macOS MCP Server

macos-mcp-server

A Model Context Protocol server that bridges AI agents to the macOS desktop: the accessibility tree, synthetic mouse and keyboard input, screenshots, window and application control, the shell, preferences, launchd, processes, the filesystem and web scraping. No computer-vision model is required: the agent perceives the UI through the accessibility tree, the way assistive technology does.

It is the macOS counterpart of windows-mcp-server: the same 35 tools, toolsets, personas, policy documents and journeys. What separates both from a plain automation bridge is that every agent action is gated on live device posture, the agent's network egress is constrained, and both are recorded in a tamper-evident audit chain the agent cannot switch off.

evaluated against live device signals (MDM enrolment, Platform SSO, boot security, FileVault, SIP, the sealed system volume) before it runs, and refused, warned or contained by policy. Rules match by tool, toolset or annotation, so a screenshot is not gated like a shell command. → Policy configuration

• Device policy engine: every tool call, resource read and prompt fetch is

optionally backed by pf rules so the console user, or the whole machine, cannot go around it. → Egress

• Egress allowlist: a loopback proxy admits only the domains you declare,

to the unified log), heartbeat, rug-pull detection, whole-session recording, evidence bundles and an out-of-band tiered kill switch. None of it is agent-disableable. → Security architecture

• Tamper-evident transparency: a hash-chained audit log (keyed, anchored

**Several tools (Shell, LaunchExecutable, Defaults, LaunchdJob, FileSystem,

Process, App) have full user-level system access with no sandboxing.** That

is the design. Run untrusted workloads in a guest, see

VM isolation, and read SECURITY.md

for what is and is not in scope as a vulnerability.

Requires macOS 27 or later on Apple silicon. Apple does not support Intel Macs on macOS 27.

Quick start

brew install deploymenttheory/tap/macos-mcp-server
macos-mcp-server permissions request      # grant Accessibility and Screen Recording once
SERVER="$(command -v macos-mcp-server)"
codex mcp add macos -- "$SERVER" stdio --persona business-user
# Or, for Claude Code:
claude mcp add --scope user macos -- "$SERVER" stdio --persona business-user

For Claude Desktop, install the .mcpb from the latest GitHub release under Settings > Extensions > Advanced settings > Install Extension. It contains the signed server binary and requests the required macOS grants on first launch.

Any other local MCP client can launch the binary with the stdio subcommand:

{
  "mcpServers": {
    "macos": {
      "command": "/absolute/path/from/command-v/macos-mcp-server",
      "args": ["stdio", "--persona", "first-line-support"]
    }
  }
}

→ Getting started covers Claude Code, Cursor, Codex CLI and Claude Desktop, and what to do before pointing this at a machine you care about. → Permissions explains the privacy grants and why the signing identity matters.

Shortened. The full README is on GitHub.