Mcp Macos

io.github.dockndevai由 GitHub 帳號 dockndevai 發布v0.2.1更新於 Nov 4, 2026

Observe & operate a Mac — files, processes, apps, shell, AppleScript, GUI — safe by default.

已驗證STDIO僅桌面瀏覽器自動化檔案與儲存開發者工具

概覽

AI 產生的概覽

本機 MCP 伺服器，讓 AI 助理觀察並操作 Mac——檔案、行程、應用程式、截圖、shell、AppleScript 與圖形介面，預設唯讀。

可以做什麼
  • 檢視系統資訊：macOS 版本、硬體、記憶體、負載、開機時間、行程、應用程式與前景應用程式。
  • 在允許清單範圍內瀏覽與讀取檔案，並讀取剪貼簿。
  • 將螢幕擷取為 PNG 圖片。
  • 寫入檔案、設定剪貼簿、發送通知、開啟檔案、網址或應用程式（讀寫模式）。
  • 執行程式、AppleScript/JXA，向行程送出訊號（管理員模式加執行開關）。
  • 將路徑移至垃圾桶，以及透過輸入文字、按鍵、點擊與移動滑鼠操作圖形介面（管理員模式加各自開關）。
適用情境
適合需要檢查或操作本機 Mac 的情境，例如查看系統狀態、讀取專案檔案、截圖，或自動化應用程式與桌面。分層模式讓你一開始只做觀察，再依需求逐步開放權限。
執行需求
僅支援 macOS，需要 Node 22 以上版本，透過 npx 在本機執行。主機終端機或 MCP 用戶端須在系統設定中授予螢幕錄製、輔助使用、自動化以及檔案與資料夾/完整磁碟存取權限。點擊與移動滑鼠另需安裝 cliclick 工具。透過 MACOS_MODE、MACOS_PATH_ALLOWLIST、MACOS_ALLOW_EXEC、MACOS_ALLOW_DELETE、MACOS_ALLOW_INPUT 等環境變數設定。
安裝前請注意
管理員模式搭配執行、刪除與輸入開關後，助理可執行指令與 AppleScript、終止行程、刪除至垃圾桶並控制圖形介面，請僅在確有需要時開啟。路徑允許清單預設為任意位置，但 ~/.ssh、~/.aws、鑰匙圈等受保護路徑永遠唯讀。高風險呼叫會透過 elicitation 請人工確認，但不支援 elicitation 的用戶端只能依賴開關。稽核紀錄寫入 stderr。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mcp Macos，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

mcp-macos

[npm] [CI] [licence]

A safe-by-default Model Context Protocol server that lets an agent observe and operate a Mac — read files, list processes and apps, take screenshots (read-only); write files, set the clipboard, post notifications, open things (read-write); and, behind explicit opt-ins, run commands / AppleScript, delete to Trash, kill processes and drive the GUI (admin).

It starts read-only. Every high-impact power needs both admin mode and its own flag, and the most dangerous ones ask the human to approve each call. Part of the dockndevai MCP server suite — one governance model across all of them.

Pure Node + osascript/screencapture — no native add-ons. macOS only.

What it gives an agent

The server starts read-only (see Safe by default); higher-capability tools are only registered when you raise the mode.

ToolForNeeds mode
system_infomacOS version, hardware, memory, load, uptimeread-only
list_directory / read_filebrowse & read files (path-allowlisted)read-only
list_processesrunning processes by CPU/memread-only
get_clipboardread the clipboardread-only
list_apps / get_frontmost_apprunning apps; the active oneread-only
screenshotcapture the screen as a PNGread-only
write_filecreate/overwrite a file (confirms on overwrite)read-write
set_clipboard / notify / openset clipboard, notify, open a file/URL/appread-write
run_commandrun a program (argv, no shell)admin + MACOS_ALLOW_EXEC
run_applescriptrun AppleScript / JXAadmin + MACOS_ALLOW_EXEC
kill_processsignal a processadmin + MACOS_ALLOW_EXEC
delete_pathmove a path to the Trashadmin + MACOS_ALLOW_DELETE
type_text / key_press / click / move_mousedrive the GUIadmin + MACOS_ALLOW_INPUT

Install

bash
npx -y @dockndevai/mcp-macos

Requires macOS and Node ≥ 22. click/move_mouse also need cliclick (brew install cliclick).

Configure

json
{  "mcpServers": {    "macos": {      "command": "npx",      "args": ["-y", "@dockndevai/mcp-macos"],      "env": {        "MACOS_MODE": "read-only"      }    }  }}

See docs/CLIENTS.md for Claude Code / Cursor / Codex / VS Code / Windsurf snippets, and .env.example for every supported variable.

Safe by default

This server can drive an entire Mac, so the access model (enforced by src/security.ts) is deliberately strict — defence in depth, not documentation:

QuestionSettingDefaultNotes
What can it do at all?MACOS_MODEread-onlyread-only observes; read-write writes files/clipboard/opens; admin adds exec/delete/kill/GUI. Tools above the mode are never registered.
Which paths can it touch?MACOS_PATH_ALLOWLIST(anywhere)Comma-separated roots. When set, any file op outside them is refused.
Which paths are read-only forever?MACOS_PROTECTED_PATHSsystem + secrets/System, /usr, /bin, /sbin, /private, /Library, ~/.ssh, ~/.aws, ~/.gnupg, ~/Library/Keychains — readable, never mutated.
Can it run commands?MACOS_ALLOW_EXECfalseGates run_command, run_applescript, kill_process (on top of admin).
Restrict which programs?MACOS_COMMAND_ALLOWLIST(any)When set, run_command may only invoke these program names.
Can it delete?MACOS_ALLOW_DELETEfalseGates delete_path (moves to the Trash, recoverable).
Can it drive the GUI?MACOS_ALLOW_INPUTfalseGates type_text/key_press/click/move_mouse.
Preview without doingMACOS_DRY_RUNfalseMutating tools validate + log intent, then return.
Audit trailMACOS_AUDIT_LOGtrueJSON line to stderr per guarded operation (ALLOW/DENY/DRY_RUN).
Interactive confirmation(automatic)—run_command, run_applescript, delete_path, kill_process and file overwrites ask the human to approve via MCP elicitation before running; clients without elicitation fall back to the flags.

See SECURITY.md.

macOS permissions

The host process (your terminal / MCP client) must be granted, in System Settings → Privacy & Security:

  • Screen Recording — for screenshot.
  • Accessibility — for type_text / key_press / click / move_mouse.
  • Automation (per-app prompts) — for run_applescript and app control.
  • Files and Folders / Full Disk Access — to read/write outside the default sandbox.

You'll be prompted the first time each is needed; nothing works around a permission you haven't granted.

Developing

bash
npm installnpm run buildMACOS_MODE=read-only node dist/index.js# introspect the tool list:echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/index.js

Licence

MIT

來源：README.md，提交 8c76767

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

3
  1. v0.2.1最新Oct 14, 2026
  2. v0.2.0Sep 29, 2026
  3. v0.1.1Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分