icloud-mcp

This unified Apple/iCloud MCP server supports Calendar, Contacts, and Mail. It is one static Go binary. It uses Model Context Protocol JSON-RPC on stdio.

The server uses only remote protocols: CalDAV, CardDAV, IMAP, and SMTP with app-specific passwords. It does not use macOS EventKit, AppleScript, browser automation, or a private Apple API. It runs headless on Linux and macOS. Pure Go also builds for Windows.

CI runs a windows/amd64 smoke build. GitHub Release archives contain linux/amd64, linux/arm64, and darwin/arm64 builds. Agents, orchestrators, and desktop chat applications can use the server.

Host-agnostic. Any MCP client can use the server if it starts child processes with an environment and connects stdin and stdout. Compatible clients include personal agents, Hermes, OpenClaw, IDE bridges, runners, and other stdio hosts. The server does not prefer a model vendor, chat product, or reseller. Configure the server only through its process environment. The binary does not parse host-specific config files or .env.

Reminders, Notes, Photos, Drive, Messages, and similar apps are out of scope. They remain out of scope until Apple documents a suitable remote third-party connector. See Supported scope.

Quick start

go install github.com/ThomasCrouzet/icloud-mcp/cmd/icloud-mcp@latest
# or: make build
# or: make release VERSION=v0.4.0
# or: make release-all VERSION=v0.4.0

1. Create an app-specific password. Never use the main Apple Account password.
2. Export a minimal environment. For the first deployment, use Calendar read-only mode:

export ICLOUD_EMAIL='you@icloud.com'
export ICLOUD_PASSWORD='your-app-specific-password'
export ICLOUD_MCP_READ_ONLY=true
export ICLOUD_MCP_DEFAULT_TZ=Europe/Paris   # owner IANA zone; default UTC

3. Register the absolute icloud-mcp path as the command in your MCP host. Register the environment as env. The host can use YAML, JSON, TOML, a UI, or an orchestrator. The exact format depends on the host.
4. Stdio carries JSON-RPC. stderr carries logs and the mutation audit. Reload the host after environment changes.

This configuration exposes 7 tools: Calendar reads, local helpers, and icloud_capabilities. The process does not construct a Contacts or Mail client.

Optional domains (still host-agnostic export form):

# Contacts reads (writes also need ICLOUD_MCP_READ_ONLY=false)
export ICLOUD_MCP_ENABLE_CONTACTS=true

# Mail reads: IMAP identity may differ from ICLOUD_EMAIL (e.g. name@icloud.com)
export ICLOUD_MCP_ENABLE_MAIL=true
export ICLOUD_MAIL_ADDRESS='mailbox@icloud.com'
# export ICLOUD_MAIL_PASSWORD='...'   # optional; else copy of ICLOUD_PASSWORD

# Mail mutation (flags / move / trash); independent of send
export ICLOUD_MCP_ENABLE_MAIL_WRITE=true
export ICLOUD_MCP_READ_ONLY=false

# Mail send: requires exact recipient allowlist even under global read-only
export ICLOUD_MCP_ENABLE_MAIL_SEND=true
export ICLOUD_MCP_SMTP_ALLOWED_RECIPIENTS='alice@example.com,bob@example.net'

You can load secrets from file:// only at boot. Each file must be a regular file of at most 4 KiB with mode 0600 or stricter. The server does not read the file again after startup:

export ICLOUD_EMAIL='file:///run/secrets/icloud-email'
export ICLOUD_PASSWORD='file:///run/secrets/icloud-password'
export ICLOUD_MAIL_ADDRESS='file:///run/secrets/icloud-mail-address'
export ICLOUD_MAIL_PASSWORD='file:///run/secrets/icloud-mail-password'

See .env.example for the full 12-variable contract.

MCP tools

The server exposes a maximum of 23 tools. Disabled tools are absent from tools/list. The process does not construct clients for disabled domains.

ICLOUD_MCP_READ_ONLY=true removes every Calendar/Contacts write, every Mail mutation, and Mail send. It does not enable a disabled read domain.

Highlights: Calendar update and delete operations understand occurrences and use strong If-Match. Contacts uses opaque book IDs and writes vCard 3.0. Mail uses (mailbox, UIDVALIDITY, UID) identities, PEEK reads, and an exact recipient policy for SMTP. set_message_flags fails closed with protocol_error when CONDSTORE is advertised. This occurs because go-imap beta.8 cannot observe tagged MODIFIED. See the full behavior notes: docs/caldav-compatibility.md, docs/carddav-compatibility.md, docs/mail-compatibility.md.

Idempotency: create_event and create_contact use server-side UID keys. Use client_uid or its idempotency_key alias. A repeated create conflicts if the UID exists. It never silently overwrites the object. The optional idempotency_key for update_event and update_contact is process-local only. Its in-memory cache has a 15 minute TTL and clears when the process restarts.

The same key and parameters return the cached success. The same key with different parameters returns conflict. Combine an update key with a strong etag when possible. See docs/error-codes.md.

Configuration

Exactly 12 product environment variables:

Booleans accept only unset, 0, false, 1, or true. Invalid values cause a boot failure. The server validates the configuration before network access. Mail write or send without Mail causes a boot error. Mail without an address or password also causes a boot error. Send without a recipient policy causes a boot error, including in read-only mode.

Global read-only can coexist with write and send flags, but it prevents their registration.

The server trims log levels and ignores case. It accepts debug or -4, info, warn, warning, or 2, and error or 4. Unset or unrecognized values use info.

Use -version to print the version. The optional -health 127.0.0.1:port flag serves /healthz and /status on loopback. Both endpoints return JSON with domains and rate limits. The optional -audit-format=json|text flag selects the mutation audit format on stderr. The default format is json.

Dates

• Calendar input start and end accept RFC3339 with an offset. They also accept wall-clock values without an offset in ICLOUD_MCP_DEFAULT_TZ. Use values without an offset for the user's local time. Recurring creates and creates with an explicit timezone write TZID and VTIMEZONE. Non-recurring timed creates default to UTC Z on the wire. All-day creates use VALUE=DATE.
• Calendar output uses RFC3339 for timed events. It always includes an explicit numeric offset in ICLOUD_MCP_DEFAULT_TZ, never bare Z. All-day dates use YYYY-MM-DD. See calendar_capabilities.outputFormat.
• Contacts birthdays: write YYYY-MM-DD only.
• Mail search: since inclusive, before exclusive (YYYY-MM-DD).