On Xcode 27.0 (27A266a) / macOS 27.2, I ran xcrun mcpbridge from a scripted stdio MCP client and captured traffic system-wide, with a curl control visible in the same captures. Findings: mcpbridge itself opened no network sockets (online or offline, and under a deny-network sandbox). The "Xcode Service" process it connects to made about 2 KB of outbound TLS to an Apple edge address at startup, plus a certificate check via trustd and a request to devimages-cdn.apple.com. When a workspace was opened through XcodeOpenWorkspace, Xcode Service also made two TLS connections to appstoreconnect.apple.com (about 5 KB upstream). This did not occur without a workspace open, and XcodeListWorkspaces itself caused no traffic. mcpbridge sends a CoreAnalytics event to analyticsd (strings: "MCPBridgeTelemetry: Submitted CoreAnalytics event" / "Telemetry off; skipped"), payload <private>. Questions: What is sent to App Store Connect when a workspace is opened this way, and is it the same as opening the project in Xcode directly? What does the MCPBridgeTelemetry event contain, is it sent off-device, and what setting controls it? Is any MCP tool input or output (file contents, paths, build output) sent to Apple?

Network connections made by Xcode's MCP tool service when mcpbridge connects (Xcode 27.0)

On Xcode 27.0 (27A266a) / macOS 27.2, I ran xcrun mcpbridge from a scripted stdio MCP client and captured traffic system-wide, with a curl control visible in the same captures.

Findings:

mcpbridge itself opened no network sockets (online or offline, and under a deny-network sandbox).
The "Xcode Service" process it connects to made about 2 KB of outbound TLS to an Apple edge address at startup, plus a certificate check via trustd and a request to devimages-cdn.apple.com.
When a workspace was opened through XcodeOpenWorkspace, Xcode Service also made two TLS connections to appstoreconnect.apple.com (about 5 KB upstream). This did not occur without a workspace open, and XcodeListWorkspaces itself caused no traffic.
mcpbridge sends a CoreAnalytics event to analyticsd (strings: "MCPBridgeTelemetry: Submitted CoreAnalytics event" / "Telemetry off; skipped"), payload <private>.

Questions:

What is sent to App Store Connect when a workspace is opened this way, and is it the same as opening the project in Xcode directly?
What does the MCPBridgeTelemetry event contain, is it sent off-device, and what setting controls it?
Is any MCP tool input or output (file contents, paths, build output) sent to Apple?