Cupertino

Cupertino puts the Apple apps on your Mac behind the Model Context Protocol (MCP), letting any MCP-speaking agent — Claude, Cursor, VS Code, and others — read and write Mail, Notes, Reminders, Calendar, Contacts, Messages, Maps, and Safari through a single, signed, notarized menu-bar app. Instead of granting Full Disk Access to every editor that spawns a server, you grant it once to Cupertino.app, which holds the permission on behalf of all twelve surfaces. The MCP server packages are MIT-licensed and published on npm under @mgcrea; the signed app binary is source-available and sold as a one-time purchase covering all 1.x releases.

What It Is

Cupertino is a macOS-only MCP host and server bundle that bridges Apple's native apps to AI agents. It ships twelve surfaces — Mail, Notes, Reminders, Calendar, Contacts, Messages, Maps, Safari, Screen, Sound, Desktop, and Simulator — each as its own MCP server. The servers are plain Node.js packages that can be run directly via npx with no licence key; the signed app is what consolidates the macOS permission model into a single, auditable process. The project is unofficial and not affiliated with Apple.

Permission Architecture

Full Disk Access on macOS is indivisible: granting it to an editor grants it to every extension and subprocess that editor runs. Cupertino's core design decision is to hold that one grant in a single signed, notarized binary (io.mgcrea.cupertino) rather than distributing it across every host. The bundle identifier is the TCC identity, so the grant survives every app update. Automation grants (for Apple Events) are prompted separately, one per target app. Screen Recording, Microphone, and Accessibility are per-process grants that reach beyond any single surface, which is why Screen, Sound, Desktop, and Simulator arrive switched off by default.

Surfaces and Tool Design

Each surface exposes a fixed set of read tools (always registered) and write tools (invisible — not merely refused — unless *_ALLOW_WRITES is enabled for that surface). The tool list is a pure function of allowWrites and nothing else, because MCP clients cache it. Key surface details:

• Mail: 21 tools; uses the Envelope Index directly for millisecond-range searches vs. ~74 seconds over Apple Events; body search narrows via the index then reads survivors, refusing and explaining when the candidate set is too large.
• Notes: 13 tools; fully usable below ~5k notes without Full Disk Access; attachment bytes require the grant.
• Reminders: 11 tools; lists, due dates, subtasks, and search across every account.
• Calendar: 10 tools; expands repeating events properly; every result carries the window the expansion covers and sets truncated when a range runs past it.
• Contacts: 7 tools; resolves phone numbers and email addresses to names, which makes the Messages surface readable.
• Messages: 9 tools; reads iMessage, SMS, and RCS from chat.db, including messages stored only in NSArchiver blobs that SQL cannot reach (the dominant format since early 2026).
• Maps: 13 tools; reads favourites, Guides, and recents from a Core Data store; writes go directly to the store without an Apple Event because Maps ships no scripting dictionary.
• Safari: 14 tools; history and bookmarks via Full Disk Access, live tabs via Automation, and page contents via a bundled Safari extension that Safari scopes per website.
• Desktop: 17 tools; drives any app's interface through AXUIElement natively (not via osascript), measured at 1.24 ms per round trip vs. ~33.6 ms through System Events.
• Simulator: 10 tools; reads and drives an iOS Simulator's accessibility tree in iOS points with no WebDriverAgent required.

Observability and Audit

Every tool call is visible in the Activity window, grouped by client, live. The menu bar shows which client is talking to which server and how many tools it has called. By default the log is a bounded ring in memory cleared on quit. An opt-in audit log writes append-only JSONL under Application Support, with each record hashed against the previous one so edited or missing records are detectable. Message contents are blanked unless explicitly enabled per surface; results are recorded only for surfaces that opt in. No data is sent off the Mac; the only network connection Cupertino can make is an opt-in update check that carries no identifier.

Client Wiring and Setup

Cupertino configures Claude Code, Claude Desktop, Cursor, LM Studio, Windsurf, VS Code, and Codex with one click per client — merging into existing config files, backing them up first, and leaving all other keys untouched. It can also be installed via Homebrew: brew install --cask mgcrea/tap/cupertino. The npm packages run standalone via npx with no app required, though without the app the Full Disk Access grant lands on whichever process launched the server. Requires macOS 26 or later for the signed app; the Node.js server packages carry no macOS version floor.

Update: Version 1.21.1

The latest release is Cupertino 1.21.1 (tagged app-v1.21.1), published on 2026-09-11. Releases are tagged per package (mail-v1.21.1, reminders-v1.21.1, etc.) and ship as a signed, notarized Cupertino.zip attached to the GitHub release alongside its SHA-256. The project was created in August 2026 and has seen active development through September 2026. The Desktop surface was notably updated to use native AXUIElement calls rather than routing through System Events, reducing per-attribute round-trip cost from ~33.6 ms to 1.24 ms.