MacOS MCP Server

What macOS MCP Server MCP server does

The macOS MCP Server MCP server gives an MCP-compatible agent access to a local macOS desktop through accessibility APIs and system interfaces. It can read the accessibility tree, perform clicks and keyboard input, inspect windows and applications, capture screenshots, and coordinate multi-step UI workflows without requiring a computer-vision model.

Beyond desktop interaction, the server exposes optional capabilities for shell commands, executable launching, preferences, launchd jobs, filesystem access, processes, notifications, clipboard operations, unified logs, network diagnostics, packages, and web scraping. It also includes planning, evidence capture, declarative journeys, credentials injection, and session recording features where the relevant toolsets or options are enabled.

How it works

The server is launched locally by an MCP client through its stdio subcommand. Tool availability is organized into toolsets, with screen, interaction, apps, and basic system functions enabled by default. Other groups, including shell, filesystem, system administration, credentials, testing, diagnostics, and planning, can be selected explicitly. Personas provide predefined toolset selections and workflow guidance.

Agents can read resources such as the desktop snapshot, display inventory, session recording, and system information. Prompts are available for RPA journeys, support triage, and evidence capture. The server also supports read-only operation through its command-line options.

A policy engine evaluates tool calls, resource reads, and prompt retrieval against live device signals before execution. Rules can produce allow, warning, hold, deny, or kill outcomes. Network egress can be restricted through a loopback proxy and optional packet-filter rules. Audit records use a hash chain, and session recording and evidence bundles are available for review.

Setup and configuration

The macOS MCP Server MCP server requires macOS 27 or later on Apple silicon. Install the binary with Homebrew, then run its permissions command to request Accessibility and Screen Recording access. An MCP client can launch the binary with an absolute path and a selected persona, such as business-user or first-line-support.

Claude Desktop can use the signed .mcpb package from a GitHub release. Claude Code and Codex CLI can add the server with their MCP commands. Other local clients can use a JSON configuration containing the executable path, the stdio argument, and optional persona or toolset arguments.

A policy file can be supplied with --policy-config. Without one, the policy engine still evaluates and records declared signals but does not refuse operations. The credentials tool requires a separate credentials-file option. The server's permissions documentation should be reviewed before deployment because several capabilities operate with full user-level access and no sandbox.

Tools and capabilities

Available tool groups include:

• Screen capture and display inspection, including snapshots, screenshots, and recording
• Accessibility interaction, text entry, scrolling, shortcuts, waiting, and multi-edit operations
• Application and window control, clipboard access, notifications, and process inspection
• Shell, executable launch, filesystem, preferences, and launchd management
• System information, services, unified logs, network diagnostics, and package operations
• Web scraping, credential injection, planning, assertion, and evidence capture
• Guardrail status and an out-of-band kill switch

Resources and prompts supplement the tools for desktop state, recordings, system information, support triage, and repeatable UI journeys.

Limitations and notes

The server intentionally does not automate the login window, lock screen, Touch ID, password sheets, TCC consent dialogs, or secure text-field contents. These remain macOS trust boundaries.

Shell, executable launch, preferences, launchd, filesystem, process, and application operations have full user-level system access without sandboxing. Untrusted workloads should be isolated in a guest environment. The server requires Accessibility and Screen Recording grants, and Apple silicon support is mandatory because Intel Macs are not supported by macOS 27.

Credentials are designed without a read mode: injection requires a secure text field, and keychain items are removed on exit paths. Policy enforcement, egress restrictions, audit logging, and recording should be configured according to the deployment's security requirements.