# Cupertino

> MCP servers for the Apple apps already on your Mac — Mail, Notes, Reminders, Calendar,
> Contacts, Messages, Safari, Maps and Voice Memos — plus the Mac's screen, sound, desktop, Simulator and a
> shell — and the signed menu-bar app that holds their permission grants once instead of handing
> them to every editor.

Unofficial. Not affiliated with Apple. macOS 26 or later, and macOS only. Shipped at 1.0.0, and at
1.39.0 as of November 2026: the signed app ships from GitHub releases. The `@mgcrea/mcp-apple-*`
packages are MIT and on npm; the app carries Screen, Sound, Desktop, Simulator and Shell instead,
which have no npm package because they need permissions and frameworks only the signed app can
hold.

## The argument

- Full Disk Access is a single, indivisible grant, and it lands on whatever process launched the
  server — your editor or your terminal, never Mail itself. Granting it to Mail.app does nothing.
- Four MCP hosts therefore mean four whole-disk grants. Cupertino is one signed, notarized app that
  holds it once, and the bundle identifier `io.mgcrea.cupertino` is the TCC identity, so the grant
  survives updates.
- The grant buys speed as well as reach: the same Mail search is 74,000 ms over Apple Events and
  97 ms off the Envelope Index.
- Write tools are not merely refused when writes are off — they are never registered, because MCP
  clients cache the tool list.

## Surfaces

The Apple apps with an npm package come first. After them, the surfaces that ship only inside the
app, because they need a permission or a framework no published npm package can hold: the Mac's
screen, sound, desktop and shell, and the iOS Simulator.

- Mail — 24 tools (12 always registered, 10 write-gated, 2 behind their own flag for watching
  incoming mail). `@mgcrea/mcp-apple-mail`
- Notes — 13 tools (7 always registered, 6 write-gated). `@mgcrea/mcp-apple-notes`
- Reminders — 11 tools (6 always registered, 5 write-gated). `@mgcrea/mcp-apple-reminders`
- Calendar — 10 tools (7 always registered, 3 write-gated). `@mgcrea/mcp-apple-calendar`
- Contacts — 7 tools (5 always registered, 2 write-gated). `@mgcrea/mcp-apple-contacts`. Turns a
  phone number or an email address into a name, which is what makes the Messages server readable.
  Its reads need no Automation grant — only the two write tools reach Apple Events. There is
  no delete tool because Contacts' scripting dictionary has no delete command.
- Messages — 11 tools (6 always registered, 2 write-gated, 1 behind its own flag for reading 2FA
  codes, 2 behind another for watching incoming messages). `@mgcrea/mcp-apple-messages`. iMessage,
  SMS and RCS out of chat.db, with names resolved through Contacts. The only surface with no read fallback at all: every read through Messages' own
  scripting interface fails, so Full Disk Access is mandatory rather than an upgrade. `send` and
  `save_attachment` are the two mutating tools; there is no edit, delete, mark-as-read or reaction
  verb to expose. Roughly 3% of messages across all history keep their text only in an archived
  blob that SQL cannot reach, and since Apple stopped writing the plain column in early 2026 that is
  ~100% of recent ones, so the server decodes them.
- Maps — 13 tools, 5 behind the write gate. Favourites, Guides, recents and places filed in no
  Guide, with coordinates. The write tools pin and unpin places, save and remove them, and file them
  into Guides, saved through Maps' own data model inside Cupertino; they exist only when Cupertino
  hosts the server, and run from npm the package only reads. `@mgcrea/mcp-apple-maps`
- Safari — 21 tools (9 always registered, 7 write-gated, 1 behind its own flag for reading 2FA
  codes, 3 behind another for reading a page's network traffic, 1 behind a third for reading the
  cookies of sites you list, never returning a value inline). `@mgcrea/mcp-apple-safari`.
  History, live tabs, bookmarks and the Reading List, plus a bundled Safari extension you enable per
  website that reads what a page actually says, waits for text to appear on it, and lets the
  write-gated tools click, fill, submit forms and scroll. The write tools also open a URL, save one to the Reading List, and close the tabs an agent opened. With "Read network
  traffic" on, the extension also records what an armed tab fetches (fetch and XMLHttpRequest from
  the top frame, plus console errors) and can save a file out of a response, such as a PDF returned
  as base64 inside JSON; bodies are not redacted. There is still no `do JavaScript` tool: that verb
  needs a developer-menu toggle that is not a TCC grant and whose state cannot be read. Live tabs
  and page contents are the only things in the whole bundle that work with no Full Disk Access at
  all — tabs need an Automation grant, and page contents need the extension.
- Voice Memos — 11 tools (5 always registered, 6 write-gated). `@mgcrea/mcp-apple-voice-memos`.
  Recordings with their folders, favourites and Recently Deleted, read from Voice Memos' own store,
  and the transcript Apple made of each recording, read out of the audio file with every segment's
  start and end. Recordings from before 2025 have no transcript, because Apple did not backfill.
  One write tool copies a recording's audio to `~/Downloads`. Five more rename, move, favourite,
  delete (to Recently Deleted) and restore a recording, saved through Voice Memos' own data model
  inside Cupertino; they exist only when Cupertino hosts the server, and run from npm the package
  only reads. Full Disk Access is mandatory.

The app itself hosts five more surfaces, none of them a separate npm install:

- Screen — 3 tools (2 always registered, 1 behind its own flag). A picture of a window Cupertino is
  already brokering — Mail, Safari, Calendar — written to disk as a PNG. Never an arbitrary app,
  window, display or region.
- Sound — 10 tools (3 need no permission at all, 4 always registered, 3 behind their own flag for
  microphone recording). Devices, volume and mute work with no grant; recording needs the
  Microphone permission and shows macOS's orange indicator, naming Cupertino, the whole time.
- Desktop — 27 tools (10 always registered, 17 write-gated). Drives any app through the Accessibility
  API — reads a window as named, addressable controls, and behind the write gate presses, types,
  right-clicks, drags and runs a whole session (`apple_desktop_run`) before releasing control back
  to whoever was using the Mac. Typing into a field it can read back happens in the background,
  without bringing the app forward. Scoped to the apps Cupertino brokers unless you widen it.
- Simulator — 12 tools (4 always registered, 8 write-gated). The same idea for an iOS Simulator
  window: reads an app's own controls in iOS points and, behind the write gate, presses, taps,
  swipes, types and folds a foldable, with no WebDriverAgent runner to keep alive.
- Shell — 2 tools, off until switched on. `apple_shell_run` runs one script, in zsh, bash, python3,
  node, AppleScript or JXA, as Cupertino's own child, so it holds every grant Cupertino holds. Before
  each run a window shows the whole script and the agent's reason, and only a click by hand on Run
  once runs it. Every request leaves a line in a run record that keeps a hash of the script, never
  its text or output.

## The app

- Wires itself into seven clients automatically — Claude Code, Claude Desktop, Cursor, LM Studio,
  Windsurf, Visual Studio Code, and ChatGPT & Codex — by merging its entries into each client's own
  config and keeping a backup.
- Load tools on demand swaps the full tool list for a small, searchable index, for the clients whose
  context a hundred-plus tool schemas would otherwise crowd out.
- A Chat pane, so the surfaces can be tried without wiring an editor first. It answers through
  Apple's on-device model, which keeps `scripts/audit-network.sh` true: the pane adds no network
  reach, no API key and nothing to send.
- An Activity log you can keep, search and export, with a signature, plus per-surface on/off
  switches and a What's New view after updating.
- Every server also publishes to the MCP Registry.

## Price

- $14.99 once, covering every 1.x release. Not a subscription, nothing lapses, and 2.0 is a separate
  purchase. EU buyers are quoted and charged €14.99, VAT included — that is not a conversion of the
  dollar figure, which is quoted tax-exclusive.
- There is no price ladder and no announced rise. There was one — three rungs tied to surfaces
  shipping — and every rung came due and was held: Calendar, Contacts, Messages and Safari all landed
  without moving the price, and so did the five surfaces after them. All twelve now cost $14.99. If
  a rise ever happens it is announced beforehand and never applied to a licence already sold.
- A 30-minute trial, started by pressing a button and never armed on its own. Every surface at full
  function, with the write toggles behaving exactly as they will after paying. It is held in memory
  and never written to disk, so quitting and reopening starts another one; nothing prevents that and
  nothing pretends to. When it closes, the servers it started are stopped — refusing only new
  connections would not close it, since an MCP host opens one stdio connection and holds it for the
  life of the editor.
- The trial answers whether Cupertino works against your mail. The 30-day refund answers whether it
  was worth the money. They are different questions and both are available.
- The servers are MIT and run on their own with no key at all. The app is a different matter: its
  source is public and readable, but any build of it — yours or ours — asks for a licence key. A
  licence buys the signed and notarized binary and the upkeep, not access to the source.
- The licence key is verified offline. There is no account, no login and no phone-home. The app
  makes exactly one network connection, the update check, and only once you have turned it on or
  pressed Check Now; it reads one file and sends no identifier. Everything here is checked in CI
  against the built binary, including that automatic checks are off in the shipped bundle.

## Links

- Source: https://github.com/mgcrea/cupertino
- How it ships, and why not the App Store: https://github.com/mgcrea/cupertino/blob/main/docs/distribution.md
- What is open, what is sold: https://github.com/mgcrea/cupertino/blob/main/docs/licensing.md