macOS 27 Golden Gate, Safari 27 and AI agents

Safari 27 brings Apple's MCP server to a stable Mac.

safaridriver --mcp has been available in Safari Technology Preview and the Safari 27 betas. When macOS 27 ships , Safari 27 goes out with it, and Apple's browser MCP lands on ordinary Macs by default rather than on machines someone deliberately put a preview build on. That is the single most consequential thing in this release for anyone running agents.

It exposes 17 tools: console logs, network requests, DOM interaction, screenshots, JavaScript evaluation, tabs, and viewport and media emulation. It is local-only, it touches no personal data, and it needs Allow Remote Automation switched on in Safari's developer settings — sudo safaridriver --enable does that with no GUI. Before that switch, the server still serves all 17 tools and every session-creating call fails with Apple's own typed error, which macos-mcp proxies back verbatim rather than dressing up.

macos-mcp mounts that server at boot and re-exports its tools verbatim as web_*, behind the same permission profiles, confirmation tokens and audit log as everything else: mount what Apple ships, never reimplement it. Where Safari 27 is not present, the same slot is filled by an AppleScript fallback — five tools, web_navigate, web_current_tab, web_page_text, web_tabs and web_select_tab — and every result it returns carries method: "fallback", because the two are not equivalent: no WebDriver session, no element interaction, no JavaScript evaluation. Exactly one of the two stacks is ever registered under the web toolset, so an agent never has to ask which one answered. The web tools →

Apple ships an MCP for Safari and one for Xcode. Nothing for the Mac.

Both of Apple's servers are developer-tool servers. Neither can click a button in Finder, read a Calendar, type into TextEdit, screenshot a window, run a Shortcut, or hand an agent a Mac it is allowed to destroy. That is not a criticism — it is the shape of the products they belong to, and it is why this project exists: mount what Apple ships, cover everything Apple does not, and put one permission model over all of it.

The Xcode half is stated the way it was measured. The gateway mounts xcrun mcpbridge exactly as it mounts Safari, but Xcode's per-agent consent dialog does not appear for third-party agent processes: probed by hand, initialize answers and tools/list then never does. So xcode_* is not advertised as working, and a test watches Xcode's served tool list so a future fix fails loudly instead of waiting to be noticed.

What the macOS 27 betas actually did.

This project's own numbers, each with the beta build recorded beside it, and the prototype code that produced them is in the repository under knowledge/.

• Two macOS VMs per host, and it is a kernel quota. On build 26A5388g, 2026-07-29, VM #1 and VM #2 ran concurrently and VM #3 was refused instantly at start with VZErrorDomain code 6 — while 39% of host RAM was still free. Bigger hardware cannot raise it. Linux guests are unaffected. Fleet capacity is hosts x 2, and that arithmetic is a scheduler input rather than a footnote. Disposable macOS VMs →
• A macOS guest renders nothing without a logged-in host session. Verified byte-for-byte: headless, host-locked and lost-WindowServer all produce an all-zero framebuffer, in-guest screencapture fails, and no IODisplayWrangler appears in the guest's ioreg. A locked host is a global kill switch for every VM display on the machine, and pgrep catches none of it — every failure looked like a healthy process.
• The eval suite scored 100% on a macOS 27 beta. On build 26A5425a, 2026-09-06: 100% (5/5) agent-driven, the mean of three runs, and 100% (9/9) scripted, on a TCC-granted Mac. That report is what /evals/latest.json publishes, and the endpoint refuses a run that never genuinely completed, so the date on it is always the honest one.
• The integration tier ran on macOS 27 too — real TextEdit and Finder windows driven through the accessibility engine, on beta hosts 26A5388g and 26A5425a — and the Safari mount was proved end to end through the gateway: navigate, page content, screenshot, all through Apple's tools.
• One macOS 27 defect found the hard way. Measured on 26A5425a: AppleScript sent from a secondary thread stalls about 30 seconds per target app while the main thread spins a CFRunLoop — 31.8 s for a first tell application "Finder", against 0.06 s with the main thread parked normally. The fix was a helper process. Worth knowing before you blame the Mac.

The GA build gets re-verified as soon as it is available . Until that run exists, the numbers above keep their beta build numbers, because a score that did not genuinely run is not a score.

Upgrading a Mac that runs agents.

1. Upgrade macOS as usual. macos-mcp is one signed, notarized, audited binary with no runtime; Gatekeeper's verdict does not change with the OS version.
2. Expect your grants to survive. Accessibility and Screen Recording attach to the app that hosts the agent — your terminal or MCP client — not to the binary, and they normally carry across an upgrade.
3. Run macos-mcp doctor anyway. If a grant was reset, doctor names it and prints the System Settings deep-link that opens the right pane.
4. Restart the client after any re-grant. Screen Recording binds only to processes started after it, so a re-granted client that was never restarted will keep failing in a way that looks like a bug.
5. If you use the web toolset, turn on Allow Remote Automation in Safari 27 and macos-mcp mounts Apple's server on the next start. Without it, the AppleScript fallback serves the same tool names with method: "fallback" — degraded, and labelled.

Nothing in the tool surface depends on a macOS 27-only API. Every toolset sits on APIs that exist on macOS 15, which is why 44 tools, 24 on by default means the same thing before and after the upgrade. The macOS 27-only pieces — DiskImageKit, guest provisioning — live in the VM CLI, not in the MCP tools. And on hardware: macOS 27 is Apple Silicon-only, and macos-mcp has been arm64-only since its first commit, so the platform requirement removes a question rather than adding one.

Where to go next

Every action is read back, never assumed: a write that changed nothing is a typed error, not a green check — the same on macOS 27 as on macOS 15.

macOS 27 questions people actually ask.