Ignacy Łątka
5f3b005610
The tool-server exposed every registered tool over HTTP with no
authentication and Access-Control-Allow-Origin: * on every response, so
any web origin (Firefox unconditionally; Chrome via PNA-disabled or
loopback-served) could read /tools and invoke /tools/:name from a
cross-origin browser tab.
Adds a per-process auth token:
- launcher.ts generates a 32-byte hex token at server start, passes it
to the spawned tool-server via ARGENT_AUTH_TOKEN, and persists it in
~/.argent/tool-server.json with mode 0600.
- http.ts requires Authorization: Bearer <token> on every route except
/preview (which is the in-process UI and was not gated before;
tightening it is a follow-up). Constant-time compare prevents
byte-by-byte timing recovery. Wrong/missing token returns 401.
- argent-tools-client and argent-mcp/mcp-server thread the token
through every fetch (fetchTools, callTool, healthcheck, /shutdown).
- argent-cli/server.ts reads the token for `argent server status`
healthcheck. The token is hidden from --json output (replaced with
`hasToken: bool`).
- ensureToolsServer now returns { url, token } instead of just url.
Also drops the global Access-Control-Allow-Origin: * middleware. The
tool-server is in-process stdio for MCP and same-origin for /preview;
no browser needs cross-origin access. Without CORS, the browser cannot
even read response bodies for hostile cross-origin probes.
Backward compat: when ARGENT_AUTH_TOKEN is unset (e.g., `npm run dev`)
the server logs a one-shot warning and skips the gate, so existing local
dev workflows keep working. Stale state files lacking a token are
treated as a launcher-generation mismatch and the server is respawned.
Argent is an agentic toolkit that gives your AI assistant direct access to iOS Simulators. Ask it to tap a button, run a profiler or reproduce an issue manually - all from within your CLI, without switching context.
npx @swmansion/argent init
Capabilities
- Autonomous iOS development - Allow your agent to work with iOS apps on its own - let it build, open, interact with the app and debug it. Ask for reproducing issues, testing features manually, profiling your app and much more, without ever interrupting your work.
- UI interaction - Give your agent full control toolkit - tapping, swiping, pinching, typing, gestures, hardware buttons and all other gears included. Let it navigate your app exactly as a user would, without lifting a finger.
- Profiling with batteries included - Argent can perform and analyze both React-Native and Xcode Instruments profiling sessions. Get comprehensive summaries and ask to optimise your app where you find fit.
- Debugging and diagnostics - Let your agent inspect logs, capture crash reports, and reproduce failing states on the simulator, so you can jump straight to the fix.
- React Native out of the box - Argent works with React Native apps natively, so your agent can build, launch, and iterate on your RN project the same way it would any iOS app - no extra setup required.
Tip: Once installed, ask your assistant "What can Argent do?" - it will walk you through all capabilities available.
Installation
Prerequisites
- macOS with Xcode installed
- Node.js 18 or later
Run init in your project
From your project root:
npx @swmansion/argent init
This command triggers an installation wizard which:
- Installs
@swmansion/argentglobally - Detects your editor and registers the MCP server
- Copies skills, rules, and agent definitions into your workspace
Prefer a manual install?
npm install -g @swmansion/argent
argent init
CLI Reference
| Command | Description |
|---|---|
argent init |
Install globally and configure MCP in the current workspace |
argent install |
Alias for init command |
argent update |
Pull the latest version and refresh workspace configuration |
argent remove |
Unregister the MCP server and uninstall the package |
argent uninstall |
Alias for remove command |
argent mcp |
Start MCP server instance, used internally by agent |
Supported Editors
argent init auto-detects and configures MCP for:
| Editor | Config location |
|---|---|
| Claude Code | .mcp.json (project) or ~/.claude.json (global) |
| Cursor | .cursor/mcp.json (project) or ~/.cursor/mcp.json (global) |
| VS Code | .vscode/mcp.json |
| Windsurf | .windsurf/mcp.json |
| Zed | .zed/settings.json |
| Gemini CLI | .gemini/settings.json |
| Codex CLI | .codex/config.yaml |
| opencode | opencode.json (project) or ~/.config/opencode/opencode.json (global) |
Privacy
Argent does not collect or transmit any user data. No telemetry, no analytics, no crash reporting.
- Argent integrates with your agent locally over MCP stdio.
- Its internal tools are not reachable from outside your machine.
- The only outbound network call we make is the version check against our public npm package, which sends no user data and fails gracefully if blocked.
License
Argent uses a mixed licensing model.
Source code is released under the Apache License 2.0.
Proprietary binaries (the bin/simulator-server and bin/ax-service executables and the .dylib files in native-devtools-ios) are the intellectual property of Software Mansion S.A. and are licensed solely for use within this project. Decompiling, reverse-engineering, or redistributing them without explicit written permission is prohibited.
By using Argent, you acknowledge and agree to this structure. See LICENSE for full details.
Argent is created by Software Mansion
Since 2012 Software Mansion is a software agency with experience in building web and mobile apps. We are Core React Native Contributors and experts in dealing with all kinds of React Native issues. We can help you build your next dream product – Hire us.