Give your AI agent a Mac.

An MCP (Model Context Protocol) server exposes tools that an AI client such as Claude Code, Claude Desktop, Cursor, VS Code or Codex can call. macos-mcp is an MCP server that exposes the Mac itself: the accessibility tree of every app, clicks, typing, scrolling, keyboard shortcuts, windows, screenshots, OCR, the clipboard, AppleScript recipes, Spotlight, files, Calendar, Reminders, Contacts, Shortcuts, Safari, and a mirrored iPhone. Your agent gets 44 typed tools and every result is structured JSON.

Any MCP client that speaks stdio. macos-mcp install --client registers it with Claude Code, Claude Desktop, Cursor, VS Code and Codex in one command, merging into the client's config and backing up what was there. Other clients get the same one-line stdio entry: macos-mcp serve.

The two default grants are Accessibility (for the ui_* tools) and Screen Recording (for screenshot, ocr and screen_find). Calendar, Reminders and Contacts prompt on first use; scripting another app asks for Automation. Grants attach to the app hosting the agent, not the binary. macos-mcp doctor lists what is missing and prints the exact System Settings deep-link to fix it.

macos-mcp is built around that question. Secure text fields are never read and never typed into. The readonly profile refuses anything that is not pure observation; under the default standard profile a destructive tool first returns a one-shot confirmation token bound to that exact call. Every call is appended to an audit log with its arguments digested, never stored raw. Keychain, system authentication dialogs and TCC are hard lines that are never crossed. Nothing phones home.

Yes. macos-mcp targets macOS 15 and later on Apple Silicon, and its integration and agent-eval tiers ran on the macOS 27 betas. Safari 27 ships Apple's own Safari MCP server, which macos-mcp mounts and re-exports verbatim as web_* tools where it is available.

Those are specialists: Peekaboo is screen capture and input, XcodeBuildMCP is Xcode builds and simulators, apple-mcp (archived January 2026) was Apple's PIM apps. macos-mcp covers the whole Mac behind one signed binary, verifies every effect instead of trusting a return code, adds a permission and audit model none of them have, and includes a migration map for apple-mcp's tools.

No. There is no telemetry, no analytics and no update check inside the binary. The only network activity is what a tool you call does, such as opening a URL in Safari.

Safari: yes. Where Apple's Safari MCP server is available (Safari 27 or Safari Technology Preview with remote automation on) its 17 tools are re-exported verbatim as web_*; everywhere else the same tool names are served by an AppleScript fallback that labels every result method: fallback. Xcode: the gateway is built, but Xcode's consent dialog currently never appears for third-party agent processes, so the Xcode mount is not shipped as working yet.

Yes — the ios toolset shipped in v0.2.0. Its eight tools drive a real iPhone through the iPhone Mirroring window: read the phone's screen, find text on it with OCR, then tap, swipe, type, and press home, app switcher, Spotlight, back and lock. The mirrored content is an opaque video surface with no accessibility tree, so iphone_find is the primary locator rather than a fallback, and coordinates are the phone's own device points instead of screen pixels — a target survives a window resize, a different Mac, and a transcript replayed tomorrow. Every mutating call captures the phone before and after and returns a typed action_unverified when the screen did not change, never a false success; iphone_type is the honest exception, reporting verification.method "none" because iOS hides the keyboard while mirroring and nothing on the Mac can read the field back. The toolset is off by default: enable_toolset turns it on. It needs iPhone Mirroring itself — iOS 18 or later, the same Apple Account on both devices, the iPhone locked and nearby — and Apple does not make iPhone Mirroring available in the EU.

On a single host, yes, today. macos-mcp vm is a CLI subcommand group — not MCP tools, so the tool surface is unchanged — that clones a golden macOS image into a throwaway guest on Apple's Virtualization.framework, runs it in a window on this Mac's console session, captures it host-side, and deletes it: list, clone, start, stop, destroy, status, screenshot, ip, input, grant, verify. A clone is an APFS clonefile with a regenerated machine identifier and its own MAC and auxiliary storage, so it is instant and costs no disk until it diverges. The accessibility and screen-recording grants are solved once per golden image and inherited by every clone, and vm verify is the per-clone acceptance check that needs no human in the guest. Two macOS VMs per Apple Silicon host is a measured kernel quota rather than a limit we chose: the third is refused with VZErrorDomain code 6 while 39% of RAM is still free, so more RAM never helps. What is not shipped is the hub that routes a machine parameter across many hosts — designed, prototyped and measured, but not released.

Delete the binary (/usr/local/bin/macos-mcp by default), remove ~/.macos-mcp (config and the audit log), and remove the macos-mcp entry from your client's MCP config — install backed the previous config up next to it. Revoke the Accessibility and Screen Recording grants for your terminal or client in System Settings if you no longer want them.