Jailbreak your iPhone so Claude can swipe right

What it does

iOS MCP is an Objective-C server that runs on jailbroken iPhones and exposes 34 tools through the Model Context Protocol. It lets AI agents—Claude, Codex, Cursor, and others—see the screen, read the UI hierarchy, tap icons, type text, press hardware buttons, launch or kill apps, adjust brightness and volume, and execute shell commands. In short, it gives an LLM the same low-level control over an iPhone that a human with a jailbreak already enjoys.

The interesting bit

The project bridges two worlds that rarely meet: high-level AI agent frameworks and the raw, permissionless guts of a jailbroken iOS device. It simulates HID events for physical buttons and touch gestures, queries the accessibility tree for UI elements, and even gates dangerous actions when the screen is locked. The security posture is refreshingly honest: no built-in authentication, so keep it on your LAN, and the author explicitly warns that run_command is arbitrary shell access with mcp-root privilege escalation available to package tools.

Key highlights

• 34 MCP tools covering touch gestures, hardware keys, text input, screenshots, app management, clipboard, device info, URL schemes, and shell execution.
• Supports rootful, rootless, and roothide jailbreaks across iOS 13 to iOS 18.
• Screen-state aware: blocks interactive or write-capable tools when the device is locked or asleep, while still permitting screenshots and status queries.
• No authentication on the MCP endpoint; intended strictly for trusted local networks.
• Includes mcp-root for privilege escalation, restricted to internal package tools.

Caveats

• Requires a jailbroken device, which limits the audience to a shrinking pool of tinkerers and researchers.
• The MCP service has no built-in authentication, so network exposure would hand over full device control to anyone who finds the port.
• run_command allows arbitrary shell execution, and the README disclaims liability for data loss, security issues, or system damage.

Verdict

Grab it if you are building LLM agents that need to physically interact with real iOS hardware, or if you want to automate a jailbroken phone without fighting Apple’s sandbox. If you don’t already have a jailbroken device and a high tolerance for LAN-only security, this is not for you.