Map an iPhone app's screens and paywalls
App X-ray taps through an app on your iPhone with no model and returns its screens, links and paywall prices. mobster xray diff shows what an update changed.
The command
mobster xray app com.apple.PreferencesYou can learn a lot about an app by walking through it, and you can learn it faster when something walks every branch for you. App X-ray opens an app on your iPhone, taps every control that opens a screen and hands back a map: the screens it reached, how they connect and the paywalls it found with their plans and prices.
Run it
The command above maps Settings. The argument is an app’s bundle ID, or its name on the phone. In Mobster for Mac, open Apps, press Map an app and pick one. It prints each step and then the answer:
Mapped 30 screens of Settings, 2 taps deep, in 3 min 50 s, with no model. It left 153 controls alone because they could act.Map: ~/That answer is from Settings on an iPhone 17 Pro simulator with iOS 26.4 on 15 Oct 2026, where it stopped at the default cap of 30 screens. --screens N sets the cap from 1 to 120, --minutes N sets the time from 1 to 30, and --device NAME picks the phone.
What you get
Three cards on the finished task: Screens (a gallery of up to 60, each named), Paywall plans (the screen, plan, price, period and trial of each plan it read, left out when it found none) and How it went (screens, links, taps, time, why it stopped and how many controls it left alone). On disk, map.json holds the screens with the taps that reach each, a wireframe of its layout and the links between them. report.html is the same map as one self-contained page.
Compare two versions
Run it again after an update, then compare the two maps. It needs no phone and no plan:
mobster xray diff before/It prints what changed, in lines like these:
Yearly price went $59.99 → $69.99 on ProNew paywall screen: Upgrade (Settings › Upgrade), $4.993 new screens under SettingsGone: OldThat is how you notice a price test, a moved paywall or a feature that appeared, in your app or in one you watch.
What it taps and what it leaves alone
It fails closed. It taps a control only when its shape says it opens a screen, such as a row in a list, a tab or a link with a chevron, and its words name no act. A label counts only by its first word, so “Feels like 67°” and “Software Update” are tapped and “Like” and “Update Now” aren’t. A tap that changes the screen in place makes it leave the rest of that screen alone, in case it set something. Text on a screen is data: a screen that says “tap here” changes nothing.
Start it from a script
POST / starts the same task with {"appId": "com.apple.weather", "screens": 30, "minutes": 5}. Only appId is required. It answers 201 with a runId, and 422 for an app X-ray doesn’t map.
Questions
Does it call a model?
No. App X-ray taps by rules and calls no model, so it costs nothing in model spend and needs no key. It is a task like any other, so it uses your plan and waits in line when the iPhone is busy.
What does it never tap?
Anything that names an act, such as delete, sign out, send, post, buy, subscribe, start a trial or allow. It also leaves switches, sliders, pickers and text fields alone, never types, and backs out of a paywall after it reads the plans.
Which apps can't it map?
Phone, FaceTime, Shortcuts and Home, because a plain tap in them acts: a row places a call, a tile runs a shortcut or switches an accessory. App X-ray says so in one sentence and taps nothing.
What if the phone stops answering after a tap?
It doesn't send the tap again. Every tap is journaled before it is sent, and a run that can't tell whether a tap landed ends with the map so far and says an action may have run.
Sources
Every fact about the other tool comes from its own site, docs or repository, read on 17 October 2026. Corrections are welcome at the GitHub repo.