Apple's Xcode Plugin for Claude Code: What It Installs

Apple’s xcode plugin for Claude Code is 15 lines in Anthropic’s official marketplace and no files: the entry stores one command, xcrun agent plugin path --plugin-format claude, and the Xcode on your own Mac writes the plugin when that command runs.¹² The entry merged on November 6, 2026 (UTC). I found no announcement from Apple or Anthropic in the places I checked.² On Xcode 27.2 the command prints a directory of 160 files: 16 skills and one MCP server entry, with no hooks and no agents. Claude Code’s own inventory estimates about 4,463 tokens added to every session, and the bridge command that server entry names listed 54 tools in a session of mine.² I read the directory and loaded it into throwaway sessions with --plugin-dir. I have not accepted the marketplace install, and each section says which statements come from where.

TL;DR

• The marketplace entry holds a command, not a plugin. Every other entry that fetches from outside the catalog carries a commit SHA. xcode has nothing to pin, and it is the one name on an exemption list in the marketplace’s validator.¹³
• Installing means a person accepts that command. Claude Code prints it and asks, and the flag that skips the question does nothing when an agent runs the install from inside a session.⁶
• You can read everything first. The command prints the directory, and claude --plugin-dir <dir> plugin details xcode-integration inventories it without starting a session.⁷²
• On Xcode 27.2 the inventory is 16 skills, zero agents, zero hooks, and one MCP server that runs xcrun mcpbridge. A session lists 15 of the skills to you. The sixteenth’s header marks it for the model only.²⁹
• If you already added the bridge with claude mcp add, Claude Code suppresses the plugin’s copy as a duplicate. On my Mac the plugin added the skills and nothing else.²⁸
• Acceptance covers the command string. What the command prints follows the Xcode you have selected, and no change to the catalog marks the difference.⁴⁵

What landed in the marketplace

The whole listing is one JSON object. Here it is as it stood in anthropics/claude-plugins-official on November 11, 2026, unchanged since the merge:¹

{
  "name": "xcode",
  "displayName": "Xcode",
  "description": "Work with Xcode projects from Claude Code: build, run, and test schemes, render SwiftUI previews, drive simulators and devices, read build logs and diagnostics, and search Apple developer documentation.",
  "author": {
    "name": "Apple Inc."
  },
  "category": "development",
  "source": {
    "source": "command",
    "command": "xcrun agent plugin path --plugin-format claude",
    "mode": "link"
  },
  "homepage": "https://developer.apple.com/xcode/"
}

The catalog held 317 plugins that day. I sorted them by where their content comes from:¹

The record of how the entry got in shows how unusual it is. A contributor opened pull request #6259, titled “Add Xcode plugin (xcode)”, on September 18, 2026. A bot replied that the repository takes contributions from Anthropic team members only, and a maintainer approved the change 19 minutes after it opened. On September 30 a second pull request, #6338, carried the same commit onto a branch inside the repository so that its checks could run.¹

The checks did not pass as written. A third pull request, #7015, says the marketplace’s validator failed the Xcode entry in three places: it has no SHA, the spaces in its command count as shell metacharacters, and it has no URL to clone. The fix moved the workflow to a validator version with a new command-exempt input and set that input to "xcode". The comment above the line calls each name on the list a “listing decision” that needs sign-off from marketplace operations.³ All three pull requests closed on November 6 (UTC) within nine minutes: #7015 opened at 00:49 and merged at 00:53, #6338 merged at 00:55, and #6259 closed as a duplicate at 00:58.¹³

Neither company has said anything about it that I could find. On November 11 I checked Apple’s developer news, releases, and newsroom feeds, Apple’s Xcode page, Anthropic’s news page, and the Claude blog, and found no mention of the plugin. Apple’s documentation for external agents still describes adding the bridge by hand with claude mcp add and mentions no plugin.²¹⁰ The basis for calling the plugin Apple’s is the author field in the entry and the fact that the command ships inside Xcode.

The entry stores a command, not a plugin

Claude Code added the command source type in version 2.1.229, on August 12, 2026.⁶ The documentation describes it as the source to use when a tool on the user’s machine produces the plugin directory, and its example is an IDE rendering a plugin for the toolchain the user has selected.⁴ The contract is small:

• The command prints one line, the absolute path of a plugin directory, and exits 0. The default time limit is 60 seconds, and the Xcode entry sets none of its own.⁴¹
• Claude Code runs the command when you install or update the plugin, and again once per session for an enabled plugin, in the background, shortly after the session starts. It skips the background runs when CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is set.⁵
• In link mode, the mode the Xcode entry uses, Claude Code copies nothing. It links to the directory’s top-level entries and loads the files where they sit. The version comes from the directory’s real path and its top-level entries, not from the contents of the files.⁴
• Claude Code runs only the exact command a person accepted. If a marketplace later changes the command or its mode, the background runs stop until each user accepts the new one.⁵
• An organization can turn the whole source type off with the managed setting disableCommandPluginSources.⁴

Those rules fit the directory name Xcode uses. On my Mac the command prints a path that carries the Xcode build number (user name replaced):

$ xcrun agent plugin path --plugin-format claude
/Users/<you>/Library/Developer/Xcode/CodingAssistant/ExportedPlugins/27B52/claude

A new Xcode build means a new path, and a new path is what tells Claude Code the plugin changed. With the directory already built and no Xcode app running, the command returned in about 0.2 seconds in three timed runs. My Mac has Xcode’s headless MCP mode turned on, the preview that sudo xcrun mcp-server enable starts and a later section covers. Here, the first call for each Xcode build wrote the directory through Xcode Service, a background helper inside the Xcode bundle, not through the Xcode app. I timed only calls against a directory that already existed, and I have not run the command with that mode off.²

The same rules change what a review can cover. Claude Code’s security documentation tells you to read a plugin’s source before installing: open the homepage or the marketplace repository and find the plugin’s directory there.⁷ For xcode the homepage is Apple’s Xcode product page and the repository holds the 15 lines above. The plugin’s content exists only after your Xcode writes it, so the review happens on your Mac, against your Xcode build.

What Claude Code asks you to accept

Because the install runs a program, Claude Code prints the command and asks before running it. In a terminal the question is Run this command now? [y/N].⁶ I ran the install on Claude Code 2.1.322 from a shell with no terminal attached, and it refused instead of asking. The first four lines of its output:²

$ claude plugin install xcode@claude-plugins-official --scope local
"xcode" is installed by running a command from marketplace "claude-plugins-official" on this machine:
  xcrun agent plugin path --plugin-format claude
  (mode "link": its output directory is used in place (linked, not copied))
Not an interactive terminal, so the command was only displayed, not accepted. Run this in your own terminal (outside the Claude Code session) to confirm the command shown above.

Three details of that step matter.

An agent cannot accept for you. -y accepts the displayed command from your own terminal. The CLI reference says Claude Code ignores the flag when the install runs inside a session, from the Bash tool or from a hook.⁶ If you ask Claude Code to install the plugin, expect it to hand the command back to you.

A script can accept one exact command. With --json, the refused install reports a shownCommand object, and --accept-command <sha256>, added in 2.1.271, accepts that command and no other. The reference says to pass it from your own terminal, because the flag has no effect inside a Claude Code session, so an agent cannot accept by hash either. The documentation ties the hash to the command, the plugin, and the marketplace catalog, and says Claude Code shows the command again if any of the three changed.⁶ Mine, excerpted from the one-line result and reformatted:²

"shownCommand": {
  "kind": "command_source",
  "pluginId": "xcode@claude-plugins-official",
  "command": "xcrun agent plugin path --plugin-format claude",
  "mode": "link",
  "catalogRevision": "gcs:43fd1f9db0941b2b83cb62268e35970d4a67c202",
  "sha256": "b6a49a80f0917b25ceb38fa52e95dacca7ad78893aeb9f0463c62b3d73ca1a48"
}

Take the value from your own --json run. The value above differs from a plain SHA-256 of the command string, which I computed for comparison, and the documentation says a hash stops counting once the catalog changes. Claude Code may refuse a value copied from this post.²⁶

A session has its own route. The rest of the refusal message names a second place to accept: the plugin’s details pane under /plugin. I have not opened that pane for xcode.²

Read the plugin before you accept it

The command that the marketplace wants to run is one you can run yourself. Three lines show you what the install would link:

# 1. Ask Xcode for the directory. The first call for an Xcode build writes it.
DIR="$(xcrun agent plugin path --plugin-format claude)"

# 2. Inventory it without starting a session.
claude --plugin-dir "$DIR" plugin details xcode-integration

# 3. Read the one file that starts a process.
cat "$DIR/.mcp.json"

Line 2 is the documented way to list what Claude Code finds in a plugin directory: it reads the files without starting a session.⁷ The name to pass is the one in the plugin’s manifest, xcode-integration. With the catalog name, xcode, the same command answers Plugin "xcode" not found.² On Xcode 27.2 (27B52) and Claude Code 2.1.322 the first part of the inventory read:²

xcode-integration 1.0.0
  Description: Xcode-managed plugin for skills and services that integrate with the IDE.
  Source: xcode-integration@inline

Component inventory
  Skills (16)  accessibility-dynamic-type-specialist, accessibility-sufficient-contrast-specialist, accessibility-voiceover-specialist, adopt-c-bounds-safety, app-intents-specialist, app-intents-whats-new-27, app-resizability, audit-xcode-security-settings, building-document-based-swiftui-applications, device-interaction, modernize-tests, swiftui-specialist, swiftui-whats-new-27, translation, translation-coordinator, xctrace
  Agents (0)
  Hooks (0)
  MCP servers (1)  xcode  (tool schemas resolved at runtime; not counted)
  LSP servers (0)

Projected token cost
  Always-on:   ~4,463 tok   added to every session

Claude Code’s security page lists the parts of a plugin that run code by themselves, outside the permission rules that govern Claude’s tool calls: hooks, monitors, mods, and MCP and LSP server processes.⁷ Apple’s directory has one of those, the MCP server. Its top level holds three entries: the manifest folder, .mcp.json, and skills/. The 160 files are 157 Markdown files, two JSON files, and one Python script. The script is 69 lines inside the audit-xcode-security-settings skill, it imports only argparse, json, re, and pathlib, and its own description says it filters saved build-settings output down to the security-relevant entries. It runs only if an agent runs it.²

claude plugin validate passes the directory with one warning: the manifest names no author. The same run applies a subset of the submission checks for Anthropic’s claude.ai directory, a separate listing from the official marketplace. Those checks report two problems that directory would refuse a submission for, no README and no LICENSE, and one warning, no icon. They do not bear on this listing: the publishing guide says the official marketplace takes no submissions through that directory’s portal.²¹² The folder states no license terms of its own. I treat it as part of Xcode.

What a session gets: 16 skills, 15 of them listed

I loaded the directory into single-prompt sessions in an empty project with claude -p --plugin-dir "$DIR". A --plugin-dir plugin lasts for that session only and installs nothing.²

The session’s opening event listed the plugin as xcode-integration@inline, version 1.0.0, and the debug log recorded 16 skills loaded from it. The session’s own list of skills and slash commands held 15 of them. The missing one, translation-coordinator, sets user-invocable: false in its header, the setting that hides a skill from the / menu and leaves Claude able to invoke it.⁹ When I asked the model in the same session to print the skills it had, it printed 16 names, the coordinator among them. That last check is the model’s own report.²

Every name carries the prefix xcode-integration:, as in /xcode-integration:swiftui-specialist. The catalog calls the plugin xcode and the manifest calls it xcode-integration, and Claude Code’s loading reference says the two names do different jobs: the catalog name is the install key, and the manifest name is the namespace for the plugin’s components.⁵ I observed the prefix under --plugin-dir. For a marketplace install I am relying on that page.

Claude Code’s estimate of what each skill costs, from the rest of the same output, beside whether the skill’s files name any of the bridge’s tools:²

The figures are tokens, and they are the tool’s estimates. The rows are rounded and add to about 4,470; Claude Code’s own total is the ~4,463 above. The two App Intents skills account for about 1,710 of it, because their descriptions are long. The estimate leaves out the MCP server’s tool schemas, which the inventory says it resolves at runtime. What each skill teaches is in my longer post on the skills Xcode 27 ships and the two ways to get them out.

The MCP half: one server entry, 54 tools here

The .mcp.json declares one stdio server named xcode whose command is xcrun mcpbridge. Apple’s documentation gives the same command for wiring the bridge by hand: claude mcp add --transport stdio xcode -- xcrun mcpbridge.¹⁰ My Claude Code sessions already had that entry. In a session with the hand-added entry and without the plugin, the bridge connected in 339 milliseconds, identified itself as xcode-tools version 25464, and listed 54 tools.² An earlier post of mine cited 20 tools for the bridge in Xcode 26.3, a count that post bases on my testing then and on a third-party walkthrough it links.

I grouped the 54 by name:²

The list reaches further than the marketplace description suggests. XcodeRM removes files from the project and, by default, moves the underlying files to the Trash. InvokeDebuggerCommand sends an lldb command to Xcode’s active debug session. GetTopCrashIssues describes itself as retrieving crash signatures for your app from Apple’s crash reporting service.² Each of these is a tool call, so Claude Code’s permission rules apply to it. The server process itself runs outside the sandbox, as every plugin’s MCP server does.⁷

The skills and the tools refer to each other. Seven of the 16 skills name bridge tools by bare name. One of the seven, audit-xcode-security-settings, also gives the generic prefixed form mcp__<server>__XcodeGlob, says the server’s name varies by environment, and tells the agent not to hardcode one. The dependency runs the other way too. The descriptions of all four String Catalog and localization tools tell the agent to activate a plugin skill before calling the tool: LocalizationPlanner and StringCatalogRead name xcode-integration:translation-coordinator, and StringCatalogContext and StringCatalogEdit name xcode-integration:translation. The other 50 descriptions name no skill.² A session with the hand-added bridge and no plugin has all four tools and neither skill. A commenter on the merged pull request asked what the listing adds, since the Xcode MCP server already worked.¹ On my Mac the answer is the skills, and four of the bridge’s own tools ask for two of them by name.

If you already added the bridge by hand

Claude Code ranks MCP server definitions: local, project, and user scope first, then servers that plugins provide, then claude.ai connectors. A server that an organization provides through managed settings ranks above all of them. Claude Code matches a plugin’s server against the others by endpoint, so a plugin server with the same command as one you configured counts as a duplicate, and Claude Code connects once, using your definition.⁸

My sessions showed exactly that. With the plugin loaded beside my user-scope xcode entry, the session’s server list held xcode with the source user and no entry for the plugin’s server, and the debug log said why (timestamp and log level trimmed):²

Suppressing plugin MCP server "plugin:xcode-integration:xcode": duplicates manually-configured "xcode"

The practical effect is in the names. While the hand-added entry stays, the tools keep the names mcp__xcode__BuildProject, mcp__xcode__XcodeRead, and so on. The documentation gives a plugin’s server the name plugin:<plugin>:<server> and its tools the form mcp__plugin_<plugin>_<server>__<tool>, and says the tool form is the one to use in permission rules and hook matchers.⁸ By that rule, a session with the plugin and no hand-added entry would call the same tool mcp__plugin_xcode-integration_xcode__BuildProject. I did not measure that arrangement, because my configuration has the hand-added entry. If you have allow rules or hooks written against mcp__xcode__ names, removing the hand-added entry after you install the plugin is a rename, by the documentation’s naming rule.

Two permission layers, and the install touches one

Accepting the command settles Claude Code’s side. Xcode keeps its own gate, and nothing in the plugin directory can open it: the directory has no hooks and no install step.

Apple documents the gate for a running Xcode. In Xcode’s Intelligence settings, under Model Context Protocol, a pop-up menu named “Allow External Agents to Use Xcode Tools” offers Always, “While Xcode is Open”, and Never, and Xcode alerts you when an external agent connects.¹⁰ Xcode 27’s release notes describe a second arrangement, a preview of an MCP server that runs without an open workspace. It stays off until you run sudo xcrun mcp-server enable, and it lets you grant code-signed agents permission to use projects within a directory tree.¹¹

My Mac runs the second arrangement. xcrun mcp-server status reports the permission enabled, one permitted agent, and 11 permitted folders.² The permitted agent is Claude Code itself, identified by its code signature, so I expect a bridge that the plugin starts to fall under the same grant. I have not tested that. I have also not seen what Xcode asks on a Mac where you have approved no agent and the plugin is the first thing to start the bridge.

What changes when Xcode changes

A pinned marketplace entry changes when the catalog changes. The Xcode entry changes when Xcode does. Three Xcode builds on my Mac, the 27.1 release candidate (27A9275), the 27.2 beta (27B5019j), and 27.2 (27B52), produced three directories, with 15, 15, and 16 skills. In the 27.2 beta, the skill that the other two builds call app-resizability is named uikit-app-modernization, and xctrace exists only in 27B52.²

The mechanism is the once-per-session run. Update Xcode, or select a different copy, and the command prints a different path the next time it runs, which with an installed and enabled plugin is normally the next session’s background run. The loading reference says Claude Code then installs the result as a new version and reloads it in the running interactive session, with a notification, or prompts you to run /reload-plugins when reloading in place would invalidate the session’s prompt cache.⁵ Your earlier acceptance still stands, because the command string is the same. I have not watched that reload happen, since I have not installed the plugin.

Two habits follow. Rerun the three review lines after an Xcode update, the way you would read a changelog, and start with the first line, because the path changes with the build. And if an agent command prints nothing after an Xcode update, look first for an Xcode you did not open (pgrep -lx Xcode). On my Mac, other xcrun agent commands hung while a hidden Xcode waited on its first-launch screen, the likely cause I traced in the longer post. xcrun agent plugin path did not hang in any run of mine. If it ever runs past the 60-second limit, the documentation says the install or update fails.⁴

Three ways to wire Xcode into Claude Code

Key Takeaways

For iOS developers using Claude Code:

• Run the three review lines first. On Xcode 27.2 they show 16 skills, one MCP server, and no hooks.²
• Install from your own terminal with claude plugin install xcode@claude-plugins-official, and compare the command it displays with the one in the catalog: xcrun agent plugin path --plugin-format claude.¹⁶
• Expect about 4,463 tokens of skill descriptions in every session, by Claude Code’s estimate, before a session invokes any skill.²

For developers who already run the hand-added bridge:

• The plugin adds Apple’s skills. Claude Code suppresses the plugin’s server as a duplicate, and your tool names stay as they are while the hand-added entry stays.²⁸
• The translation tools expect the plugin: all four String Catalog and localization tools tell the agent to activate one of two skills that only the plugin provides.²

For teams that review tools before use:

• No commit pins the content. Review the directory per Xcode build, and treat an Xcode update as a plugin update.¹⁴
• --accept-command <sha256> ties a scripted install to one reviewed command and catalog, and disableCommandPluginSources turns the source type off for an organization.⁴⁶

For marketplace and plugin authors:

• A command source makes the tool on the user’s machine the publisher. Anthropic’s official marketplace admits each one by name, as a listed exemption to its pinning rule.³

FAQ

What is Apple’s Xcode plugin for Claude Code?

An entry named xcode in Anthropic’s official Claude Code marketplace, with “Apple Inc.” as its author. The entry contains no plugin files. It stores the command xcrun agent plugin path --plugin-format claude, and on the three Xcode 27 builds I tried, Xcode wrote the plugin directory on my Mac when the command ran.¹²

How do I install the Xcode plugin in Claude Code?

Run claude plugin install xcode@claude-plugins-official in your own terminal and accept the command it displays. Inside a session, the place to accept is the plugin’s details pane under /plugin, going by the message the refused install printed.² An agent cannot accept the command for you: Claude Code ignores -y inside a session.⁶ I have not completed the install myself. At the default user scope you get the plugin, and its always-on skill descriptions, in every project on the machine. --scope local keeps it to you in one repository, and --scope project records it in .claude/settings.json, which you commit. That turns the plugin on for everyone who works in the repository and downloads nothing to their machines, so each collaborator still runs the install once per clone. Acceptance is per user: each person accepts the command Claude Code shows them. My own attempt used --scope local.²⁶ To remove the plugin later, the same reference gives claude plugin uninstall xcode@claude-plugins-official, with --scope when you installed somewhere other than the default user scope.⁶

What does the plugin contain?

On Xcode 27.2 (27B52): 16 skills, an .mcp.json that declares one server running xcrun mcpbridge, and a three-field manifest. Claude Code’s inventory reports zero agents, zero hooks, and zero LSP servers.²

Do I need the plugin if I already ran claude mcp add for xcrun mcpbridge?

You need it for the skills. Claude Code treats the plugin’s server as a duplicate of yours and suppresses it, so the tools do not change. The skills are new, and four bridge tools, the String Catalog and localization set, tell the agent to activate a skill from the plugin first.²⁸

Why does Claude Code list 15 skills when the folder has 16?

translation-coordinator sets user-invocable: false. Claude Code hides such a skill from the / menu and still lets the model invoke it.⁹ The session’s skill list showed 15, and the model reported 16.²

How much context does the plugin use?

Claude Code’s plugin details estimates about 4,463 tokens in every session for the 16 skill descriptions. Invoking a skill costs more, from about 380 tokens for xctrace to about 21,700 for audit-xcode-security-settings. The estimate excludes the MCP server’s tool schemas.²

What runs on my Mac after I install it?

Going by the documentation and the directory: the accepted command, at install and normally once per session in the background while the plugin is enabled, and the xcrun mcpbridge server process when a session connects to it. The directory has no hooks.²⁵ Everything else is a call to one of the bridge’s tools, which your permission rules cover, or skill text, which the security page says enters Claude’s context as instructions and shapes what Claude does with the tools it already has.⁷ The one Python script, in audit-xcode-security-settings, runs only if an agent runs it, and that is a tool call your permission rules cover too.

Which Xcode do I need?

xcrun agent plugin answered in all three builds on my Mac: the 27.1 release candidate (27A9275), a 27.2 beta (27B5019j), and 27.2 (27B52). I have not tried an earlier Xcode, and none of Apple’s Xcode 27 release notes mention the command.²¹¹

What I measured

One Mac, November 10 and 11, 2026. Treat the numbers as one developer’s observations, not as Apple’s or Anthropic’s documentation.²

• Mac and tools: macOS 27.0 (26A428), Xcode 27.2 (27B52) selected, Claude Code 2.1.322. Xcode’s headless MCP mode was on.
• Catalog: anthropics/claude-plugins-official at commit 43fd1f9, the head on both days.
• Read without a session: the directory xcrun agent plugin path --plugin-format claude prints, claude --plugin-dir <dir> plugin details, claude plugin validate, and a count of files by type.
• Sessions: four single-prompt claude -p sessions in an empty project, none saved. Three loaded the plugin with --plugin-dir. One had only my hand-added bridge and asked Claude Code’s tool search for the bridge’s tools. No session called a bridge tool.
• Install: refused by design in a shell with no terminal. I never accepted the command.
• Tool descriptions: the 54 tool schemas as an interactive Claude Code session loaded them from my hand-added bridge through tool search. The session called no tool.
• Absence checks: Apple’s developer news, releases, and newsroom feeds, Apple’s Xcode page, Anthropic’s news page, and the Claude blog, fetched November 11 and searched for the plugin.
• Not verified: the interactive prompt and the details pane; anything after a marketplace install, including the background run, the reload after an Xcode update, and the version string; the plugin’s own server running with no hand-added entry; what Xcode asks when the plugin’s bridge is the first agent it sees; any Xcode other than 27B52 for the session measurements; a Mac with headless mode off.

The skills themselves, the second way out of Xcode (xcrun agent skills export), and the hang I hit on Xcode 27.2 are in Xcode 27 Ships Agent Skills You Can Export Anywhere. Two MCP Servers Made Claude Code an iOS Build System covers the hand-added bridge, and MCP Servers Are the New Attack Surface covers why a server’s tool list deserves a read. The setup as a whole is in the iOS agent development guide.

References