Angular-safe pattern: sets the input value via HTMLInputElement.prototype's native setter (bypasses React's synthetic value tracker), then dispatches input + change events. selector is a CSS selector (e.g. 'input[name=email]', '#password'). Returns {ok, tag, name, id, value} so you can confirm the right field was hit. Requires the dylib injected and a WKWebView present (see webview_list).

querySelectorAll inside a WKWebView. Returns matching elements with tag, id, name, type, inner text/value, bounding rect, and visibility. Useful for sanity-checking 'is the email field actually rendered?' before webview_fill, or for enumerating multiple matches. Requires the dylib injected.

Enumerate WKWebView instances currently in the host app's view hierarchy. Returns an array of {index, ax_id, class, url, title, frame, hidden}. Use this to confirm a web view is present and pick one by index/ax_id for webview_eval_js etc. Note: does NOT see SFSafariViewController / ASWebAuthenticationSession (those run in a separate system process and are unreachable). Requires the dylib injected.