@mmerterden/dev-toolkit-mcp 2.24.1

package/tools/ios-app-store-audit/rules/embedded-sdk.js

@@ -0,0 +1,126 @@
+/**
+ * embedded-sdk - Validates embedded frameworks for code signing, simulator
+ * architectures, and privacy manifest presence (for Apple's required SDK list).
+ * Direct port of EmbeddedSDKRule.swift.
+ *
+ * ITMS error codes: 91065 (signing), 90174 (sim slices). Apple Guideline 5.1.1.
+ *
+ * Source list: https://developer.apple.com/support/third-party-SDK-requirements/
+ */
+
+import { execSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { dirname, basename, join } from "path";
+import { fileURLToPath } from "url";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "embedded-sdk";
+export const name = "Embedded SDK Validation";
+export const description = "Checks embedded frameworks for signing, simulator slices, and privacy manifests";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SDK_LIST_PATH = join(__dirname, "../data/apple-required-sdks.json");
+
+let APPLE_REQUIRED_SDKS = null;
+function loadSDKs() {
+  if (APPLE_REQUIRED_SDKS !== null) return APPLE_REQUIRED_SDKS;
+  try {
+    const data = JSON.parse(readFileSync(SDK_LIST_PATH, "utf-8"));
+    APPLE_REQUIRED_SDKS = new Set(data.sdks || []);
+  } catch {
+    APPLE_REQUIRED_SDKS = new Set();
+  }
+  return APPLE_REQUIRED_SDKS;
+}
+
+function isAppleRequiredSDK(frameworkName) {
+  const list = loadSDKs();
+  const stripped = frameworkName.replace(/\.framework$/, "").replace(/\.xcframework$/, "");
+  if (list.has(stripped)) return true;
+  // SPM mangled / repackaged matches: name starts with or contains an SDK token.
+  for (const sdk of list) {
+    if (stripped.startsWith(sdk) || stripped.includes(sdk)) return true;
+  }
+  return false;
+}
+
+function isCodeSigned(path) {
+  try {
+    execSync(`/usr/bin/codesign --verify --deep --strict "${path}"`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function simulatorArchitectures(binaryPath) {
+  if (!existsSync(binaryPath)) return [];
+  let archs = "";
+  try {
+    archs = execSync(`/usr/bin/lipo -archs "${binaryPath}" 2>/dev/null`, {
+      encoding: "utf-8",
+    }).trim();
+  } catch {
+    return [];
+  }
+  return archs.split(/\s+/).map((a) => a.trim()).filter((a) => a === "x86_64" || a === "i386");
+}
+
+export function check(ctx) {
+  const violations = [];
+  const archiveSigned = ctx.executablePath ? isCodeSigned(ctx.executablePath) : false;
+
+  if (!archiveSigned && (ctx.embeddedFrameworks?.length ?? 0) > 0) {
+    violations.push(makeViolation({
+      ruleID: id, severity: Severity.INFO,
+      message: "Archive is not signed - skipping framework signature checks. Sign the archive to enable full validation.",
+    }));
+  }
+
+  for (const fwPath of ctx.embeddedFrameworks ?? []) {
+    const fwName = basename(fwPath);
+    const required = isAppleRequiredSDK(fwName);
+
+    // Signature check (only for signed archives, only error for required SDKs)
+    if (archiveSigned && !isCodeSigned(fwPath) && required) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-91065", severity: Severity.ERROR,
+        message: `'${fwName}' is on Apple's required SDK list and is not signed`,
+        file: fwPath,
+        suggestion: "Contact the SDK vendor for a signed version. See: https://developer.apple.com/support/third-party-SDK-requirements/",
+      }));
+    }
+
+    // Simulator architectures (always error if found)
+    const binaryName = fwName.replace(/\.framework$/, "").replace(/\.xcframework$/, "");
+    const binaryPath = join(fwPath, binaryName);
+    if (existsSync(binaryPath)) {
+      const simArchs = simulatorArchitectures(binaryPath);
+      if (simArchs.length > 0) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "ITMS-90174", severity: Severity.ERROR,
+          message: `Framework '${fwName}' contains simulator architectures: ${simArchs.join(", ")}`,
+          file: fwPath,
+          suggestion: "Strip simulator architectures before submission",
+        }));
+      }
+    }
+
+    // A required-SDK framework with no PrivacyInfo.xcprivacy is ITMS-91061, an
+    // enforced rejection since 2025-02-12 -  not a 5.1.1 advisory. Filing it as
+    // a WARNING let a hard rejection pass the audit.
+    if (required) {
+      const manifestPath = join(fwPath, "PrivacyInfo.xcprivacy");
+      if (!existsSync(manifestPath)) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "ITMS-91061", severity: Severity.ERROR,
+          message: `'${fwName}' is on Apple's required SDK list but missing PrivacyInfo.xcprivacy (ITMS-91061)`,
+          file: fwPath,
+          suggestion: "Upgrade to an SDK version that ships a privacy manifest, or request one from the vendor. App Store Connect rejects the upload without it. See: https://developer.apple.com/support/third-party-SDK-requirements/",
+        }));
+      }
+    }
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/entitlement.js

@@ -0,0 +1,105 @@
+/**
+ * entitlement - Validates entitlements consistency + companion Info.plist
+ * purpose strings + background modes + keychain group prefixes.
+ * Direct port of EntitlementRule.swift.
+ *
+ * Apple Guidelines: 2.5.4, 5.1.1, ITMS-90046
+ */
+
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "entitlements";
+export const name = "Entitlements Validation";
+export const description = "Checks entitlements for consistency and required companion Info.plist keys";
+
+const ENT_PURPOSE_MAP = [
+  { entitlement: "com.apple.developer.healthkit",                      plistKey: "NSHealthShareUsageDescription",  label: "HealthKit" },
+  { entitlement: "com.apple.developer.healthkit",                      plistKey: "NSHealthUpdateUsageDescription", label: "HealthKit" },
+  { entitlement: "com.apple.developer.networking.wifi-info",           plistKey: "NSLocalNetworkUsageDescription", label: "Wi-Fi Info" },
+  { entitlement: "com.apple.developer.nfc.readersession.formats",      plistKey: "NFCReaderUsageDescription",      label: "NFC" },
+  { entitlement: "com.apple.developer.homekit",                        plistKey: "NSHomeKitUsageDescription",      label: "HomeKit" },
+  { entitlement: "com.apple.developer.siri",                           plistKey: "NSSiriUsageDescription",         label: "Siri" },
+];
+
+const BACKGROUND_MODES = {
+  audio: "Background Audio",
+  location: "Background Location",
+  voip: "VoIP",
+  fetch: "Background Fetch",
+  "remote-notification": "Remote Notifications",
+  "bluetooth-central": "Bluetooth Central",
+  "bluetooth-peripheral": "Bluetooth Peripheral",
+  "external-accessory": "External Accessory",
+  processing: "Background Processing",
+};
+
+export function check(ctx) {
+  const violations = [];
+  const ent = ctx.entitlements;
+  const plist = ctx.infoPlist || {};
+  if (!ent) return violations;
+
+  // Entitlement → Info.plist purpose string mapping
+  for (const m of ENT_PURPOSE_MAP) {
+    if (ent[m.entitlement] != null && plist[m.plistKey] == null) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+        message: `${m.label} entitlement requires ${m.plistKey} in Info.plist`,
+        suggestion: `Add ${m.plistKey} with a meaningful description to Info.plist`,
+      }));
+    }
+  }
+
+  // Background modes
+  const bgModes = Array.isArray(plist.UIBackgroundModes) ? plist.UIBackgroundModes : null;
+  if (bgModes) {
+    for (const mode of bgModes) {
+      const label = BACKGROUND_MODES[mode];
+      if (label) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "2.5.4", severity: Severity.INFO,
+          message: `Background mode '${label}' is enabled - Apple reviews these carefully`,
+          suggestion: "Ensure this background mode is actively used and justified in App Review notes",
+        }));
+      }
+    }
+    if (bgModes.includes("location") &&
+        plist.NSLocationAlwaysAndWhenInUseUsageDescription == null &&
+        plist.NSLocationAlwaysUsageDescription == null) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+        message: "Background location mode requires NSLocationAlwaysAndWhenInUseUsageDescription",
+        file: "Info.plist",
+      }));
+    }
+  }
+
+  // Associated domains - present but empty
+  const domains = ent["com.apple.developer.associated-domains"];
+  if (Array.isArray(domains) && domains.length === 0) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.WARNING,
+      message: "Associated domains entitlement is present but the domain list is empty",
+      suggestion: "Add your universal link domains or remove the entitlement",
+    }));
+  }
+
+  // Keychain access groups - must share team prefix
+  const groups = ent["keychain-access-groups"];
+  if (Array.isArray(groups)) {
+    const appID = typeof ent["application-identifier"] === "string" ? ent["application-identifier"] : "";
+    const teamPrefix = appID.split(".")[0] || "";
+    for (const group of groups) {
+      if (typeof group !== "string") continue;
+      if (!group.startsWith(teamPrefix) && !group.startsWith("$(")) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "ITMS-90046", severity: Severity.WARNING,
+          message: `Keychain access group '${group}' does not match team prefix '${teamPrefix}'`,
+          suggestion: "Verify keychain sharing groups are configured correctly",
+        }));
+      }
+    }
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/extension-signing.js

@@ -0,0 +1,105 @@
+/**
+ * extension-signing - Validates every embedded .appex (app extension /
+ * widget / share extension): code signing, bundle-ID prefix consistency,
+ * privacy manifest hint, App Groups entitlement match with the main app.
+ * Direct port of ExtensionSigningRule.swift.
+ *
+ * ITMS error codes: 90035, 90046, 90283. Apple Guideline 5.1.1.
+ */
+
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { join, basename } from "path";
+import { Severity, makeViolation } from "../models.js";
+import { parsePlist, extractEntitlements } from "../context.js";
+
+export const id = "extension-signing";
+export const name = "Extension Signing";
+export const description = "Checks embedded extensions for signing, bundle ID prefix, and entitlement consistency";
+
+function isCodeSigned(path) {
+  try {
+    execSync(`/usr/bin/codesign --verify --deep --strict "${path}"`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function check(ctx) {
+  const violations = [];
+  const mainBundleID = typeof ctx.infoPlist?.CFBundleIdentifier === "string"
+    ? ctx.infoPlist.CFBundleIdentifier
+    : "";
+
+  const mainGroups = Array.isArray(ctx.entitlements?.["com.apple.security.application-groups"])
+    ? ctx.entitlements["com.apple.security.application-groups"]
+    : null;
+
+  for (const pluginPath of ctx.embeddedPlugins ?? []) {
+    const name = basename(pluginPath);
+
+    // 1. Code signed?
+    if (!isCodeSigned(pluginPath)) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90035", severity: Severity.ERROR,
+        message: `Extension '${name}' is not properly code signed`,
+        file: pluginPath,
+        suggestion: "Ensure the extension target uses the same signing configuration as the main app",
+      }));
+    }
+
+    // 2. Bundle-ID prefix
+    const extPlistPath = join(pluginPath, "Info.plist");
+    const extPlist = parsePlist(extPlistPath);
+    const extBundleID = typeof extPlist?.CFBundleIdentifier === "string" ? extPlist.CFBundleIdentifier : "";
+
+    if (mainBundleID && extBundleID && !extBundleID.startsWith(mainBundleID)) {
+      const cleanName = name.replace(/\.appex$/, "");
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90046", severity: Severity.ERROR,
+        message: `Extension '${name}' bundle ID '${extBundleID}' must be prefixed with main app bundle ID '${mainBundleID}'`,
+        file: extPlistPath,
+        suggestion: `Change extension bundle ID to '${mainBundleID}.${cleanName}'`,
+      }));
+    }
+
+    // 3. Per-extension privacy manifest hint
+    if (extPlist?.NSExtensionPointIdentifier != null) {
+      const extPrivacyPath = join(pluginPath, "PrivacyInfo.xcprivacy");
+      if (!existsSync(extPrivacyPath)) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.INFO,
+          message: `Extension '${name}' does not have its own PrivacyInfo.xcprivacy`,
+          file: pluginPath,
+          suggestion: "Consider adding a privacy manifest to the extension if it accesses required-reason APIs",
+        }));
+      }
+    }
+
+    // 4. App Groups consistency vs main app
+    if (mainGroups) {
+      const extExecName = (typeof extPlist?.CFBundleExecutable === "string"
+        ? extPlist.CFBundleExecutable
+        : name.replace(/\.appex$/, ""));
+      const extExecPath = join(pluginPath, extExecName);
+      const extEnt = extractEntitlements(extExecPath);
+      const extGroups = Array.isArray(extEnt?.["com.apple.security.application-groups"])
+        ? extEnt["com.apple.security.application-groups"]
+        : null;
+      if (extGroups) {
+        const missing = extGroups.filter((g) => !mainGroups.includes(g));
+        if (missing.length > 0) {
+          violations.push(makeViolation({
+            ruleID: id, guidelineRef: "ITMS-90283", severity: Severity.ERROR,
+            message: `Extension '${name}' uses App Groups not in main app: ${missing.join(", ")}`,
+            file: pluginPath,
+            suggestion: "Add the missing App Groups to the main app target",
+          }));
+        }
+      }
+    }
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/info-plist.js

@@ -0,0 +1,158 @@
+/**
+ * info-plist - Validates Info.plist for required keys, purpose strings,
+ * ATS configuration, app-name length (≤30 chars), and launch storyboard
+ * presence. Direct port of InfoPlistRule.swift.
+ *
+ * Apple Guidelines: 2.1, 2.3, 5.1.1.
+ */
+
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "info-plist";
+export const name = "Info.plist Validation";
+export const description = "Checks Info.plist for required keys, purpose strings, and ATS configuration";
+
+/** Keys that need a non-empty, meaningful description. */
+const PURPOSE_STRING_KEYS = [
+  ["NSCameraUsageDescription",                       "Camera"],
+  ["NSMicrophoneUsageDescription",                   "Microphone"],
+  ["NSPhotoLibraryUsageDescription",                 "Photo Library"],
+  ["NSPhotoLibraryAddUsageDescription",              "Photo Library Add"],
+  ["NSLocationWhenInUseUsageDescription",            "Location (When In Use)"],
+  ["NSLocationAlwaysAndWhenInUseUsageDescription",   "Location (Always)"],
+  ["NSLocationAlwaysUsageDescription",               "Location (Always - Legacy)"],
+  ["NSContactsUsageDescription",                     "Contacts"],
+  ["NSCalendarsUsageDescription",                    "Calendars"],
+  ["NSRemindersUsageDescription",                    "Reminders"],
+  ["NSBluetoothAlwaysUsageDescription",              "Bluetooth"],
+  ["NSBluetoothPeripheralUsageDescription",          "Bluetooth Peripheral"],
+  ["NSHealthShareUsageDescription",                  "HealthKit Share"],
+  ["NSHealthUpdateUsageDescription",                 "HealthKit Update"],
+  ["NSMotionUsageDescription",                       "Motion"],
+  ["NSSpeechRecognitionUsageDescription",            "Speech Recognition"],
+  ["NSFaceIDUsageDescription",                       "Face ID"],
+  ["NSLocalNetworkUsageDescription",                 "Local Network"],
+  ["NSUserTrackingUsageDescription",                 "App Tracking Transparency"],
+  ["NSSiriUsageDescription",                         "Siri"],
+  ["NSAppleMusicUsageDescription",                   "Media Library"],
+  ["NSHomeKitUsageDescription",                      "HomeKit"],
+  ["NFCReaderUsageDescription",                      "NFC"],
+  ["NSNearbyInteractionUsageDescription",            "Nearby Interaction"],
+  ["NSSensorKitUsageDescription",                    "SensorKit"],
+  ["NSWorldSensingUsageDescription",                 "World Sensing"],
+  ["NSHandsTrackingUsageDescription",                "Hand Tracking"],
+];
+
+const VAGUE_PHRASES = ["need access", "requires access", "needs permission", "this app needs"];
+
+export function check(ctx) {
+  const violations = [];
+  const plist = ctx.infoPlist || {};
+
+  // Required keys
+  if (plist.CFBundleIdentifier == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.ERROR,
+      message: "CFBundleIdentifier is missing", file: "Info.plist",
+    }));
+  }
+  if (plist.CFBundleShortVersionString == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.ERROR,
+      message: "CFBundleShortVersionString is missing", file: "Info.plist",
+    }));
+  }
+  if (plist.CFBundleVersion == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.ERROR,
+      message: "CFBundleVersion is missing", file: "Info.plist",
+    }));
+  }
+  if (plist.CFBundleDisplayName == null && plist.CFBundleName == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.3.7", severity: Severity.WARNING,
+      message: "Neither CFBundleDisplayName nor CFBundleName is set", file: "Info.plist",
+    }));
+  }
+
+  // App name length (Apple App Store ≤30 chars)
+  const displayName = (plist.CFBundleDisplayName ?? plist.CFBundleName);
+  if (typeof displayName === "string" && displayName.length > 30) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.3.7", severity: Severity.ERROR,
+      message: `App name '${displayName}' exceeds 30 character limit (${displayName.length} chars)`,
+      file: "Info.plist",
+      suggestion: "Shorten the app name to 30 characters or fewer",
+    }));
+  }
+
+  // Purpose strings - empty / vague checks
+  for (const [key, framework] of PURPOSE_STRING_KEYS) {
+    const value = plist[key];
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed === "") {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+        message: `${key} (${framework}) is present but empty`,
+        file: "Info.plist",
+        suggestion: `Provide a meaningful description explaining why your app needs ${framework} access`,
+      }));
+      continue;
+    }
+    const lowered = value.toLowerCase();
+    if (VAGUE_PHRASES.some((p) => lowered.includes(p)) && value.length < 50) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+        message: `${key} (${framework}) has a vague description: "${value}"`,
+        file: "Info.plist",
+        suggestion: `Provide a specific, user-facing explanation of why ${framework} access is needed`,
+      }));
+    }
+  }
+
+  // ATS - flag NSAllowsArbitraryLoads = true
+  const ats = plist.NSAppTransportSecurity;
+  if (ats && ats.NSAllowsArbitraryLoads === true) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.WARNING,
+      message: "NSAllowsArbitraryLoads is set to true - disables App Transport Security",
+      file: "Info.plist",
+      suggestion: "Use NSExceptionDomains for specific domains instead of disabling ATS entirely",
+    }));
+  }
+
+  // Minimum deployment target - only flag <iOS 13
+  if (typeof plist.MinimumOSVersion === "string") {
+    const major = parseInt(plist.MinimumOSVersion.split(".")[0], 10);
+    if (Number.isFinite(major) && major < 13) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "2.1", severity: Severity.WARNING,
+        message: `MinimumOSVersion is ${plist.MinimumOSVersion} - iOS 13+ is recommended for modern API support`,
+        file: "Info.plist",
+      }));
+    }
+  }
+
+  // UIRequiredDeviceCapabilities (info - not always required)
+  if (plist.UIRequiredDeviceCapabilities == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.INFO,
+      message: "UIRequiredDeviceCapabilities not set",
+      file: "Info.plist",
+      suggestion: "Consider specifying required device capabilities",
+    }));
+  }
+
+  // Launch storyboard or UIApplicationSceneManifest (modern apps need at least one)
+  if (plist.UILaunchStoryboardName == null && plist.UIApplicationSceneManifest == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.1", severity: Severity.WARNING,
+      message: "No UILaunchStoryboardName or UIApplicationSceneManifest found",
+      file: "Info.plist",
+      suggestion: "A launch storyboard is required for all modern iOS apps",
+    }));
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/ipv6-compliance.js

@@ -0,0 +1,101 @@
+/**
+ * ipv6-compliance - Apple Guideline 2.5.5 (apps must work on IPv6-only networks).
+ * Direct port of IPv6ComplianceRule.swift.
+ *
+ * Scans the executable's printable strings for:
+ *   - Hardcoded IPv4 literals (filtered to drop version strings + loopback)
+ *   - Legacy networking APIs that bypass system DNS (gethostbyname, etc.)
+ *   - Raw socket APIs that don't auto-handle IPv6
+ */
+
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "ipv6-compliance";
+export const name = "IPv6 Compliance";
+export const description = "Scans binary for hardcoded IPv4 addresses and non-IPv6-compatible networking patterns";
+
+const LEGACY_NETWORK_APIS = [
+  "inet_addr", "inet_aton", "inet_ntoa",
+  "gethostbyname", "gethostbyaddr",
+  "getaddrinfo",
+];
+
+const RAW_SOCKET_APIS = [
+  "SCNetworkReachabilityCreateWithAddress",
+  "CFSocketCreate",
+  "CFStreamCreatePairWithSocketToHost",
+];
+
+const IPV4_REGEX = /\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/g;
+
+function isRealIP(ip) {
+  const octets = ip.split(".").map((o) => parseInt(o, 10));
+  if (octets.length !== 4 || octets.some((o) => Number.isNaN(o) || o < 0 || o > 255)) return false;
+  if (ip === "0.0.0.0" || ip === "127.0.0.1") return false;
+  // Skip version-like strings (all octets < 20 is almost certainly "1.0.0.0", "2.3.0.0", etc.)
+  if (octets.every((o) => o < 20)) return false;
+  return true;
+}
+
+export function check(ctx) {
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return [];
+
+  let stringsOutput = "";
+  try {
+    stringsOutput = execSync(`/usr/bin/strings "${ctx.executablePath}"`, {
+      encoding: "utf-8",
+      maxBuffer: 256 * 1024 * 1024,
+    });
+  } catch {
+    return [];
+  }
+
+  const violations = [];
+
+  // 1. Hardcoded IPv4 addresses
+  const ipMatches = new Set();
+  let m;
+  while ((m = IPV4_REGEX.exec(stringsOutput)) !== null) {
+    if (isRealIP(m[1])) ipMatches.add(m[1]);
+  }
+  if (ipMatches.size > 0) {
+    const sample = [...ipMatches].slice(0, 5).join(", ");
+    violations.push(makeViolation({
+      ruleID: id,
+      guidelineRef: "2.5.5",
+      severity: Severity.WARNING,
+      message: `Found ${ipMatches.size} hardcoded IPv4 address(es): ${sample}`,
+      suggestion: "Use hostnames instead of hardcoded IP addresses to ensure IPv6 compatibility",
+    }));
+  }
+
+  // 2. Legacy networking APIs
+  for (const api of LEGACY_NETWORK_APIS) {
+    if (stringsOutput.includes(api)) {
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.5.5",
+        severity: Severity.INFO,
+        message: `Binary references legacy networking API: ${api}`,
+        suggestion: "Use URLSession or NWConnection for IPv6-compatible networking",
+      }));
+    }
+  }
+
+  // 3. Raw socket APIs
+  for (const api of RAW_SOCKET_APIS) {
+    if (stringsOutput.includes(api)) {
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.5.5",
+        severity: Severity.WARNING,
+        message: `Binary uses low-level socket API: ${api} - may not work on IPv6-only networks`,
+        suggestion: "Use NWConnection or URLSession which handle IPv6 automatically",
+      }));
+    }
+  }
+
+  return violations;
+}