Mcp Osascript

io.github.m0rvaynePublished by GitHub account m0rvaynev1.1.3Updated Nov 3, 2026

macOS automation: 17 typed tools for windows, menus, keyboard, clipboard, tabs, screenshots

VerifiedSTDIODesktop onlyBrowser AutomationDeveloper Tools

Overview

AI-generated overview

macOS-only MCP server that lets an assistant control the Mac: windows, menus, keyboard, clipboard, browser tabs, screenshots and Shortcuts.

What you can do
  • Control apps and windows: launch or front apps, list, move, resize, minimize, fullscreen or close windows, hide, unhide or quit apps, and read the frontmost app and display layout
  • Drive menus and input: list or click menu items, type text, press key combinations, and run arbitrary AppleScript or JXA scripts
  • Read and write the clipboard, show native notifications, open URLs and files or folders
  • Inspect browser tabs in Safari, Chrome or Arc, take full-screen, region or window screenshots, and list or run Apple Shortcuts
  • Check which macOS permissions are granted and what each one unlocks
When to use it
Useful when you want an assistant to operate a Mac directly — rearranging windows, clicking through app menus, filling in text fields, grabbing screenshots or triggering Shortcuts — instead of only talking about it. Only relevant on macOS desktops.
Requirements
Runs locally on macOS 13 or later with Node.js 18 or newer, installed via npx or a Claude Desktop extension bundle. macOS Automation, Accessibility and Screen Recording permissions must be granted in System Settings for the tools that need them. No API keys or environment variables are declared.
Before you install
The run_osascript tool executes arbitrary AppleScript or JXA, so the MCP client is the trust boundary; anything the assistant is persuaded to run executes with your user rights. Tools can type, click, close windows, quit apps, write the clipboard, open files and URLs, and save screenshots. Screen Recording and Accessibility access expose on-screen content and input control. The author's red-team audits are self-commissioned, not third-party certification.

Installation

In SourceWeft

  1. Open Mcp Osascript in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[mcp-osascript]

Let Claude control your Mac. Move windows, click menus, type text, read clipboard, manage browser tabs, take screenshots, run Shortcuts — 18 typed tools with input validation and security guardrails.

[npm version] [macOS 13+] [Node 18+] [License: MIT] [Tests: 84 passed] [Tests] [m0rvayne/mcp-osascript MCP server]

Listed in the official MCP Registry as io.github.m0rvayne/mcp-osascript

[Demo]

Quick Start

Claude Desktop — one click. Download mcp-osascript-1.1.3.mcpb from the latest release and double-click it. Claude Desktop installs the extension itself.

Or add it to the config manually:

json
{  "mcpServers": {    "osascript": {      "command": "npx",      "args": ["-y", "mcp-osascript"]    }  }}

Add this to your Claude Desktop config (Settings → Developer → Edit Config), restart Claude, and you're ready.

Config for other clients (Cursor, VS Code, Claude Code)

Cursor / VS Code (Copilot)

json
{  "mcpServers": {    "osascript": {      "command": "npx",      "args": ["-y", "mcp-osascript"]    }  }}

Claude Code

bash
claude mcp add osascript -- npx -y mcp-osascript

From source (development)

bash
git clone https://github.com/m0rvayne/mcp-osascript.gitcd mcp-osascript && npm install# then use: "command": "node", "args": ["/path/to/mcp-osascript/server/index.js"]

Try These Prompts

Once installed, ask Claude:

PromptWhat happens
"Open Safari and show me what tabs I have"Launches Safari, reads all tab titles and URLs
"Move the Finder window to the left half of my screen"Resizes and positions the window
"Click File → Export as PDF in Keynote"Navigates the menu bar and clicks the item
"Copy the URL from my active Chrome tab"Reads browser tabs, finds the active one
"Type 'Hello World' into the active text field"Simulates keyboard input
"Show a notification when you're done"Displays a native macOS banner
"What app am I using right now?"Returns the frontmost app name and bundle ID
"Press Cmd+Shift+4"Triggers the screenshot shortcut
"List all items in the Edit menu of VS Code"Introspects the menu bar
"Close the second window of Terminal"Targets a specific window by index
"Screenshot the Safari window and save it to my Desktop"Captures just that window, not the whole screen
"Which monitor is my Slack window on?"Reads display geometry and window positions
"Hide everything except my editor"Hides apps without quitting them
"Run my 'Daily Standup' shortcut"Invokes an Apple Shortcut by name

Tools

18 typed tools, each with input validation, error classification, and permission-aware error messages.

ToolWhat it doesPermission
check_permissionsReport which permissions are granted and what each unlocksNone
run_osascriptExecute any AppleScript or JXA scriptNone
get_clipboardRead clipboard as textNone
set_clipboardWrite text to clipboardNone
send_notificationShow macOS notification bannerNone
open_urlOpen URL in browser (http/https/mailto only)None
open_appLaunch or bring app to frontNone
get_frontmost_appGet active app name + bundle IDAutomation
get_browser_tabsList tabs in Safari, Chrome, or ArcAutomation
type_textType text into active app (max 500 chars)Accessibility
press_keyPress key with modifiers (cmd+c, return, f5)Accessibility
manage_windowsList / move / resize / minimize / fullscreen / closeAccessibility
get_displaysList monitors — position, size, which is mainNone
app_menuList or click menu items in any appAccessibility
screenshotCapture full screen, a region, or an app windowScreen Recording
app_visibilityHide, unhide, or quit an applicationAccessibility
file_openOpen a file or folder, optionally in a given appNone
run_shortcutList or run Apple ShortcutsNone

Self-Correcting Menus

When Claude tries to click a menu item that doesn't exist, the server automatically returns the list of available items at that level — so Claude can retry with the correct name. No other MCP server does this.

User:   "Click File → Export as PDF in Preview"Claude: calls app_menu click ["File", "Export as PDF"]Server: "Menu item 'Export as PDF' not found in 'File'.         Available: ['New from Clipboard', 'Open...', 'Close', 'Save',         'Duplicate', 'Rename...', 'Export...', 'Export as PDF...']"Claude: calls app_menu click ["File", "Export as PDF..."]Server: "Clicked: File > Export as PDF..."

Why mcp-osascript?

mcp-osascriptsteipete (880★)peakmojo (464★)
Typed tools with validation182 (generic)1 (generic)
URL scheme allowlisthttp/https/mailtoNoNo
Env isolation (child process)PATH+HOME+LANG onlyFull process.envFull process.env
Process group kill (no orphans)SIGTERM→SIGKILLNoNo
Error sanitization (paths, tokens)YesNoNo
Prototype pollution protectionObject.create(null)NoNo
Self-correcting menu clickYesNoNo
Integration tests8400
Runs tests in CIYesNoNo
Red-team audit passes400
Untrusted-output fencingYesNoNo
Stdin piping (no temp files)YesTemp filesTemp files

Star counts are a popularity measure, not a quality one — both alternatives predate this project by months. The rows above are the things that differ in practice.

Security audits

Four red-team audit passes (adversarial agents run against the source, commissioned by the author — not a third-party certification), the most recent against v1.1.2 with three parallel agents covering the shell surface, AppleScript escaping, and information disclosure. It found six real defects, including a tool that silently annulled another tool's scheme allowlist and a concurrency slot that could leak until the server deadlocked. Every finding is fixed and carries a regression test. escapeAS was verified against 13 string-breakout candidates through real osascript — none escape.

Permissions

Tools work in three tiers:

  • No permission needed — clipboard, notifications, URLs, apps, files, displays, Shortcuts. Works immediately.
  • Automation — browser tabs, frontmost app. macOS prompts once per browser.
  • Accessibility — keyboard, windows, menus, hide/unhide. Grant once in System Settings → Privacy & Security → Accessibility.
  • Screen Recording — screenshots only. Grant in System Settings → Privacy & Security → Screen Recording.

Ask Claude to run check_permissions and it will tell you which of these are already granted, which tools each one unlocks, and exactly which settings pane to open for the rest. The probes are read-only and never trigger a permission prompt.

When a permission is missing, the server tells you exactly what to do:

"Accessibility permission required. Grant access to 'osascript'in System Settings > Privacy & Security > Accessibility."

Testing

bash
npm test

84 integration tests covering all 18 tools — input validation, security boundaries (URL scheme blocking, prototype pollution, script size limits), timeout enforcement, permission error handling, and regressions for every finding of the security audit.

Security & Architecture

Security

  • run_osascript executes arbitrary code — this is by design. The MCP client (Claude) is the trust boundary.
  • Scripts piped via stdin to /usr/bin/osascript — no temp files, no TOCTOU race conditions.
  • Script size: 50 KB max. Output: 50K chars max, truncated on a UTF-8 character boundary (no mojibake in non-Latin output).
  • Error messages sanitized — filesystem paths, tokens, and passwords are stripped.
  • Child processes get minimal env: PATH, HOME, LANG only — no API keys or secrets leak.
  • URL scheme allowlist — file://, smb://, vnc://, javascript: all blocked.
  • Handler dispatch uses Object.create(null) — no prototype pollution.
  • Externally-sourced text (browser tab titles, window titles, menu items, clipboard) is returned inside an explicit <untrusted-data> envelope, so a web page that renames itself cannot smuggle instructions into the model's context.
  • file_open refuses anything that parses as a URL — open(1) resolves URLs as well as paths, so without that check it would quietly annul open_url's scheme allowlist.
  • screenshot never overwrites an existing file unless overwrite: true, and the extension must match the format.
  • Every list-building tool strips |, CR and LF from app-supplied names, so a crafted window or tab title cannot forge a record.

Reliability

  • Process group kill on timeout — SIGTERM → 2s grace → SIGKILL. No orphaned processes.
  • Concurrency semaphore — max 5 simultaneous osascript processes.
  • Graceful shutdown — server.close() with 10s force-exit safety net.
  • Error classification — parses macOS error codes (-1728, -1743, -25211) into actionable messages. Supports English and Russian locales.

Requirements

  • macOS 13+ (Ventura or later)
  • Node.js 18+

License

MIT

Source: README.md at commit 8eb0731

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.1.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts