Mac Messages MCP

Findings (2)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (18)

• tool_get_recent_messages

  Read recent macOS Messages as a plain-text summary. This is read-only: it queries the local Messages database and does not send, edit, or delete messages. Requires macOS Full Disk Access for the host app or terminal. Returned Messages/Contacts-derived text is structurally neutralized

• tool_send_message

  Send one outgoing message through the macOS Messages app. This has an external side effect: it sends the provided text (and any attachments) to the recipient using Messages. It may use iMessage or SMS/RCS depending on recipient availability and Messages configuration, but file attac

• tool_find_contact

  Find AddressBook contacts by fuzzy name matching. This is read-only: it searches local contacts and does not message anyone or change contacts. Requires Contacts/AddressBook permission for the host app or terminal. Returned names and numbers are structurally neutralized and wrapped

• tool_check_db_access

  Diagnose read access to the local macOS Messages database. This is read-only: it checks whether the server can locate and query the Messages SQLite database and returns a plain-text diagnostic report with any permission or path errors. It requires Full Disk Access for the host app or

• tool_check_contacts

  List a small sample of contacts available from AddressBook. This is read-only: it loads cached local contact names and phone numbers and returns a count plus sample entries, structurally neutralized and wrapped in <untrusted-mcp-output>. Requires Contacts/AddressBook permission. Use thi

• tool_check_addressbook

  Diagnose read access to the local macOS AddressBook database. This is read-only: it checks whether the server can locate and read local Contacts/AddressBook data and returns a plain-text diagnostic report with permission or path errors. It does not modify contacts. Use this when contact

• tool_get_chats

  List named group chats from the macOS Messages database. This is read-only: it queries chat identifiers and display names and does not send, edit, or delete messages. Requires Full Disk Access for the host app or terminal. Returns group names and IDs structurally neutralized and wrapped

• tool_check_imessage_availability

  Check whether a recipient appears reachable through iMessage. This is a read-only availability check against local Messages services; it does not send a message. Requires Messages to be configured on this Mac. Returns a plain-text result indicating iMessage availability or likely SMS/RC

• tool_fuzzy_search_messages

  Fuzzy-search local message text within a time window. This is read-only: it queries the local Messages database and does not send, edit, or delete messages. Requires Full Disk Access for the host app or terminal. Matching messages are structurally neutralized and wrapped in <untrust

• tool_search_attachments

  Search message attachments by date range, contact, and MIME type. This is read-only and returns metadata only; it does not return file bytes or modify attachments. Requires Full Disk Access for the host app or terminal. Filenames, MIME types, paths, and sender labels are structurally ne

• tool_get_attachment

  Fetch a specific attachment by its database ROWID. This is read-only: it resolves a local Messages attachment file and does not modify or delete it. Requires Full Disk Access for the host app or terminal. For image MIME types under max_bytes, returns the image inline so you can see

• tool_list_conversations

  List every conversation, not just named group chats. This is read-only: it reports chat identifiers, kind (direct, group, or business), message count, unread count, and last activity. Requires Full Disk Access. Returned names and identifiers are structurally neutralized and wrapped

• tool_wait_for_new_messages

  Block until a newer message exists, or the timeout expires. Read-only. An MCP stdio server cannot push, so this is a bounded poll: call it in a loop, feeding the highest ROWID you have seen back as since_rowid. Returned message text is structurally neutralized and wrapped in <untrus

• tool_search_attachment_contents

  Search the contents of message attachments, not just their metadata. This is read-only. Text formats are read directly, PDFs need the optional `pypdf` package, and images need the optional `pytesseract` package plus the tesseract binary; rows it cannot extract from are counted in the re

• tool_create_contact

  Create one Contacts.app entry holding a single phone number. This is a privileged write: it changes the user's Contacts through Contacts.app automation, needs Automation permission for Contacts, and does not merge with an existing card, so calling it twice for the same person duplic

• tool_schedule_message

  Schedule one message to be sent later by this server process. The queue is in memory: it survives only while this MCP server process runs. If the client disconnects or the server restarts before send_at, the message is never sent and is not restored. Scheduled sends use the same Message

• tool_list_scheduled_messages

  List messages scheduled in this server process and their status. Read-only with respect to Messages: it only reads the in-memory queue. Statuses are pending, sent, or failed; a failed entry shows the send error. Use tool_cancel_scheduled_message to drop a pending job.

• tool_cancel_scheduled_message

  Cancel one pending scheduled message. Read-only with respect to Messages: it only removes the job from this process's in-memory queue. A job that has already run cannot be cancelled.