Mcp Macos

io.github.dockndevai由 GitHub 账号 dockndevai 发布v0.2.1更新于 Nov 4, 2026

Observe & operate a Mac — files, processes, apps, shell, AppleScript, GUI — safe by default.

已验证STDIO仅桌面浏览器自动化文件与存储开发者工具

概览

AI 生成的概览

本地 MCP 服务器，让 AI 助手观察并操作 Mac——文件、进程、应用、截图、shell、AppleScript 与图形界面，默认只读。

可以做什么
  • 查看系统信息：macOS 版本、硬件、内存、负载、运行时长、进程、应用与前台应用。
  • 在允许列表范围内浏览和读取文件，并读取剪贴板。
  • 截取屏幕为 PNG 图片。
  • 写入文件、设置剪贴板、发送通知、打开文件、网址或应用（读写模式）。
  • 运行程序、AppleScript/JXA，向进程发送信号（管理员模式加执行开关）。
  • 将路径移入废纸篓，以及通过输入文字、按键、点击和移动鼠标操作图形界面（管理员模式加各自开关）。
适用场景
适合需要检查或操作本机 Mac 的场景，例如查看系统状态、读取项目文件、截图，或自动化应用与桌面。分级模式让你可以先只做观察，再按需逐步放开权限。
运行要求
仅限 macOS，需要 Node 22 或更高版本，通过 npx 在本地运行。宿主终端或 MCP 客户端需在系统设置中授予屏幕录制、辅助功能、自动化以及文件与文件夹/完全磁盘访问权限。点击和移动鼠标还需安装 cliclick 工具。通过 MACOS_MODE、MACOS_PATH_ALLOWLIST、MACOS_ALLOW_EXEC、MACOS_ALLOW_DELETE、MACOS_ALLOW_INPUT 等环境变量配置。
安装前请注意
管理员模式配合执行、删除和输入开关后，助手可运行命令与 AppleScript、结束进程、删除到废纸篓并控制图形界面，仅在确有需要时开启。路径允许列表默认为任意位置，但 ~/.ssh、~/.aws、钥匙串等受保护路径始终只读。高风险调用会通过 elicitation 请求人工确认，但不支持 elicitation 的客户端只能依赖开关。审计记录写入 stderr。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Mcp Macos，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

mcp-macos

[npm] [CI] [licence]

A safe-by-default Model Context Protocol server that lets an agent observe and operate a Mac — read files, list processes and apps, take screenshots (read-only); write files, set the clipboard, post notifications, open things (read-write); and, behind explicit opt-ins, run commands / AppleScript, delete to Trash, kill processes and drive the GUI (admin).

It starts read-only. Every high-impact power needs both admin mode and its own flag, and the most dangerous ones ask the human to approve each call. Part of the dockndevai MCP server suite — one governance model across all of them.

Pure Node + osascript/screencapture — no native add-ons. macOS only.

What it gives an agent

The server starts read-only (see Safe by default); higher-capability tools are only registered when you raise the mode.

ToolForNeeds mode
system_infomacOS version, hardware, memory, load, uptimeread-only
list_directory / read_filebrowse & read files (path-allowlisted)read-only
list_processesrunning processes by CPU/memread-only
get_clipboardread the clipboardread-only
list_apps / get_frontmost_apprunning apps; the active oneread-only
screenshotcapture the screen as a PNGread-only
write_filecreate/overwrite a file (confirms on overwrite)read-write
set_clipboard / notify / openset clipboard, notify, open a file/URL/appread-write
run_commandrun a program (argv, no shell)admin + MACOS_ALLOW_EXEC
run_applescriptrun AppleScript / JXAadmin + MACOS_ALLOW_EXEC
kill_processsignal a processadmin + MACOS_ALLOW_EXEC
delete_pathmove a path to the Trashadmin + MACOS_ALLOW_DELETE
type_text / key_press / click / move_mousedrive the GUIadmin + MACOS_ALLOW_INPUT

Install

bash
npx -y @dockndevai/mcp-macos

Requires macOS and Node ≥ 22. click/move_mouse also need cliclick (brew install cliclick).

Configure

json
{  "mcpServers": {    "macos": {      "command": "npx",      "args": ["-y", "@dockndevai/mcp-macos"],      "env": {        "MACOS_MODE": "read-only"      }    }  }}

See docs/CLIENTS.md for Claude Code / Cursor / Codex / VS Code / Windsurf snippets, and .env.example for every supported variable.

Safe by default

This server can drive an entire Mac, so the access model (enforced by src/security.ts) is deliberately strict — defence in depth, not documentation:

QuestionSettingDefaultNotes
What can it do at all?MACOS_MODEread-onlyread-only observes; read-write writes files/clipboard/opens; admin adds exec/delete/kill/GUI. Tools above the mode are never registered.
Which paths can it touch?MACOS_PATH_ALLOWLIST(anywhere)Comma-separated roots. When set, any file op outside them is refused.
Which paths are read-only forever?MACOS_PROTECTED_PATHSsystem + secrets/System, /usr, /bin, /sbin, /private, /Library, ~/.ssh, ~/.aws, ~/.gnupg, ~/Library/Keychains — readable, never mutated.
Can it run commands?MACOS_ALLOW_EXECfalseGates run_command, run_applescript, kill_process (on top of admin).
Restrict which programs?MACOS_COMMAND_ALLOWLIST(any)When set, run_command may only invoke these program names.
Can it delete?MACOS_ALLOW_DELETEfalseGates delete_path (moves to the Trash, recoverable).
Can it drive the GUI?MACOS_ALLOW_INPUTfalseGates type_text/key_press/click/move_mouse.
Preview without doingMACOS_DRY_RUNfalseMutating tools validate + log intent, then return.
Audit trailMACOS_AUDIT_LOGtrueJSON line to stderr per guarded operation (ALLOW/DENY/DRY_RUN).
Interactive confirmation(automatic)—run_command, run_applescript, delete_path, kill_process and file overwrites ask the human to approve via MCP elicitation before running; clients without elicitation fall back to the flags.

See SECURITY.md.

macOS permissions

The host process (your terminal / MCP client) must be granted, in System Settings → Privacy & Security:

  • Screen Recording — for screenshot.
  • Accessibility — for type_text / key_press / click / move_mouse.
  • Automation (per-app prompts) — for run_applescript and app control.
  • Files and Folders / Full Disk Access — to read/write outside the default sandbox.

You'll be prompted the first time each is needed; nothing works around a permission you haven't granted.

Developing

bash
npm installnpm run buildMACOS_MODE=read-only node dist/index.js# introspect the tool list:echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/index.js

Licence

MIT

来源：README.md，提交 8c76767

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

3
  1. v0.2.1最新Oct 14, 2026
  2. v0.2.0Sep 29, 2026
  3. v0.1.1Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分