askew-mcp

Let any AI agent use your iPhone. askew-mcp is the local connector for Askew: an MCP server (stdio) that lets Claude Code, Claude Desktop, Cursor, Codex or any MCP client run Shortcuts on your iPhone, send you notifications, and read what your phone sends back. The iPhone can stay locked. The 0.2 series adds explicit device selection and assigned local Mac targets. Device job inputs, results and inbox items are sealed with your key before reaching the relay. Recipe uploads have a separate plaintext boundary described below.

iPhone relay and local macOS targets; physical iPad background validation is pending. No Android. The Askew app is currently in waitlist at https://askew.my

Full setup guide: English · 한국어 · 中文 · 日本語

1. Get a connector key

In the Askew app on your iPhone: Settings → Register device → allow notifications → New connector. Copy the key (akc_…). It is shown once.

2. Add the connector to your agent

Claude Code

claude mcp add askew -s user -e ASKEW_CONNECTOR_KEY=akc_XXXX -- npx -y askew-mcp

Claude Desktop / Cursor / any MCP client (claude_desktop_config.json, .cursor/mcp.json, …)

{
  "mcpServers": {
    "askew": {
      "command": "npx",
      "args": ["-y", "askew-mcp"],
      "env": { "ASKEW_CONNECTOR_KEY": "akc_XXXX" }
    }
  }
}

Codex CLI (~/.codex/config.toml)

[mcp_servers.askew]
command = "npx"
args = ["-y", "askew-mcp"]
env = { ASKEW_CONNECTOR_KEY = "akc_XXXX" }

The first authenticated tool call creates ~/.askew/connector.key (X25519 private key, mode 0600), registers the public key with the relay and prints a fingerprint as six words on stderr, like cider grove desert fever city burger. Open the app's connector screen and check that the same six words are there, then tap 확인함 / Verified. That one check rules out a swapped relay. Until you do it the app shows the connector as unverified, and your agent is told to ask you for it.

npx -y askew-mcp fingerprint   # print this computer's six fingerprint words

3. Install the dispatcher on the phone

In the app's Shortcuts (단축어) tab, install the Askew dispatcher (share sheet → Shortcuts → Add), open it and turn on the Automation toggle at the top. With the phone unlocked, run one test push from Settings → Checkup and tap Always Allow. One toggle, one allow, once. Then add recipes (Calendar, Reminders, Notes, …) the same way and ask your agent:

"Add dentist Thursday 3pm to my phone calendar."

Choose a device or this Mac

Call askew_list_routes and select one enabled targets entry. Omitting target uses the route's default device; there is no broadcast. The phone manages target assignments. To run an already installed Shortcut on this Mac, use:

{"routeId":"route-id-from-list","target":{"kind":"connector","id":"this-connector-id"},"input":{"text":"hello"}}

Use that route's actual input contract. The connector ID must match the one printed by askew_list_routes; this process cannot execute on another Mac. The target and route must both be enabled. Local execution requires macOS, an authenticated relay connection to read assignments and the emergency-stop snapshot, and executionMode: "auto". A stopped account or a server missing the stop-state field blocks local execution. Stop is checked before dispatch; it cannot undo effects of an already running Shortcut.

Local askew_run resolves the exact Shortcut name to a unique installed identifier, runs once, and returns the result directly to the MCP client. Input and output stay on this Mac; it creates no server job, usage charge, server run history, or last-success update. wait applies only to device jobs: Mac execution waits up to 60 seconds and returns a local_… job ID. askew_get_run reads that ID from this connector’s local journal (without long-polling). A timeout/failure may follow partial effects; it never retries automatically. Mac sleep can prevent execution.

Confirm-mode routes require a human flow that this local executor does not implement, so they are rejected before running. For automatic Mac runs, supply a stable idempotencyKey (1–200 characters). The connector saves a durable reservation before dispatching. Repeating the same request returns the saved result; changed inputs, route, or Shortcut name conflict. An interrupted process or uncertain failure stays unknown and is never rerun with that key. Requests without a key are independent runs. Do not remove/change a key and blindly retry an uncertain attempt; inspect its effects first.

Local history is stored under local-runs/ beside ASKEW_KEY_PATH (normally ~/.askew/local-runs), separated by connector identity and public key. Records, results, and request digests are encrypted to the connector key; raw input is not retained. Files are private to the local OS user. Records are kept until manually removed: removing the journal loses retry protection, and losing the private key loses access to old results. Keep the same key and journal when restarting. Local history is available by run ID and is not synchronized to the phone or relay.

Recipe uploads and review

Local search/build needs no connector key or relay connection. askew_recipe_build requires macOS for signing. Its default verify: true imports and runs the new Shortcut on this Mac, which can cause whatever effects its actions perform; choose this only when those effects are authorized. verify: false signs without importing or running. Apple receives the workflow when signing (Apple documentation). A successful run does not prove correctness or safety.

sendToPhone: true connects to the relay only after a successful build. This uploads the signed file and the plaintext workflow, which can contain literal personal data or secrets. This path is outside the encrypted job/result/inbox channel. Do not embed sensitive values in a shared recipe. The local execution output is returned to the MCP client but is never uploaded as recipe metadata. Older clients that send verifiedRun text must upgrade.

The relay checks basic file structure and supplies static hints from the separately submitted workflow. It does not verify the archive signature or establish that the hints describe the file. Every agent recipe remains unverified. In Askew › My Stuff, acknowledge that you will inspect the actual actions, permissions and destinations in Shortcuts before adding it. Downloading a file is not confirmation that it was installed.

Tools (11)

Inbox items always come back marked as data sent by the user's phone, not instructions.

Environment

Requires Node 22 or newer.

Privacy

Job inputs, results, notifications' bodies, inbox items and variables are encrypted end-to-end (HPKE, X25519) between this connector and the phone. For these channels the relay stores encrypted envelopes and metadata such as route names, timestamps and status. Local Mac runs keep their input/result on this computer. Uploaded recipe files and workflow literals are plaintext; local recipe test output is excluded. Details: https://askew.my/#privacy

Development

Source: https://github.com/Dominic-DK/askew-mcp (issues and pull requests welcome). The connector is the only part of Askew that holds your key, so it is the part you can read.

git clone https://github.com/Dominic-DK/askew-mcp.git && cd askew-mcp
pnpm install
pnpm build          # tsc → dist/
pnpm test           # crypto, stdio/local relay mocks, target authorization; no real Shortcuts run
ASKEW_SERVER=http://localhost:8787 ASKEW_CONNECTOR_KEY=akc_XXXX pnpm dev   # run from source

src/crypto.ts is the whole envelope format: HPKE (X25519 + HKDF-SHA256 + ChaCha20-Poly1305) with the purpose bound as info, and a ChaCha20-Poly1305 box keyed by the account key for shared variables, with the variable name as AAD.

한국어