Local MCP

Send Message

send_message

Destructive

Sends an iMessage via the Mac's Messages.app to a recipient handle (phone number with country code, e.g. +14155551234, or an Apple ID email). This is a write operation: the first call (without confirm) returns a preview; call again with confirm=true to actually send. Direct (1:1) iMessage only — sending into an existing group chat isn't supported yet. Optionally attach files (a photo, a PDF, a vCard) via attachments — each is sent as its own iMessage, in order, before the text. If every attachment fails, the text is not sent either; if some succeed, the text still sends and attachments_failed lists what didn't go through. A send that Messages refuses comes back as an error, not as a result with sent=false. Requires Messages.app signed in to iMessage + Automation permission. send_message reaches iMessage only: a contact who is not on iMessage (an SMS / green-bubble conversation) cannot be messaged with this tool, and SMS relay through the iPhone is not supported.

Input Schema

Name	Required	Description
`to`	Yes	Recipient handle: phone number with country code (+14155551234) or Apple ID email.
`text`	Yes	Message body to send.
`confirm`	No	Set true to actually send. Without it, returns a preview only.
`remember`	No	With confirm: true, also stop asking for this kind of action from now on. Only when the person said so ("don't ask again"). The person can revoke it in LMCP or with set_always_allowed.
`attachments`	No	Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.

Output Schema

Name	Required	Description	Default
`to`	No
`note`	No
`sent`	No
`text`	No
`error`	No
`preview`	No
`service`	No
`attachments`	No
`attachments_failed`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 24, 2026

addedInput schema / properties / remember

Added value: +{
+  "description": "With confirm: true, also stop asking for this kind of action from now on. Only when the person said so (\"don't ask again\"). The person can revoke it in LMCP or with set_always_allowed.",
+  "type": "boolean"
+}

Changed3 schema fields changedSep 30, 2026

addedInput schema / properties / attachments

Added value: +{
+  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
+  "type": "string"
+}

addedOutput schema / properties / attachments

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / attachments_failed

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

Changed3 schema fields changedSep 29, 2026

removedInput schema / properties / attachments

Removed value: -{
-  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
-  "type": "string"
-}

removedOutput schema / properties / attachments

Removed value: -{
-  "items": {
-    "type": "string"
-  },
-  "type": "array"
-}

removedOutput schema / properties / attachments_failed

Removed value: -{
-  "items": {
-    "type": "string"
-  },
-  "type": "array"
-}

Changed3 schema fields changedSep 23, 2026

addedInput schema / properties / attachments

Added value: +{
+  "description": "Files to send, as comma-separated absolute paths (e.g. a photo or PDF). Each is sent as a separate iMessage, before the text.",
+  "type": "string"
+}

addedOutput schema / properties / attachments

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / attachments_failed

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

First observedJun 30, 2026

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=true, openWorldHint=true, so the safety profile is covered. The description still adds real context: the two-step confirm gate, that refusals come back as errors rather than sent=false, and how partial attachment failure behaves. Useful additions, though it doesn't describe the preview payload or output fields in depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Long but dense and front-loaded: purpose and confirm flow come first, then attachments behavior, then permissions and limits. The closing sentence about iMessage-only/SMS relay partly repeats the earlier '1:1 only' statement, which is the main redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers everything an agent needs for a destructive send tool with an output schema: preview/confirm flow, permission prerequisites, error semantics, attachment partial-failure reporting via attachments_failed, and hard channel limits. Nothing consequential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning: 'confirm' as a preview-then-send gate, 'attachments' as comma-separated absolute paths sent in order before the text, and the implication of 'remember' requiring confirm. It does not restate 'to'/'text' beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and channel ('Sends an iMessage via the Mac's Messages.app') plus the recipient handle format, and explicitly scopes it: 1:1 only, iMessage only, no SMS relay. That distinguishes it cleanly from the many other send_message-style siblings (telegram, whatsapp, teams, email).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use mechanics: first call returns a preview, call again with confirm=true to send, and states prerequisites (Messages.app signed in + Automation permission). It also rules out group chats and SMS contacts. It stops short of naming sibling alternatives for non-iMessage recipients, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Local MCP tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.