jb-p1lot
Rootless iOS jailbreak development bridge with a Go CLI, stdio MCP server,
Theos package, SpringBoard screen/HID agent, and small on-device control app.
git clone https://github.com/castdrian/jb-p1lot.git
cd jb-p1lot
./scripts/bootstrap.sh
jb-p1lot setup --all --device <udid> --ssh-host <host> --ssh-port <port>
Install the Codex integration with:
codex plugin marketplace add https://github.com/castdrian/jb-p1lot --ref main
codex plugin add jb-p1lot@adrian
If this saves you time, sponsor the project.
Discovery, root shell/files, screenshots and H.264 streams, accessibility and
HID input, app/process/package control, logs/crashes/sysdiagnose, metrics,
PCAP, LLDB, Frida, tweak build/deploy/rollback, and long-running sessions are
exposed as both CLI commands and MCP tools.
The device daemon listens on TCP 5912, advertises _jb-p1lot._tcp, and requires
TLS 1.3 mutual authentication. USBMux is preferred when USB is connected and
encrypted WiFi remains available after disconnect. Pairing grants root
authority to the paired host; the control app can revoke, rotate, or restart
the bridge.
Every reboot operation is userspace-only and maps to Dopamine's userspace
restart path. Hardware/full reboot requests are rejected so the jailbreak is
not intentionally lost.
go test ./...
gmake package FINALPACKAGE=1
python3 scripts/validate_plugin.py plugins/jb-p1lot
python3 scripts/validate_skill.py skills/jb-p1lot
jb-p1lot setup builds and installs jb-p1lot-idevice with cargo when it is
missing (cargo install --path helpers/idevice does the same by hand). It lists
devices, mounts
the developer disk image from Xcode's copy and takes screenshots over the
iOS 17+ developer tunnel with the idevice crate. Discovery, setup and the
screenshot fallback use it, so neither pymobiledevice3 nor libimobiledevice's
device tools or iproxy are needed: port forwards run through it as well.
gmake deploy DEVICE=<udid> builds the package, installs it on the device with
self_update, waits for the bridge to restart, and fails unless the device
reports the host's version.
See skills/jb-p1lot for focused routing guidance. See
THIRD_PARTY_NOTICES.md for ScreenMirror and MCP SDK attribution.
