Apple Notes MCP
Provides tools for searching and editing Apple Notes on macOS, including hybrid semantic/full-text search, note retrieval, creation, updating, appending, moving, and backup, with folder scoping.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Apple Notes MCPwhat did I decide about the pricing model last spring?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Apple Notes MCP
Let Claude, Cursor, or Codex search and edit your Apple Notes — by meaning, entirely on your Mac.
You ▸ What did I decide about the pricing model back in spring?
Claude ▸ [search-notes] "Pricing v3" (Apr 14) — you settled on usage-based
with a floor, after rejecting per-seat in "Pricing v2".You didn't name the note. There's no folder called "pricing." No API key was used, and nothing left your laptop.
Features
Search finds notes you can't remember the words for
Every note is embedded on-device with all-MiniLM-L6-v2 into
LanceDB, alongside a full-text index. A
query runs both and fuses the two rankings with Reciprocal Rank Fusion.
Why both: keyword search fails when you remember the idea but not the phrasing. Vector search fails on exact strings — an error code, an invoice number, a person's name. Fusing them ranks a note that scores mid-range on both above one that spikes on only one, so you don't have to guess which kind of query you're making.
Writes that can't quietly destroy a note
Six write tools, with three guarantees:
Guarantee | Why it matters |
Every mutation snapshots the old body to disk first, and returns the path | An agent editing your notes is unreviewed by definition. You get an undo file even when the edit was wrong. |
Ambiguous titles refuse to write — two notes sharing a title is an error, not a coin flip | Silently overwriting the wrong note is unrecoverable in a way an error message isn't. |
| "Add this to my todos" must never replace the todo list. Separating them makes the destructive option an explicit choice. |
Reading an untrusted note can't execute code
The obvious way to drive Apple Notes is to interpolate a title into a script:
const title = "${title}" // ← arbitrary code executionA title containing " closes that literal, and the rest runs as JavaScript for
Automation — shell commands, file reads, exfiltration. Note titles are not
trusted input: they arrive from shared notes, mail-to-Notes, imports, and sync
from other devices.
This server removes the vulnerability class instead of escaping around it. The
JXA scripts are static files shipped in the package, titles and bodies are
passed as argv and read inside run(argv), and subprocess always runs
with an argument list and shell=False. No user-controlled text ever enters
any program source. Full review in SECURITY.md.
Fully local
No API keys, no account, no telemetry. The only network request in the tool's life is a one-time ~90 MB model download — after that it works on a plane.
Built to survive macOS updates
Notes are read through Apple's automation API, not by parsing the private
NoteStore.sqlite. Direct sqlite reads are faster, but Apple reshapes that
schema between releases and stores bodies as gzipped protobuf. Via the automation
API, macOS's own permission prompt is the consent gate and an OS update doesn't
silently corrupt your index.
Folder scoping everywhere
get-note, update-note, append-note, backup-note, and move-note all take
an optional folder. Pass it and same-titled notes in other folders or iCloud
accounts stop shadowing your target.
Related MCP server: MCP Apple Notes
Requirements
macOS (Apple Notes and osascript are macOS-only) · Python 3.10+ · ~500 MB disk
for the model and its torch dependency.
Setup
1. Install
uv tool install applenotes-mcpbrew install uv && uv tool install applenotes-mcp # recommended, isolated
# or pip, inside a virtualenv
python3 -m venv ~/.venvs/notes && ~/.venvs/notes/bin/pip install applenotes-mcpThe package isapplenotes-mcp — no hyphen after "apple". The name
apple-notes-mcp on PyPI is a different, unrelated project, so
uvx apple-notes-mcp fetches the wrong thing.
2. Register it with your client
Every client runs the same command, uvx applenotes-mcp. Find your row:
Client | How |
Claude Code |
|
Claude Code — plugin (recommended) | see below — registers the server and teaches Claude to use it |
Cursor |
|
Codex CLI |
|
Claude Desktop | Settings → Developer → Edit Config |
VS Code / Copilot |
|
Zed |
|
Windsurf |
|
Cursor, Claude Desktop, and Windsurf take this exact JSON:
{
"mcpServers": {
"apple-notes": { "command": "uvx", "args": ["applenotes-mcp"] }
}
}Codex uses TOML:
[mcp_servers.apple-notes]
command = "uvx"
args = ["applenotes-mcp"]VS Code nests under servers, Zed under context_servers. Ready-to-paste files
for every client are in integrations/.
Claude Code plugin
One step for the server plus an apple-notes skill:
/plugin marketplace add ashishakkumar/apple-notes-mcp
/plugin install apple-notes-mcp3. Teach your agent to use it well
Optional, but the highest-leverage step. Step 2 connects the tools; this explains
when to reach for them — search before asking which note, why append-note
beats update-note, what to do with an ambiguous title. Without it, agents tend
to ask you for a note title instead of just searching.
Client | File | Put it in |
Claude Code | ships with the plugin, or copy to | |
Cursor |
| |
Codex & everything else | append to your |
4. Grant permission and index
Ask your assistant: "Index my Apple Notes."
macOS prompts for permission to control Notes. Approve it — nothing works until you do. (Later: System Settings → Privacy & Security → Automation.)
The first run downloads the model once, then embeds every note. Seconds for a few hundred notes, a couple of minutes for thousands.
Ask something real: "What did I write about the Q3 budget?"
Re-run index-notes after adding or editing notes — the index is a snapshot, not
a live view.
claude mcp list # Claude Code
# any client — does the server start and speak MCP?
echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}' \
| uvx applenotes-mcpA JSON reply naming apple-notes means the server is fine, and any remaining
problem is client config.
Tools
Read
Tool | Does |
| Hybrid semantic + full-text search. The one you'll use most. |
| One note in full, by exact title. Optional |
| Every folder name. |
| Titles inside one folder. |
| How many notes are indexed. |
| Rebuild the index from scratch. |
Write — each snapshots the old body to ~/.local/share/apple-notes-mcp/backups/ first.
Tool | Does |
| Add HTML to the end of a note. Prefer this over |
| Replace a note's body wholesale. |
| New note in the default folder. |
| New note in a named folder. Fails if it doesn't exist. |
| Move a note to another folder. |
| Snapshot on demand, before a risky multi-step edit. |
Bodies are HTML on a single line, capped at 2 MB.
What to know before indexing
Indexing reads every note in full. That's the point, but be deliberate.
The index is unencrypted at
~/.mcp-apple-notes/data, protected only by file permissions and FileVault. Treat it as sensitive as your notes.Prompt injection is inherent to RAG. A note can contain text aimed at the assistant reading it. No MCP server can neutralize that.
Path | Contents |
| LanceDB vector + full-text index |
| Pre-mutation snapshots ( |
Purge everything: rm -rf ~/.mcp-apple-notes ~/.local/share/apple-notes-mcp
Troubleshooting
Symptom | Fix |
| Automation permission missing. System Settings → Privacy & Security → Automation → your client → enable Notes. |
| Same. Quit and reopen the client after granting. |
First search hangs for a minute | One-time model download. Instant afterwards. |
Search misses a note you just wrote | Re-run |
|
|
Won't start on Linux or Windows | It can't — Apple Notes is macOS-only. |
Bonus: conversation-tag for Ghostty
plugin/ is an optional macOS + Ghostty extra:
it tags each terminal tab with a pixel-art sprite and title pulled from today's
Apple Notes todo list, so six parallel Claude sessions stop looking identical.
Built on this server, installed via its own install.sh (it writes a GPU shader,
which the plugin system can't do). See plugin/README.md.
Development
git clone https://github.com/ashishakkumar/apple-notes-mcp && cd apple-notes-mcp
uv venv
uv pip install --group test # pytest + light runtime deps
uv pip install -e . --no-deps # skips torch; the tests stub the embedder
uv run pytestThe suite stubs _run_jxa, the single boundary to macOS, so it runs on any
platform and covers injection safety, UTF-8 byte caps, ambiguity refusal,
backup-before-mutate ordering, path traversal in backup filenames, and RRF
fusion. CI additionally exercises mcp 1.x and 2.x and completes a real stdio
handshake.
Credits
Python port of mcp-apple-notes
by Rafal Wilinski, rewritten to close the injection issues in the original and
add write tools, backups, and folder scoping.
MIT — see LICENSE.
Available Tools
12 toolsappend-noteA
Append HTML to the body of an existing Apple Note matched by exact title. Content must be HTML without newlines. The current body is snapshotted to disk before being modified. Fails (and leaves the note untouched) if zero or multiple notes share the title within the resolved scope (the whole Notes app if folder is omitted, otherwise just that folder). Pass folder whenever you know which folder the target note lives in.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | No | ||
| content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It discloses key behavioral traits: HTML content with newline constraint, disk snapshot before modification, failure without altering note when zero/multiple matches, and the resolved scope behavior with folder. This is exceptionally transparent for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, each earning its place. The core action leads, followed by constraints, failure semantics, and a practical recommendation. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is moderately complex with failure modes and an optional folder scope. The description covers the operation, content constraints, failure conditions, scope resolution, and a usage recommendation. Output schema exists, so return values don't need elaboration. Complete for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains `title` requires exact match, `content` must be HTML without newlines, and `folder` acts as a scope limiter (whole app if omitted, otherwise a specific folder). This adds significant meaning beyond the bare schema, though a bit more on content format could push it to 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Append') and resource ('body of an existing Apple Note') with a clear matching criterion ('exact title'). It clearly distinguishes from sibling tools like create-note and update-note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises passing `folder` when known and explains the failure mode when zero or multiple notes match. While it doesn't name alternatives directly, the scoping and disambiguation guidance are clear. It could be stronger by explicitly contrasting with create-note or update-note, but the usage context is well implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
backup-noteA
Snapshot the current HTML body of a note (matched by exact title) to disk and return the file path. Useful before risky multi-step edits. Fails if zero or multiple notes share the title within the resolved scope. Pass folder to scope the lookup to a single folder.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavior. It discloses side effects (writes to disk, returns file path), failure modes (zero or multiple title matches), and scoping behavior via folder. It stops short of explicitly stating that the note is not modified, but 'snapshot' strongly implies non-destructiveness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, with the core action front-loaded. No redundant phrases. Every clause adds value, from the action to the failure conditions to the parameter guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a 2-parameter tool with an output schema, the description covers purpose, usage timing, error behavior, and parameter semantics. It also notes the folder scoping option. The output schema supplies return type, so the description need not repeat it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates: 'matched by exact title' explains the title parameter, and 'Pass `folder` to scope the lookup to a single folder' explains the folder parameter. Both parameter meanings are clarified beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Snapshot', the resource 'HTML body of a note', and the action 'to disk and return the file path'. It also specifies exact-title matching, which distinguishes it from siblings like get-note or update-note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context: 'Useful before risky multi-step edits.' It also explains failure conditions and folder scoping. However, it does not explicitly mention when NOT to use it or name alternative tools, so it lacks full exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create-noteB
Create a new Apple Note. Content must be HTML without newlines.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds one important constraint ('Content must be HTML without newlines') but does not describe other behavioral aspects like whether the note is created in a default folder, what the response or output contains, or any side effects or permissions required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences that immediately state the core purpose and the key constraint. Every word adds value, and the critical content rule is front-loaded, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple create-note tool, the description covers the essential operation and the one critical input constraint. However, it lacks context about how this tool differs from 'create-note-in-folder' and does not mention output behavior. Since an output schema exists, return values need not be described, but the sibling differentiation gap makes it incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does add semantics for the 'content' parameter by specifying the HTML and newline constraints, but it provides no additional meaning for the 'title' parameter, leaving it only as a string type in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action and resource: 'Create a new Apple Note.' It is specific enough to indicate the tool creates a note, but it does not explicitly differentiate from the sibling 'create-note-in-folder' by noting the default location or absence of folder selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'create-note-in-folder' or 'append-note'. The description lacks any contextual or conditional information that would help an agent choose this tool over its siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create-note-in-folderA
Create a new Apple Note inside a specific folder. Content must be HTML without newlines. Fails if the folder does not exist — use list-folders to check first.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | Yes | ||
| content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses two key behaviors: the HTML-without-newlines constraint and the failure when the folder doesn't exist. However, it omits other relevant context such as authentication requirements, idempotency, or response shape, but those partially covered by output schema. Overall, moderate transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences with no fluff. The purpose is front-loaded, and each sentence contributes: purpose, content constraint, and failure mode with mitigation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-param create tool with an output schema, the description is adequately complete. It covers the core purpose, key input constraints, and a common error condition. It doesn't explain folder format or return value, but the output schema likely covers the latter. Slight gap in folder parameter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage, so the description must compensate. It adds meaning for 'content' (must be HTML without newlines) and 'folder' (must exist). It does not clarify whether folder expects a name or ID, and gives no detail on 'title'. Partial compensation, but gaps remain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Create a new Apple Note inside a specific folder,' using a specific verb and resource that distinguishes it from siblings like create-note. The scope ('specific folder') is explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: use this tool to create a note in a specific folder, and indicates a prerequisite: check list-folders first to avoid failure. It does not explicitly name alternatives like create-note, but the guidance is helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get-noteA
Get a note's full content and details by exact title. Optional folder scopes the title lookup to that folder — pass it whenever you know which folder the target note lives in to avoid shadowing by homonyms in other folders/accounts.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses a key behavioral trait: without a folder, homonyms in other folders/accounts may shadow the target note. This goes beyond the generic 'get' operation and adds valuable context, though it doesn't mention read-only nature or error handling, which are less critical given the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action, and efficiently communicates the primary purpose and the optional parameter's rationale. Every word earns its place with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-parameter tool with an output schema, this description covers the essential purpose and behavioral nuance. The folder scoping warning is especially valuable for avoiding pitfalls. No additional context seems necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates. It explains that 'title' is an exact match and that 'folder' scopes the lookup, including the shadowing caveat. This provides meaningful semantics beyond the raw schema field names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get a note's full content and details by exact title' with a specific verb ('Get'), resource ('note'), and qualifier ('full content and details', 'exact title'). This clearly differentiates from siblings like search-notes (searching) and list-notes (listing), as it focuses on retrieval by exact title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you need full content by exact title. It also provides guidance for the optional folder parameter, advising to pass it to avoid homonym shadowing. However, it does not explicitly compare to alternatives or state when not to use it, which would earn a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
index-notesA
Index all Apple Notes for semantic search. Tell the user this can take from a few seconds to a few minutes depending on how many notes they have.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits itself. It mentions that indexing can take from seconds to minutes and instructs to inform the user, which is useful. However, it does not disclose side effects, permissions, or whether the operation is read-only or destructive, leaving some transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and purpose, and includes a practical user-facing instruction. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, zero parameters, and presence of an output schema, the description adequately covers the core purpose and a key user experience note. It could mention side effects or return behavior, but the essential information is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so the baseline per instructions is 4. The description adds no parameter-specific detail, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool indexes all Apple Notes for semantic search, using a specific verb and resource. It is distinct from sibling tools like list-notes or search-notes, which perform different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that indexing is done for semantic search and instructs the user to tell the user about potential duration, implying when to use it. However, it does not explicitly mention alternative tools or when not to use it, though the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-folder-notesB
List the titles of all notes inside a named Apple Notes folder.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only states the action without addressing read-only nature, error behavior (e.g., folder not found), or any side effects. This is a significant gap for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with front-loaded information. Every word is purposeful and there is no redundancy or unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter list tool with an output schema, the description covers the core purpose and return scope (titles in a folder). However, it lacks context about folder validation, empty results, or edge cases. Without annotations, more behavioral context would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only mentions 'named' Apple Notes folder, implying the 'folder' parameter is a folder name. It does not clarify whether it should be the exact name, ID, or path, nor does it specify case sensitivity or existence requirements. The description adds minimal meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('titles of all notes inside a named Apple Notes folder'), clearly distinguishing it from siblings like list-notes (which likely lists all notes) and list-folders. The scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as list-notes or search-notes. It implies usage via 'inside a named Apple Notes folder' but does not explicitly state when this is preferred or when other tools should be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-foldersA
Return the names of all Apple Notes folders.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It states this is a read-only operation ('Return the names'), but does not disclose potential edge cases (e.g., empty folders, ordering, hidden folders) or any other behavioral traits. It is minimally transparent but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the key action and resource. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and an output schema available, the description is sufficiently complete. It unambiguously states what the tool returns, and the output schema likely covers any return format details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema is fully covered. No parameter explanation is needed, and the description aligns with this. Baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Return' and the resource 'names of all Apple Notes folders'. This distinguishes it from sibling tools like list-notes, which lists notes, and list-folder-notes, which lists notes within a folder.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives. It implies usage for retrieving all folder names, but does not mention exclusion criteria or compare it to related folder tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-notesB
Count the notes currently in the local index.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It clarifies that the count is of the local index, but it does not indicate the return format (count vs. list), which conflicts with the tool name, nor does it mention side effects, freshness, or performance characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. It efficiently states the core function and scope, earning full marks for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with no parameters and has an output schema, so a brief description might be sufficient. However, the mismatch between the tool name and description, combined with the lack of usage guidance, leaves gaps in completeness that prevent a higher score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (empty schema). With no parameters to document, the description need not add parameter details, so the baseline score of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Count the notes') and scope ('currently in the local index'), which clearly differentiates it from sibling tools like get-note or search-notes. However, the tool name 'list-notes' implies enumeration rather than counting, creating some ambiguity about the actual return value.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives such as search-notes or index-notes. There are no mentions of exclusions or conditions that would help an agent decide between tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move-noteA
Move an existing Apple Note (matched by exact title) into the named destination folder. Optional source_folder scopes the title lookup to that folder, so a homonym in another folder doesn't trigger ambiguity. Fails if the note is missing, ambiguous within the resolved scope, or the destination folder does not exist.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | Yes | ||
| source_folder | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses key behaviors: exact title matching, folder scoping, and failure conditions (missing, ambiguous, destination nonexistent). It doesn't state outcomes like whether the note is removed from the source folder, but the act of moving is clear and the output schema likely covers return values.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the primary action, then the optional parameter caveat, then failure conditions. Every sentence adds value with no redundancy or filler, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters, no annotations, and an output schema present, the description covers the main behavioral contract: what it does, how to disambiguate, and when it fails. It doesn't elaborate on return values, but the output schema can address that. The main gap is absence of details about how 'folder' names are resolved (e.g., exact match vs. case-insensitive), but this is a minor omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain parameters. It does: 'title' is the exact title to match, 'folder' is the destination, and 'source_folder' scopes the lookup to avoid homonym ambiguity. This gives meaning beyond the bare schema properties, though it doesn't detail edge cases like case sensitivity or folder naming formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool moves an existing Apple Note by exact title into a destination folder. The verb 'Move' and resource 'Apple Note' specify the action and target, and details like 'matched by exact title' and failure conditions distinguish this from sibling tools like update-note or get-note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool (moving notes between folders) and explains the optional source_folder for disambiguation. It doesn't explicitly name alternatives but implies that moving is distinct from other note operations, and the context is sufficient to infer the intended use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search-notesA
Search notes by meaning and by text (hybrid vector + full-text search).
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the hybrid vector + full-text search behavior, which is valuable, but does not mention any other behavioral aspects (e.g., read-only, result limits). The disclosure of the hybrid method adds meaningful context beyond the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-front-loaded sentence with zero waste. It states the primary action, the target, and the key behavioral nuance (hybrid search) in a compact form.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and an output schema exists, the description covers the essential context: what the tool does and its unique search method. It does not detail output format, but that is not required when an output schema is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has only one parameter with no description, but the tool description explains that the query is used for searching 'by meaning and by text', giving purpose to the parameter. This compensates for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Search' with a clear resource 'notes' and distinguishes the tool by specifying the hybrid method ('by meaning and by text (hybrid vector + full-text search)'). This clearly sets it apart from siblings like list-notes or get-note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when you need to find notes by meaning or text. It does not explicitly name alternatives or exclusions, but the context is clear enough for an agent to decide between search and other note-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update-noteA
Replace the body of an existing Apple Note matched by exact title. Content must be HTML without newlines. The current body is snapshotted to disk before being overwritten. Fails (and leaves the note untouched) if zero or multiple notes share the title within the resolved scope (the whole Notes app if folder is omitted, otherwise just that folder). Pass folder whenever you know which folder the target note lives in — it eliminates spurious 'multiple notes share that title' errors caused by homonyms in other accounts/folders.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| folder | No | ||
| content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses critical behaviors: content must be HTML without newlines, the current body is snapshotted to disk before overwrite, and the operation fails atomically ('leaves the note untouched') on ambiguity. This exceeds expected transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense with no fluff, but the final sentence about eliminating spurious errors could be seen as slightly redundant given the earlier failure explanation. Still, it earns its place by providing reasoning. Overall well-organized with purpose first, then constraints, then usage tip.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, the description covers all necessary context: what it does, input constraints (HTML, no newlines), side effects (snapshot), failure modes and conditions, and scope resolution. The output schema exists, so return values need no explanation. This is a fully specified description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must compensate. It does so thoroughly: 'title' is exact title match, 'content' is HTML without newlines, and 'folder' is optional scope with clear default behavior (whole Notes app vs a specific folder) and concrete rationale for passing it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource: 'Replace the body of an existing Apple Note matched by exact title.' This distinguishes it from siblings like append-note (append) and create-note (create). The exact-title matching criterion adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs when to use the tool and how to avoid errors: 'Pass folder whenever you know which folder the target note lives in.' It also explains failure conditions ('Fails if zero or multiple notes share the title') and the resolved scope behavior, which serves as when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools have clear, distinct purposes (get vs search, update vs append). The only potential confusion is between list-notes (which counts indexed notes) and list-folder-notes (which lists titles in a folder), and between create-note and create-note-in-folder, but the descriptions clarify these differences.
All tool names follow a consistent kebab-case verb-noun pattern (e.g., list-notes, get-note, update-note). Even the multi-word create-note-in-folder follows the same readable convention, making the set highly predictable.
With 12 tools, the server is well-scoped for Apple Notes management. It covers listing, indexing, searching, creating, updating, appending, backing up, and folder operations without feeling bloated or sparse.
The server provides strong read, create, and update capabilities, but lacks a delete-note tool, which is an obvious gap for a notes management server. Additionally, there is no way to list all notes across folders (only count via list-notes or list by folder), limiting full inventory management.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Search, read, and write your Apple Notes from ChatGPT/Claude via a local Mac agent + MCP relay.
Securely search, create, and organize your Mem notes and collections from AI assistants.
Let ChatGPT, Claude & Cursor use your Mac: email, calendar, iMessage, Teams, files. Local, free.
Voice notes that organize themselves. Capture by Siri, AI auto-tags, semantic search retrieves.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceEnables semantic search and RAG (Retrieval Augmented Generation) over your Apple Notes.433412MIT
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI assistants like Claude to search and reference your Apple Notes using semantic search and RAG capabilities, with fully local execution and no API keys required.433
- FlicenseAqualityDmaintenanceA local-only server that enables AI agents to create, read, search, and organize Apple Notes directly on macOS. It supports folder management, note formatting, and checklists using native automation to ensure data remains private and local.2414
- AlicenseAqualityDmaintenanceEnables AI assistants to read, search, and create notes in Apple Notes on macOS via JXA, with fast bulk operations and a compact schema.7142MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ashishakkumar/Apple-Notes-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server