My iPhone was down to 9.3 GB free, and I wanted to see which apps eat the space, which ones can see my location at all times and what drains the battery. The last time I checked app permissions was probably never. Some of this I can only do by tapping through Settings (there is no export or API, and Shortcuts cannot read it either), so I wanted Claude Code to do the tapping for me. It already did my Viber messages and my Facebook groups.
My first idea was iPhone Mirroring on the Mac, but Apple does not offer it in the EU (citing the Digital Markets Act), and every tool built on top of it is out for me.
The second option is WebDriverAgent, a small HTTP server built on the UI-testing framework from Apple. I run it on the phone, and it accepts taps, swipes and requests for the current screen. There are MCP servers on GitHub that use WebDriverAgent already (MCP lets an AI assistant call outside tools). appium-mcp from the Appium team is the mature one, ios-agent arrived at almost exactly the design I ended up with, and there is even a paid Mac app doing the same. I did not install any of them.
The reason is simple. The code that drives the phone gets everything I can see on it. Once WebDriverAgent runs on an unlocked phone, the tool can open any app and read what it shows: my banking apps up to their Face ID prompt (further if one is still logged in), my mail and chats, and the login codes I get by SMS and e-mail.
So I decided to write the smallest thing I can read end to end, a bit of bash and Python on top of three pinned pieces. WebDriverAgent I build from source at a fixed commit and sign with my own Apple ID, go-ios does the USB tunnel, and the MCP part is the official Python MCP SDK. Claude Code gets 11 tools (screen, tap, type, scroll, launch an app and a few more). Anything labelled send, pay, delete, call or post needs an explicit confirm before the tap. The code is on GitHub if you want to read it.
Writing it myself I learned a few things the READMEs do not say. WebDriverAgent has no password, so while it runs, any device on my Wi-Fi can pull a screenshot of the phone. Not great.
When the phone locks, WebDriverAgent still sees the lock screen, notifications included. Of course, to you mine is just another repo, depending on WebDriverAgent and go-ios like all the others. Read it first, I kept it short on purpose.
The storage pass on my phone found two things. Photos is the biggest single item (I have iCloud Photos switched off), and iOS had already offloaded most of the apps I never open. Next I want to audit what all the other apps on the phone are allowed to do. If you install any of these tools, mine included, keep in mind that Developer Mode is the one switch none of them can get around, and turn it off when you are done.