MacOS MCP

Name: MacOS MCP
Author: CursorTouch

@google/gemini-cli · by CursorTouch

Lightweight MCP server for computer use in MacOS

122 488.1k/wk GitHub npm PyPI

No known CVEs

MIT license

Actively maintained

Last commit 5d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

MCPpedia last refreshed this data 1d ago

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "macos-mcp": {
      "url": "https://<host>:8000/mcp/",
      "type": "http",
      "oauth": {
        "clientId": "my-client",
        "clientSecret": "my-secret"
      }
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/macos-mcp)](https://mcppedia.org/s/macos-mcp)

Read me

What MacOS MCP does

macOS-MCP is a lightweight, open-source Model Context Protocol server that bridges AI agents and the macOS operating system. It enables seamless automation of macOS through LLMs via tasks such as file navigation, application control, UI interaction, browser automation, and system operations.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@google/gemini-cli' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

66/100across 5 weighted dimensions

How we score →

0255075100

−34

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

7 fixed

CVE-2025-54368info · fixed

uv allows ZIP payload obfuscation through parsing differentials

## Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. The attacker could choose which installer to target

Affected: >= 0Fixed in 0.8.6source →

GHSA-4gg8-gxpx-9rphinfo · fixed

uv is vulnerable to arbitrary file write through entry point names

### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under `console_scripts` or `gui_scripts`), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's `PATH`. This could shadow or overwr

Affected: >= 0Fixed in 0.11.15source →

CVE-2026-12537critical · fixedCVSS 10

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

# Summary Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive (headless) environments handle folder trust, which may impact existing CI/CD workflows under specific conditions. # Details Folder Trust in Headless Mode In previous versions, Gemini CLI running in CI environmen

Affected: >= 0Fixed in 0.39.1source →

GHSA-wpqr-6v78-jr5gcritical · fixedCVSS 10

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Affected: >= 0Fixed in 0.39.1source →

GHSA-pjjw-68hj-v9mwinfo · fixed

uv vulnerable to arbitrary file deletion through RECORD entries

## Impact Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall. uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall. uv does not use the RECORD fi

Affected: >= 0Fixed in 0.11.6source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is MacOS MCP safe to use?: MacOS MCP has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install MacOS MCP?: MacOS MCP supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with MacOS MCP?: MacOS MCP is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is MacOS MCP actively maintained?: MacOS MCP is actively maintained — last commit was 5 days ago. It has 122 GitHub stars.

Similar servers

Others in other

View all →

Pi Lean Ctx95

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.3k 6

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

60.9k 3

Brigade93

One local source for the MCP servers, tools, and memory your AI coding agents share, synced into each tool's native config with a review gate and a receipt for every change. No daemon, no lock-in.

60 5

Sigmap92

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

598 6

MCP Security Weekly

Get CVE alerts and security updates for MacOS MCP and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "mcpServers": { "macos-mcp": { "url": "https://<host>:8000/mcp/", "type": "http", "oauth": { "clientId": "my-client", "clientSecret": "my-secret" } } } }

Frequently Asked Questions

Is MacOS MCP safe to use?

MacOS MCP has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install MacOS MCP?

MacOS MCP supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with MacOS MCP?

MacOS MCP is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is MacOS MCP actively maintained?

MacOS MCP is actively maintained — last commit was 5 days ago. It has 122 GitHub stars.