macos-apps-mcp

One local MCP server for Mail, Calendar, Reminders, Notes, Messages, Contacts, Photos, Safari, Music and Shortcuts on macOS. Searches and lists return pointers: an id, a one-line summary and a link that opens the item in its app. Bodies are a separate, capped fetch. Writes are tiered and audited; deletes, moves and sends preview first. macOS only. Python + FastMCP + uv. See DESIGN.md and CHANGELOG.md.

What you can ask

• "What is on my calendar this week? When am I free on Thursday afternoon?"
  _{events, free_busy}
• "Which emails need a reply? Draft a reply to the first one."
  _{mail_needs_response, mail_reply. The reply opens as a draft in Mail. It is not sent.}
• "Move the newsletters in my inbox to Archive. Show me first."
  _{mail_search, move_mail, mail_undo. The move previews by default. mail_undo reverses it, within the known limits below.}

Safety and privacy

• Local. No telemetry, and no network requests of its own: only a local unix socket (shim to daemon) and the dashboard on 127.0.0.1. Three tools reach past the Mac through the apps, when called: the send tools (off by default) send through Mail, safari_open opens a page, and run_shortcut runs a Shortcut that can call the web.
• Three tiers. Read, write and outbound. Send tools are absent until you enable them per app: macos-apps-mcp allow-send mail (daemon) or MACOS_APPS_ALLOW_SEND=mail (stdio). MACOS_APPS_READ_ONLY=1 registers reads only and wins over both.
• Dry run first. dry_run defaults to true for delete_draft, move_mail, trash_mail, mail_undo, send_mail, reply_all, forward_mail, delete_reminder, delete_event, delete_note and update_note. Other writes act when called. mail_reply opens a draft only.
• Audit log. Every write goes to ~/.local/state/macos-apps-mcp/audit.jsonl (under $XDG_STATE_HOME when set). An update or delete by id also records the item as it was. The audit tool reads the log back.
• Mail recovery. Before a Mail move or delete, each message is copied as .eml under ~/.local/state/macos-apps-mcp/backup/mail/. mail_undo reverses the batch. No tool empties the Trash.
• Known limits. A message Mail downloaded only in part is backed up without its attachments. Moves and trashes through a Gmail label folder are refused, because Gmail reverts them about 2 minutes later. sent: true means Mail accepted the message, not that it was delivered. All Mail facts.
• Dashboard. Under the signed .app daemon, a local page (127.0.0.1 only) shows every write, what it changed, and the backup behind each Mail batch. Invented data below:

First 5 minutes

Requires macOS, Python ≥ 3.12 and uv. uv provides uvx. The package is on PyPI. Point your MCP client at uvx

... View full README on GitHub