Add MCP bridge support for Xcode - #8
Merged
Merged
Conversation
`vm.py start --bridge PORT=COMMAND` exposes a host-side stdio command to the guest at 10.0.2.101:PORT via a slirp guestfwd, so an MCP stdio server running on the host (e.g. `xcrun mcpbridge` on macOS) can be driven from inside the sandbox. Each guest connection spawns a fresh copy of the command with its stdio piped to the socket. This channel deliberately bypasses the mitmproxy allowlist — it is a raw pipe to a host process — so it is opt-in and warns on both --help and startup. netcat-openbsd is added to the guest packages so the guest side can `nc 10.0.2.101 PORT`. Also records the remaining roadmap (items 6-16) in TODO.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Opening the socket was only half the job: nothing in the guest knew a bridge existed until an MCP client was pointed at it, and the host-side Xcode prerequisite was not discoverable from anywhere. - README gains a "Host tool bridges" section: what a bridge is, a blunt warning that it bypasses the mitmproxy allowlist and is a raw pipe to a host process, and a three-step Xcode walkthrough covering the Xcode Intelligence toggle, the --bridge invocation, and the in-guest `claude mcp add` registration. - `vm.py start` now prints the exact `claude mcp add ... nc IP PORT` line for each bridge, both before boot (where the allowlist-bypass warning belongs) and again just before the SSH handoff (where you paste from). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jeffreleos
approved these changes
Aug 5, 2026
jeffreleos
reviewed
Aug 5, 2026
Comment on lines
+610
to
+612
| print(f"To use from within the guest, run {this_command} from within your") | ||
| print("project folder:") | ||
| print() |
There was a problem hiding this comment.
Insane number of print statements just to get a newline here. Non-blocker.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a flag you can use to poke an MCP-shaped hole in the sandbox to be able to operate Xcode from within the VM. This softens sandboxing a little since Xcode builds are technically equivalent to Bash access, but I am comfortable with the risk given that iOS developers don't have broad AWS/production credentials.