---
title: "apple-security-devices"
description: "Realistic Apple security-research environments using Tart macOS guests, physical iPhones, and darwin-vm low-level Darwin guests."
canonical: https://agentpluginsdirectory.com/plugins/apple-security-devices
last-updated: 2026-10-21
---

# apple-security-devices
Realistic Apple security-research environments using Tart macOS guests, physical iPhones, and darwin-vm low-level Darwin guests.
- Slug: apple-security-devices
- Publisher: Beale
- Repository: https://github.com/philo-groves/beale-mono
- Manifest: managed-plugins/apple-security-devices/plugin.json
- Version: 0.1.0
- Category (editorial): security
- Skills: 1 (apple-security-devices)
- MCP servers: 1 (devices)
- Stars: 3
- Repository created: 2026-08-28
- Repository last pushed: 2026-10-20
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/apple-security-devices
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What apple-security-devices does, in the publisher's words

apple-security-devices is a portable Agent Plugin for evidence-oriented Apple security research. It deliberately separates three environments with different evidentiary value:

- Tart runs stock macOS guests for reproducible macOS behavior and mitigation validation.
- CoreDevice devicectl communicates with authorized, physically connected iPhones for real iOS behavior.
- darwin-vm runs an intentionally incomplete, instrumentable Darwin root-shell environment for kernel and low-level userspace work.

iOS Simulator is excluded. It does not reproduce the physical iPhone security boundary and must not be used to support iOS exploitability, mitigation, or bounty conclusions.

- macOS host for Tart and physical-iPhone tools.
- Tart installed and a separately prepared VM image for Tart operations.
- Xcode with devicectl, plus a paired and trusted physical iPhone, for device operations.

The plugin never downloads firmware, clones repositories, modifies ramdisks, creates Tart images, pairs devices, or manages Darwin VM checkouts. Darwin tools receive an existing checkout root from the authorized workspace context for each inspection or launch.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/philo-groves/beale-mono/HEAD/managed-plugins/apple-security-devices/README.md

## Skills

- apple-security-devices: Use realistic Apple security research environments through Tart macOS VMs, physically connected iPhones, or darwin-vm. Apply when selecting, preparing, operating, or interpreting Apple platform experiments, especially when iOS Simulator would give unrealistic security evidence.

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

## MCP servers

- devices: transport: stdio; command: node ${PLUGIN_ROOT}/server.mjs

Read from the plugin's own mcp.json. Environment variable names only, never values.