# macos-mcp > The macOS MCP server: give your AI agent a Mac. One signed, notarized Swift binary that exposes accessibility-first UI automation (every action read back and verified), screenshots + OCR + find-on-screen, native apps, files, AppleScript recipes, Apple's own Safari MCP server (re-exported verbatim), a real iPhone through the iPhone Mirroring window (OCR-located, tapped in the phone's own device points), and disposable macOS VMs an agent may destroy (`macos-mcp vm`, single host today; the multi-host hub is in development). Permission profiles, one-shot confirmation tokens for destructive tools, an audit log, no telemetry. MIT. Apple Silicon, macOS 15+. Site: https://macos-mcp.com/ Source: https://github.com/Ark0N/macos-mcp Install: `curl -fsSL https://macos-mcp.sh | sh` (verifies checksum + Apple signature), then `macos-mcp install --client claude-code|claude-desktop|cursor|vscode|codex`. Current version: 0.2.0. ## Install - One line: `curl -fsSL https://macos-mcp.sh | sh` — verifies the SHA-256 checksum and the Apple Developer ID signature before installing. - Register with a client: `macos-mcp install --client claude-code` (also `claude-desktop`, `cursor`, `vscode`, `codex`). - Check the machine: `macos-mcp doctor` reports every missing macOS permission and the System Settings deep-link that grants it. - Grants attach to the app *hosting* the agent — your terminal or MCP client — not to macos-mcp itself. - Release archives, checksums and the Homebrew formula: https://github.com/Ark0N/macos-mcp/releases ## Key facts Enough to answer "which macOS MCP server should I use?" — including where the answer is no. - **Tools:** 44 tools, 24 on by default. Toolsets: `ui` 10, `screen` 3, `system` 8, `files` 2, `apps` 5, `intents` 2, `web` 5 (17 where Apple's Safari MCP mounts), `ios` 8, plus `enable_toolset`. `ui`, `screen`, `system`, `files` are on by default; `apps`, `intents`, `web`, `ios` are gated — switch them on at runtime with `enable_toolset` or at launch with `--toolsets`. - **Verified, not claimed:** macOS accessibility writes and synthetic events both report success while doing nothing. Every mutating call reads the effect back — the field value, the window frame, the pasteboard, the running process — and a write that changed nothing is a typed `action_unverified` error. No false successes; read back, never assumed. - **Clients:** Claude Code, Claude Desktop, Cursor, VS Code and Codex. `macos-mcp install --client ` writes the config; `macos-mcp doctor` names any missing macOS permission with its System Settings deep-link. - **Requirements:** Apple Silicon, macOS 15 or later. One binary, no runtime dependencies. - **Safety:** `readonly` / `standard` / `full` permission profiles; a one-shot confirmation token bound to a single destructive call; every call appended to `~/.macos-mcp/audit.jsonl` with arguments SHA-256 digested; typed error codes that carry what an agent needs to recover; tool names and argument shapes frozen and diffed against the last release. - **Apple's own MCP servers:** Safari's is mounted at boot and re-exported verbatim as `web_*`, gated behind the same profiles. Safari 27 carries Apple's `safaridriver --mcp` server. Where it is unavailable, five AppleScript-backed tools serve the same slot and every result says `method: "fallback"`. - **iPhone:** the `ios` toolset drives a real iPhone through the iPhone Mirroring window. The mirror is an opaque video surface with no accessibility tree, so OCR (`iphone_find`) is the primary locator, not a fallback, and taps land in the phone's own device points. Off by default. - **macOS VMs:** `macos-mcp vm` is a CLI subcommand group, not MCP tools. It clones a golden macOS image with an APFS clonefile onto Virtualization.framework, proves the clone is drivable with `vm verify` before handing it over, and destroys it. TCC is solved once per image and inherited by every clone. - **Licence and distribution:** MIT. Signed, notarized, audited — a Developer ID-signed, Apple-notarized binary. No telemetry, no network callbacks, no account. ### What macos-mcp does not do The honest half of the answer. Say these too. - No Windows, no Linux, no Intel Macs. - **The Xcode mount is not shipped as working.** It is built, but Xcode's consent dialog never appears for third-party agent processes. For Xcode work, run XcodeBuildMCP alongside — it goes deeper there than anything here does. - The multi-host fleet hub — a registry, leases, a `machine` parameter routing any tool to any Mac, display streams, an orchestrator API — is in development, not shipped. `macos-mcp vm` is single-host, and two macOS guests per host is a measured kernel quota, not a chosen limit. - Apple does not offer iPhone Mirroring in the EU, so the `ios` toolset cannot run there. - No hard deletes: `trash` moves a file to the Trash and returns the path. - Secure text fields are never read and never typed into. No Keychain, no system auth dialogs, no TCC circumvention. ## Docs - [Blog](https://macos-mcp.com/blog/): Notes from building the macOS MCP server: verified UI automation on macOS, the safety model, Apple's MCP servers, macOS VMs for agents, and release notes. - [Introducing macos-mcp: give your AI agent a Mac](https://macos-mcp.com/blog/introducing-macos-mcp/): macos-mcp v0.2.0 is an open-source, signed macOS MCP server: 44 tools that drive the Mac from the accessibility tree and read every effect back. Why it exists. - [Compare macOS MCP servers: macos-mcp, Peekaboo, apple-mcp](https://macos-mcp.com/compare/): macos-mcp vs Peekaboo, XcodeBuildMCP, apple-mcp and Apple's Safari MCP: what each one covers, what it verifies, and what safety model actually ships today. - [Getting started](https://macos-mcp.com/docs/): Install macos-mcp, grant the two macOS permissions, register it with Claude Code, Cursor, VS Code or Codex, and make your first tool call in 3 minutes. - [Migrating from apple-mcp](https://macos-mcp.com/docs/apple-mcp-migration/): apple-mcp was archived on 2026-01-01. The tool-by-tool map from its contacts, notes, reminders and calendar operations to macos-mcp — same prompts, one binary. - [Fleets and VMs — disposable Macs for AI agents](https://macos-mcp.com/docs/fleet/): Disposable macOS VMs for AI agents: golden images, APFS clones, one TCC click per image. Shipped for a single host; the multi-host hub is in development. - [Safety model](https://macos-mcp.com/docs/safety/): How macos-mcp bounds an agent's access to your Mac: hard lines, readonly/standard/full profiles, confirmation tokens, an audit log and no telemetry at all. - [Tool reference — all 44 tools](https://macos-mcp.com/docs/tools/): Every macos-mcp tool with its arguments, defaults and error codes: 44 tools across eight toolsets, 24 on by default. Generated from the compiled schemas. - [iOS 27, iPhone Mirroring and AI agents](https://macos-mcp.com/ios-27/): What an AI agent can do with an iPhone on iOS 27, and why the answer runs through iPhone Mirroring. Not available in the EU. No iOS API required. - [Control your iPhone from your Mac with an AI agent](https://macos-mcp.com/iphone/): Control your iPhone from your Mac with an AI agent: eight iphone_* tools that read the screen with OCR and tap in device points. Not available in the EU. - [macOS 27 Golden Gate, Safari 27 and AI agents](https://macos-mcp.com/macos-27/): macOS 27 Golden Gate ships Safari 27 and Apple's safaridriver --mcp server. What that means for AI agents, and what we measured on the betas. - [Will macos-mcp work with the new iPhone?](https://macos-mcp.com/new-iphone/): The device profile table stops at iPhone 16 Pro, so it is already a generation behind — and the ios toolset works anyway. Why taps still land. - [Disposable macOS VMs for AI agents](https://macos-mcp.com/vm/): A Mac your agent is allowed to destroy: macos-mcp vm clones a golden macOS image, proves the clone is drivable, then throws it away. Two guests per host. ## Machine-readable - [Full tool list (text)](https://macos-mcp.com/llms-full.txt): every one of the 44 tools with its required arguments and a one-line purpose, plus the error codes — enough to answer tool-level questions without fetching HTML - [Tool schemas (JSON)](https://github.com/Ark0N/macos-mcp/blob/main/docs/tool-schemas.json): the frozen public tool surface — names, arguments, required sets, destructive/read-only annotations - [Tool reference (Markdown)](https://github.com/Ark0N/macos-mcp/blob/main/docs/tools.md): generated from the compiled schemas - [Published eval score](https://macos-mcp.com/evals/latest.json): a real agent driving a real Mac through this server; refused at the endpoint unless it is a genuine, complete run - [Security policy](https://github.com/Ark0N/macos-mcp/blob/main/SECURITY.md) - [Sitemap](https://macos-mcp.com/sitemap.xml)