Local MCP

Send Message

send_message

Sends an iMessage via the Mac's Messages.app to a recipient handle (phone number with country code, e.g. +14155551234, or an Apple ID email). This is a write operation: the first call (without confirm) returns a preview; call again with confirm=true to actually send. Direct (1:1) iMessage only — sending into an existing group chat isn't supported yet. Optionally attach files (a photo, a PDF, a vCard) via attachments — each is sent as its own iMessage, in order, before the text. If every attachment fails, the text is not sent either; if some succeed, the text still sends and attachments_failed lists what didn't go through. A send that Messages refuses comes back as an error, not as a result with sent=false. Requires Messages.app signed in to iMessage + Automation permission.

Input Schema

TableJSON Schema

Name	Required	Description
`to`	Yes	Recipient handle: phone number with country code (+14155551234) or Apple ID email.
`text`	Yes	Message body to send.
`confirm`	No	Set true to actually send. Without it, returns a preview only.
`attachments`	No	Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`to`	No
`note`	No
`sent`	No
`text`	No
`error`	No
`preview`	No
`service`	No
`attachments`	No
`attachments_failed`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedSep 30, 2026

addedInput schema / properties / attachments

Added value: +{
+  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
+  "type": "string"
+}

addedOutput schema / properties / attachments

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / attachments_failed

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

Changed3 schema fields changedSep 29, 2026

removedInput schema / properties / attachments

Removed value: -{
-  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
-  "type": "string"
-}

removedOutput schema / properties / attachments

Removed value: -{
-  "items": {
-    "type": "string"
-  },
-  "type": "array"
-}

removedOutput schema / properties / attachments_failed

Removed value: -{
-  "items": {
-    "type": "string"
-  },
-  "type": "array"
-}

Changed3 schema fields changedSep 23, 2026

addedInput schema / properties / attachments

Added value: +{
+  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
+  "type": "string"
+}

addedOutput schema / properties / attachments

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / attachments_failed

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

First observedJun 30, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (readOnlyHint=false, openWorldHint=true, destructiveHint=false): it discloses the two-step preview/confirm write flow, that attachments are sent as separate ordered messages before the text, the partial-failure semantics ('if every attachment fails, the text is not sent'), and that refused sends surface as errors rather than sent=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and scope, and essentially every sentence carries distinct operational information. It is a dense single block rather than bulleted, and the attachment-failure sentence is long, but there is little dead weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the aspects an agent needs to call it correctly — confirm handshake, attachment ordering and failure modes, error-vs-result behavior, and environment prerequisites. An output schema exists, so return-value detail is correctly left out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds genuine meaning: the confirm parameter's preview-then-send contract and the attachments ordering/partial-failure behavior are not derivable from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Sends an iMessage via the Mac's Messages.app') and names the exact transport, which separates it from the many other send_* siblings (whatsapp_send_message, teams_send_message, signal, zalo, send_email). It also pins the scope: direct 1:1 only, group chat unsupported.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use: 1:1 only, requires a recipient handle format, and states the prerequisites (Messages.app signed in to iMessage + Automation permission). It does not, however, explicitly route the agent to siblings (e.g. group chat or other channels), so the 'use X instead' guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Local MCP tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.