Codex iOS App Plugin: What Does the CFA AI Toolkit Install on Your Mac, and Does It Send Your Code Anywhere?
Updated: 6 days ago
The short answer
The free, open-source CFA AI Toolkit for iOS installs as a Codex plugin that stays on your Mac. Its own privacy notes say the installer and dashboard "do not send telemetry, upload source, fetch packages, or contact a developer server", and that the plugin "has no MCP server, hooks or network connector." It copies files into a few named folders, adds a small cfa command, and leaves your app's source alone. The one thing to remember: when you ask the AI to review your code, your chosen AI provider may process that code, so check its data settings before you point it at a private project.
💡 What this article covers
What CFA is, exactly what the Codex plugin puts on your Mac, what does and doesn't leave your computer, how to check a download, and how to update or remove the toolkit cleanly.
What is CFA?
CFA stands for Cooperative Feature Architecture. It's a blueprint for laying out an iOS app in Xcode so every kind of code has one obvious home: Views draw the screen, ViewModels hold screen state, Features own the rules, and repositories handle storage. It isn't a library you add to your app. You build with Apple's own frameworks, such as SwiftUI and Swift Concurrency.
The CFA AI Toolkit for iOS packages those rules as eight AI skills, Xcode project templates and a local Xcode Project Dashboard, so tools like Codex and Claude Code build iOS apps the CFA way. It's MIT-licensed and free.
Why ask what a plugin installs?
Because an AI plugin sits right next to your source code. If you're building an app for a client, or an idea you haven't announced yet, it's fair to want to know what you're adding to your Mac before you add it. The good news is that the toolkit writes this down in plain terms, in its installation guide and its privacy notes. Everything below comes from those two documents.
What does the Codex plugin install on my Mac?
You download the plugin zip from the repository's releases page, extract it and double-click Install.command, or run the same installer from Terminal:
node scripts/install.mjs
According to the installation guide, the installer then does five things:
Checks the package's checksum inventory, so a damaged or edited download is caught.
Copies the complete plugin to ~/plugins/ios-app-development-cfa.
Adds itself to your personal ~/.agents/plugins/marketplace.json, keeping anything already listed there.
Runs codex plugin add, so Codex can find the skills.
Adds a cfa Terminal command in ~/.local/bin.
The guide is just as clear about what it doesn't do: "No source app is changed and no software is downloaded." It needs Node.js 20 or newer, and on a Mac Install.command can use Codex's own runtime when Node isn't installed. There are no npm packages to fetch.
Does the toolkit send my code anywhere?
The toolkit itself doesn't. The privacy notes say the installer "writes only the selected installation and personal marketplace locations, then optionally invokes the installed Codex CLI." There's no tracking, no upload and no server of its own to talk to. It also ships with no API keys, no login details and no user data.
Your AI tool is a different matter, and the toolkit is honest about it. When you ask for an AI-guided review, the work is done by "the chosen agent and model provider", and "source may be processed by that provider." Codex, Claude Code or any other host follows its own policies. So the sensible habit is simple: before you open a private project, read your AI tool's data controls, just as you would without the toolkit.
Will it change my Xcode project?
Not unless you ask an AI to change it. The pieces that look at your project are built to read, not write:
cfa inspect is a read-only map of which screen talks to which ViewModel and feature, and which tests exist. The README says it flags missing links "without changing the project."
cfa dashboard runs locally and "does not edit your application." It does create a new timestamped dashboard folder inside the project folder you scan, so you'll see that appear.
cfa enable-project is optional. It appends a short, marked block of CFA guidance to your AGENTS.md (or CLAUDE.md with --host claude) and doesn't touch Swift source.
The Xcode templates install into your personal Xcode Templates folder only. The guide says the template installer "never changes an existing app."
One thing worth knowing about the dashboard: its HTML and JSON reports include source excerpts and file paths. The privacy notes suggest keeping them local unless you mean to share those details. If your project is in Git, check you aren't committing a report by accident.
How do I know the download is genuine?
Each release comes with a SHA256SUMS file, so you can compare the digest of the zip you downloaded with the published one. On a Mac that's one line in Terminal (use the real file name of the release you downloaded):
shasum -a 256 ios-app-development-cfa-<version>-plugin.zip
Inside the package, checksums.json lets the installer spot files that changed after extraction. The guide is careful to say these are integrity checks, "not publisher signatures", so always download from the official repository. The package also isn't an Apple-signed or notarised installer. If macOS asks you to approve the downloaded script, the guide's advice is to inspect it and run the Terminal command instead.
What happens when I update it?
Updates are deliberately cautious. Opening Install.command again requests a protected replacement of the existing CFA installation. In Terminal, you run the installer from the new release with --replace. Either way, it only replaces a CFA-managed installation you haven't edited, and it keeps the previous copy beside it as a .backup folder. If you've changed the files, or a folder with the same name came from somewhere else, it refuses and asks you to move them aside yourself. It never silently deletes your edits.
How do I check it worked?
Open a new Codex conversation and ask, in the README's words:
I have installed CFA AI Toolkit for iOS from
https://github.com/3DaysOfSwift/CFA-AI-Toolkit-for-iOS.
Do you have access to create and maintain iOS projects with CFA?
You can also run cfa doctor in Terminal to confirm the installed skills and any project guidance. If Terminal says it can't find cfa, the guide's fix is to add ~/.local/bin to your path once and open a new Terminal window:
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zprofile
How do I remove it?
For the Codex plugin, the guide gives one command (swap personal for the marketplace name the installer printed, if it was different):
codex plugin remove ios-app-development-cfa@personal
That switches the plugin off in Codex. The copied files and marketplace entry stay so you can reinstall later; delete them yourself when you're sure you don't need them.
What about Claude Code and other tools?
If you use Claude Code, or another tool that reads portable skill folders, the same installer copies the eight skills into that tool's skills folder instead:
node scripts/install.mjs --mode skills --skills-directory ~/.claude/skills
Swap ~/.claude/skills for your tool's folder if it's different. To remove them, delete only the eight folders the installer printed, keeping any edits you want first. One note: the cfa command comes with the Codex plugin install and may be missing from a skills-folder-only install. The skills still work without it. The guide also notes that copying files isn't a promise that every AI product discovers local skills, so use a tool that documents skill-folder support.
Key takeaways
The CFA AI Toolkit's installer and dashboard send no telemetry, upload no source and contact no developer server.
The Codex plugin has no MCP server, hooks or network connector. It copies files to named folders and adds the cfa command.
Your AI provider may process your source during an AI-guided review, so check its data controls for private projects.
Dashboard reports contain code excerpts and file paths. Keep them local unless you mean to share them.
Check downloads with SHA256SUMS, update with the protected --replace path, and remove it with codex plugin remove.
Is the CFA AI Toolkit free?
Yes. It's open source under the MIT licence, so you can use, change and share it, including in commercial apps.
Related articles
About Us
3 Days of Swift Concurrency is created by Matthew Thomas, an iOS developer building in public since 2022. He publishes the free, MIT-licensed CFA AI Toolkit for iOS and reference apps on GitHub. Visit 3DaysOfSwiftConcurrency.com to follow along. The paid training programme is still being built: a soft launch is targeted for 1 December 2026, but that date depends on deadlines being met and isn't guaranteed.
Comments