On this page · 12 sections
- Why agent security matters in Xcode 27
- How coding agents work in Xcode 27
- The new filesystem security layer
- What agents can do inside a project
- Permissions, plans and human approval
- External agents and the Xcode MCP server
- Apple's security skills: a different kind of protection
- Your code, your Mac and your fleet
- What Apple has not documented yet
- Practical checklist
- How eCorpIT can help
- References
Summary. Xcode 27 lets coding agents plan work, edit code, run simulators, read debugger output and change build settings, entitlements and Info.plist keys. Alongside that, it adds a security layer that monitors and controls the files agents, and any processes they start, can read and write. The layer is something you turn on, not a default you can count on. Apple's WWDC26 presentation says it uses new macOS 27 features, so the kernel asks Xcode before an agent touches a file. Xcode 27 itself also runs on macOS Tahoe 26.6, and Apple does not say whether the layer works there. This guide sets out what Apple documents, what it does not, and what to configure before an agent works on a real codebase.
The pairing matters. The more an agent can do inside a project, the more it matters what it may touch. Apple's own description of the filesystem layer is short, so this article keeps what Apple has documented separate from what you should test in your own copy of Xcode.
About this article. This guide is based on Apple's Xcode 27, 27.1 and 27.2 beta release notes, Apple's Xcode documentation on coding intelligence and external agents, Apple's WWDC26 sessions and Apple's developer news, as checked on 17 October 2026. Xcode 27.1, released on 15 October, made no changes to these controls. Parts of this tooling are labelled beta or early preview, so behaviour and command names may change. Researched with AI assistance and reviewed by our editorial team.
Why agent security matters in Xcode 27
A traditional code editor does what the developer types. A coding agent does what it decides is needed to finish a task: it may read many files, run scripts, call build tools and start other programs.
That changes the risk model for a developer's Mac. A project folder often sits next to other repositories, credentials, signing assets and personal files. An agent that can reach beyond the current project can also read, or accidentally change, more than that project.
Xcode 27's approach has several layers rather than one switch:
- A filesystem security layer for agents and the processes they spawn.
- Permission lists for commands and tools.
- Plan review before an agent changes code.
- A separate access model for external agents that connect through the Model Context Protocol (MCP).
Each layer answers part of the same question: what may an agent do, and who decides?
How coding agents work in Xcode 27
Xcode 27 includes Swift 6.4 and the SDKs for iOS, iPadOS, tvOS, watchOS, macOS and visionOS 27. It needs a Mac running macOS Tahoe 26.6 or later and runs only on Apple silicon.
Agents reach a project in two ways.
Agents inside Xcode
The coding assistant now sits in Xcode's editor area. The agents Apple names include Claude Agent, Codex, Gemini and, new in Xcode 27, Google Antigravity; Gemini and support for the Agent Client Protocol first arrived in Xcode 26.6. Agents can be extended with plug-ins that contain skills, MCP servers and Agent Client Protocol agent configurations.
External agents through MCP
Agents that run outside Xcode, such as Claude Code or Codex in a terminal, connect through Xcode's MCP server. You turn on Allow external agents to use Xcode tools in Xcode's Intelligence settings, then point the agent at xcrun mcpbridge. Section 6 covers the commands and a new preview that works without an open workspace.
The new agent capabilities in Xcode 27 are tools on Xcode's MCP server, so they reach external agents as well as the ones inside Xcode. That is why access control matters on both routes. Our comparison of Claude, Codex and Gemini in Xcode covers the agents themselves.
The new filesystem security layer
The central item sits in the Xcode 27 release notes under Coding Intelligence, New Features. Apple says Coding Intelligence now includes a security layer that monitors and controls filesystem access by coding agents and any processes they spawn, and that it can be enabled in Coding Intelligence settings.
How it works
The release note is one sentence, but Apple's WWDC26 special presentation on Apple Intelligence and Xcode adds a short explanation. A new Xcode setting turns on file access mediation at the kernel level, using new features in macOS 27. When a sub-process such as an agent wants to read or write a file, the kernel asks Xcode first. Xcode applies its policies, trusts your project and its files, and asks you when something needs approval. In Apple's words, "the agent can run, but it can only touch what Xcode allows it to."
Four points to note
It covers spawned processes. Agents start compilers, package managers, scripts and shell commands. A control limited to the agent itself could be sidestepped by asking another program to do the file work, so the inclusion of spawned processes is what gives the layer its reach.
It is about files. Apple's wording covers filesystem access. It does not mention network access or credentials, so do not assume protections Apple has not described.
You have to turn it on. Apple says the layer can be enabled. The settings pane is Xcode, Settings, Intelligence; the release notes call it Coding Intelligence settings, and Apple does not document the toggle's exact label or its default. Check the setting yourself.
It relies on macOS 27. Apple ties the mechanism to new macOS 27 features, while Xcode 27 also runs on macOS Tahoe 26.6. Apple does not say whether the layer is available on 26.6, so confirm the setting exists on the Macs your team actually uses.
What agents can do inside a project
The release notes list what Xcode 27 lets agents do. Agents can:
- Boot simulators, install and launch apps, synthesise touch events and capture screenshots to verify UI behaviour.
- Verify watchOS apps, including Digital Crown and button presses, and tvOS apps through Siri Remote navigation.
- Change the active run state and read and use the debugger console.
- List and switch schemes and run destinations.
- Inspect and modify build settings, compiler flags, entitlements and Info.plist keys.
- Read project insights such as crashes, disk writes, energy use, hangs and launch issues.
- Read, plan and edit translations in String Catalog files.
- Render SwiftUI previews as snapshots in light and dark appearance and in different orientations.
The build settings and entitlements item deserves most attention. Entitlements and Info.plist keys decide what an app may access and how it presents itself to the system, and build settings and compiler flags can strengthen or weaken an app's security. Review an agent's change to these the way you would review a colleague's. Xcode 27.2 beta also adds an optional JSON project file format that Apple describes as more readable, merge-friendly and easier for coding agents to edit, which should make those changes easier to review in a diff.
Permissions, plans and human approval
The filesystem layer is not the only control. Xcode 27 keeps a person in the loop in several places.
Command and tool permissions
You can grant agents permission to use specific system commands and tools. In Intelligence settings, the Permissions row under Agents shows an Allowed Commands list, where you can add and remove entries, and an Allowed Tools list. Permissions you grant during a conversation are collected there, so review the lists from time to time.
Plan review and approval
Plans appear as editable Markdown documents next to the conversation, where you can review, annotate and discuss them, then approve before the agent goes ahead. Plan mode is not automatic for every task: it starts when your prompt asks for a plan or when you type /plan. Use it for anything larger than a small fix.
Undo and history
The coding assistant has an Undo Changes button, and its conversation History lets you roll changes back. History requires the project to be in a Git repository, which is one more reason to keep agent work on a branch.
Agent configuration files
Agent-specific configuration lives under ~/Library/Developer/Xcode/CodingAssistant, in folders for Claude Agent, Codex and Gemini. Apple notes these configurations affect agents only when you launch them in Xcode, so they do not govern the same agent run from a terminal.
Plug-ins
Plug-ins can add subagents, MCP servers and skills, and you manage them under the Plug-ins row in Intelligence settings. A plug-in can give an agent new tools, so treat it like any other dependency: install only plug-ins you trust and review what each one adds.
External agents and the Xcode MCP server
The standard route
In Xcode, choose Settings, then Intelligence, and under Model Context Protocol turn on Allow external agents to use Xcode tools. Apple's documentation then gives commands such as these for Claude Code and Codex:
claude mcp add --transport stdio xcode -- xcrun mcpbridge
codex mcp add xcode -- xcrun mcpbridge
Open the project in Xcode before you prompt the external agent. Xcode alerts you when an external agent connects and while it is active.
The preview that works without an open workspace
Xcode 27 adds an early preview of an MCP server that runs without requiring an open Xcode workspace. It also lets you grant code-signed agents permission to use projects within a directory tree for longer periods, without repeated prompts. Apple documents three commands:
sudo xcrun mcp-server enable
xcrun mcp-server status
sudo xcrun mcp-server enable --unsafe-always-allow-all-agents
The first turns the preview on and the second checks its state. The third approves all permissions upfront. Apple positions it for agents in unattended environments and says it is not a recommended configuration for at-desk use. Apple also warns that the preview may not work in every configuration and that some changes may need an Xcode relaunch or a restart.
Apple does not document a command to switch the preview off or revoke a grant, and it does not explain how the directory tree is chosen. Our advice, not Apple's: keep any grant as narrow as you can, ideally one repository rather than a parent folder that holds many projects, and test what the grant actually covers before you rely on it.
Apple's security skills: a different kind of protection
Xcode 27 also ships two coding-intelligence skills with a security focus:
- audit-xcode-security-settings audits your app and suggests extra security-oriented build settings and entitlements.
- adopt-c-bounds-safety supports a file-by-file workflow for adopting the C bounds safety extension,
-fbounds-safety.
These are easy to confuse with agent protection, but they solve a different problem: they use agents to harden your app. They do not restrict what an agent can access.
The same release adds the arm64e.x1 slice, Hardware-Checked Pointer Arithmetic, which checks for pointer overflow into memory tags on top of Memory Integrity Enforcement. Apple's guide says adopting Memory Integrity Enforcement is a prerequisite. Again, this hardens the shipped app rather than controlling agents in the IDE. One set of features protects your project from the agent; the other helps protect your app from attackers.
Your code, your Mac and your fleet
Agent security is also about where your code goes and what else an agent can reach.
Code sent to the provider. Apple's setup guide notes that the agent or model you choose may access your project files and other information. Read the privacy terms of the provider you connect, and keep secrets out of the repository.
Full Disk Access. On 2 October 2026 Apple said it will add controls so that granting Full Disk Access needs very explicit user action, and warned that the risks of that level of access grow as AI agents become more capable. Do not give Full Disk Access to a terminal or an agent command-line tool just to make an agent work.
Managed Macs. An organisation can turn the coding assistant off on managed Macs by setting CodingAssistantAllowExternalIntegrations to false in a device management profile.
Our articles on hardening an agent's shell access and running agents in isolated virtual machines cover controls outside Xcode.
What Apple has not documented yet
In the material we reviewed, several practical questions remain open:
- Policy detail. WWDC explains the mechanism at a high level, but not which paths are trusted, what is blocked silently and what triggers a prompt.
- Default state and label. Apple says the layer can be enabled but gives neither its default nor the toggle's name.
- macOS 26.6. Apple does not say whether the layer works on macOS Tahoe 26.6.
- Network access. The layer covers files only.
- Visibility. There is no documented log of allowed or denied file access.
- Preview grants. Apple does not document how to view, narrow or revoke the long-lived grants in the MCP preview.
These gaps do not show that the controls are weak or strong. They mean teams should test the controls directly, write down what they see and check again after each Xcode update.
Practical checklist
Before you let agents work on real projects in Xcode 27:
- Turn on the filesystem layer. Open Xcode, Settings, Intelligence and enable it, and confirm it is available on your macOS version.
- Review permissions. Under Agents, open Permissions and allow only the commands and tools your workflow needs.
- Plan first. Use
/planfor larger tasks and approve only a plan that matches your intent.
- Review sensitive changes. Treat edits to entitlements, Info.plist keys, build settings and compiler flags as security changes in code review.
- Keep a way back. Work in a Git repository, on a branch, so History and normal review both work.
- Limit external access. Turn on external agent access only when you need it, and keep any preview grant to one repository.
- Avoid the unsafe flag at the desk. Keep
--unsafe-always-allow-all-agentsto controlled, unattended machines, as Apple advises.
- Vet plug-ins. Review each plug-in's skills and MCP servers before you install it, and remove those you no longer use.
- Protect the rest of the Mac. Do not grant Full Disk Access to agent tools, and use device management on company Macs.
- Test and retest. Try the controls on a small project and repeat after each Xcode update.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. We help iOS teams adopt coding agents safely, from Xcode permission settings and branch workflows to review rules for entitlement and build-setting changes, as part of our AI coding agent rollout service. Talk to us at /contact-us/.
Last updated: 17 October 2026.
