| Version | Supported |
|---|---|
| latest | ✅ |
| < 0.1.0 | ❌ |
If you discover a security vulnerability in XcodeBazelMCP, please report it responsibly:
- Do not open a public GitHub issue.
- Email maatheusgois@gmail.com with a description of the vulnerability, steps to reproduce, and any relevant logs or screenshots.
- You can expect an initial response within 48 hours.
- We will work with you to understand the issue and coordinate a fix before any public disclosure.
XcodeBazelMCP is a local CLI and MCP server that spawns Bazel and Xcode toolchain processes on your machine. It does not handle authentication, network services, or user data. Security concerns are primarily around:
- Command injection via tool arguments
- Unintended file system access
- Dependency supply chain risks