Apple Messages MCP
Read, search, and (cautiously) send iMessage/SMS/RCS conversations from Claude on macOS, backed by the TCC-protected chat.db plus Messages scripting.
get_stats— message/chat totals, group chats, unread count, attachments, per-service breakdown (iMessage/SMS/RCS), date range, database sizelist_chats— conversations newest-first, with participants, contact names, last-message preview and count; paged vialimit/offsetget_chat_messages— one conversation's messages oldest-first, paged backwards withbefore_idsearch_messages— case-insensitive substring search over all history (index-backed), filterable bychat_id,from_me, andafter/beforedates; filters alone read a conversation newest-firstget_message— single message in full: text, sender, tapbacks, edit/unsend flags, replies, delivery and read timestamps, attachment listget_attachment— fetch an attachment's bytes, base64-encodedrefresh_search_index— warm or fully rebuild the local search mirror (optional; searches self-refresh)compose_message— opens Messages with recipient and text prefilled and stops; the safe default and the only way to start a new conversationsend_message— delivers immediately to an existingchat_id(Messages picks the transport); irreversible, requiresconfirm=TrueThe four read tools also render inline MCP Apps cards in the chat (conversation list, iMessage-style transcript, highlighted search hits, single bubble)
Handles modern quirks: typedstream
attributedBodydecoding, Apple-epoch timestamps, tapbacks, edits, unsends, threaded replies
Caveats: requires macOS 13+ (RCS needs 26+) with Full Disk Access, plus Automation permission for sending and contact names; live send delivery is implemented but unverified.
Provides tools for reading, searching, and sending Apple Messages (iMessage, SMS, and RCS) on macOS, including conversations, message history, attachments, and chat statistics.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Apple Messages MCPFind messages about dinner plans from last weekend"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Apple Messages MCP
Read and search your iMessage, SMS, and RCS conversations from Claude, on macOS.
Companion to claude-connector-apple-mail and claude-connector-apple-reminders.
Status: reading and searching are solid. Sending works but is unproven on a
live send — the scripting call is implemented and its syntax verified, but
Apple has broken send before, so treat the first real send as a test. See
Sending messages.
Tools
Tool | Description |
| Totals, unread count, per-service breakdown (iMessage/SMS/RCS), date range |
| Conversations, most recently active first, with participants and a preview. Renders as a card |
| Messages in one conversation, oldest-first, paged. Renders as a bubble transcript |
| Substring search over all history, filtered by chat, sender, and date range. The search term is optional — pass filters alone to read a conversation. Renders as a card |
| One message in full, with attachments and delivery timestamps. Renders as a card |
| Attachment bytes, base64-encoded |
| Warm or rebuild the local search index |
| Open Messages with text prefilled — you press send |
| Send to an existing conversation; delivers immediately |
Related MCP server: iMessage MCP Server
Previews in the chat
The four read tools render an inline card in the transcript, the way the Gmail and Superhuman connectors show an email instead of a wall of JSON:
Tool | Card |
| A conversation list like the Messages sidebar — avatar, name, last-message preview, relative date, a green dot for SMS/RCS |
| An iMessage-style transcript — blue/green bubbles for you, grey for them, day separators, sender names in groups, tapbacks, attachments, edited and unsent markers |
| Hit rows across conversations with the match highlighted; scoped to one |
| One bubble plus delivery details and the attachment list |
This is MCP Apps
(io.modelcontextprotocol/ui), built the same way as the Apple Mail
connector's preview_email so the two cards read as one family: the same host
tokens and fallback palette, the same header/footer chrome, avatar colours and
date formatting, the same handshake. Each of those tools carries
_meta.ui.resourceUri (and the pre-GA flat _meta["ui/resourceUri"], which
some hosts still read) pointing at ui://apple-messages/message-preview, a
single self-contained HTML document the server serves as
text/html;profile=mcp-app. Claude Desktop renders it in a sandboxed iframe
and streams the tool call's arguments and result to it over postMessage
(ui/initialize, ui/notifications/tool-input, ui/notifications/tool-result).
The document reads the host's theme and CSS variables so it matches light and
dark mode, reports its own height so the card fits its content, and collapses
long transcripts behind a Show all button.
Nothing about the tool results changed: a host without Apps support ignores the metadata and sees the same JSON as before, which is also what the model reads. One document serves all four tools — it picks a view from the tool name the host reports, falling back to the shape of the structured result.
The document lives at src/apple_messages_mcp/ui/message_preview.html, with
the Messages icon inlined as a data URI at load time (the sandbox blocks
outside fetches, so the page must be self-contained). Like the Mail card it
draws its own border (prefersBorder: false) and declares no CSP allowances,
so the host runs it under the strictest default: no network, no nested frames.
The "Widget from Apple Messages" label above the card is the host's own chrome
for MCP Apps, not something the connector controls. tests/test_preview.py drives
the real server over the SDK's in-memory transport and checks the tool
metadata, the resource, and the result shapes the card dispatches on.
Requirements
macOS 13 Ventura or later. RCS requires macOS 26 or later.
Full Disk Access for the Claude app — required for reading.
Automation permission for Messages — required for sending and for contact names. macOS prompts for this one automatically.
Granting Full Disk Access
System Settings → Privacy & Security → Full Disk Access
Enable Claude (add
/Applications/Claude.appwith + if it isn't listed)Quit and reopen Claude. macOS caches this permission at process launch, so the restart is mandatory — the extension will keep failing without it.
Why this needs Full Disk Access when Apple Mail doesn't
The Apple Mail extension talks to Mail.app entirely through scripting, so it needs no special permissions. Messages cannot work that way.
Messages' AppleScript dictionary exposes exactly four classes — account,
chat, participant, file transfer — and no message class. Verified on
macOS 26.5.2:
$ osascript -e 'tell application "Messages" to get every text message of first chat'
syntax error: Expected "from", etc. but found identifier. (-2741)Chats and participants enumerate fine; message bodies are simply not exposed.
So the only read path is SQLite over ~/Library/Messages/chat.db, which is
TCC-protected. Unlike Automation, Full Disk Access cannot be requested
programmatically — the user must grant it by hand.
The extension therefore uses both permissions for different jobs:
Concern | Mechanism | Permission |
Messages, chats, search, attachments | SQLite on | Full Disk Access |
Contact names for raw handles | Messages scripting | Automation |
Sending | Messages scripting ( | Automation |
Compose window, prefilled |
| none |
Contact names come from Messages' participant class (full name), which reads
the user's Contacts card. That sidesteps the separately-protected AddressBook
database — if Automation is denied, handles simply render as raw numbers.
Implementation notes
attributedBody. Since Ventura, message.text is frequently NULL and the
body lives in message.attributedBody as an Apple typedstream — the legacy
NSArchiver format, which plistlib cannot read. typedstream.py decodes it in
pure Python, so the bundle needs no PyObjC dependency. It anchors on the
NSString/NSMutableString class name and reads the length-prefixed UTF-8
payload after the + type marker. Decoding is total: an undecodable body yields
None rather than failing the query.
Timestamps. message.date is Apple-epoch (2001-01-01), in seconds before
macOS 13 and nanoseconds since. Both are detected and handled.
Search. chat.db ships no text index, and most bodies live only in
attributedBody, where SQL cannot see them. That combination is nastier than
it looks.
The first implementation widened its predicate to
m.text LIKE ? OR m.attributedBody IS NOT NULL and re-filtered the decoded
text in Python. Because that second clause is true for nearly every modern
row, the query's LIMIT truncated the scan to the newest few hundred messages
before the Python filter ever ran — so any older match silently disappeared. A
search for a real message returned zero results rather than being slow. On a
916 MB history that meant search effectively covered only the last few days.
The fix is to decode once instead of per query. index.py mirrors decoded,
casefolded bodies into ~/Library/Caches/apple-messages-mcp/search-index.db,
which searches then join against — so the match, the filters, the ordering and
the LIMIT all apply to the complete history in SQL. The mirror is:
Incremental. New messages are found by a
message.ROWIDwatermark. Edits and unsends reuse an existing ROWID, so each refresh also looks at the most recent 2000 rows — but only at those withdate_editedset or with both body columns now NULL, since re-decoding 2000 blobs on every search is real work that almost always finds nothing. An edit that Messages somehow did not stamp, or one older than that window, needsrefresh_search_index(rebuild=True). Improving theattributedBodydecoder also warrants a rebuild; bumpingSCHEMA_VERSIONforces one.Casefolded, and only that. Display text still comes from chat.db, so the mirror is purely a matching oracle. Storing
str.casefold()halves its size and makes case-insensitive matching correct for non-ASCII — SQLite'sLIKEfolds case for ASCII alone.Disposable. It lives in
~/Library/Cachesand rebuilds if deleted. Nothing here writes to chat.db.
Not FTS5, despite the earlier plan here: FTS5 matches whole tokens, so
MATCH 'dentist' never finds "mydentist", which is narrower than the substring
semantics search_messages documents. A substring scan over compact casefolded
text is already fast, so FTS5 would have doubled the index for semantics we
cannot use. Adding it later is a contained change if a query ever does drag.
Read-only and non-locking. Connections open mode=ro and no statement
mutates the database. If SQLite cannot open the live WAL read-only, it falls
back to a private snapshot copy so a running Messages.app is never disturbed.
Tapbacks, edits, replies. Reactions are decoded from
associated_message_type (2000–2007, with the 3000-range as their removals),
threaded replies from thread_originator_guid, and edits from date_edited.
Sending messages
Messages has no draft object, so there is no exact analogue of the Mail extension's draft-first design. The write path therefore comes at two levels, and they are deliberately not equivalent.
compose_message — the safe default. Opens Messages with the recipient and
body prefilled via the imessage: / sms: URL scheme, and stops. A human
reads it and presses send, so nothing leaves the machine on Claude's say-so.
This is also the only way to start a new conversation. Needs no permission at
all.
send_message — delivers immediately. Uses the scripting interface's
send, and cannot be unsent. It takes a chat_id rather than a phone number,
which is not a limitation but the point: the dictionary accepts either a
participant or a chat, and addressing an existing chat by GUID lets
Messages choose the transport (iMessage / SMS / RCS) instead of the caller
guessing and silently sending an SMS to someone on iMessage. It also requires
confirm=True, purely as a guard against being triggered casually.
What is verified, and what is not
Confirmed on macOS 26.5.2 — the dictionary exposes
send : direct-parameter (file | text), to: (participant | chat)the service type enumeration is SMS, iMessage, RCS, chat has a
GUID id property to address, and the generated AppleScript compiles.
Not confirmed: that a live send actually delivers. Apple has broken
AppleScript send before, and its presence in the dictionary has never been
proof that it works. Nothing in the test suite delivers a message, so the first
real send is the experiment. If it fails, shortcuts run with a "Send Message"
action is the fallback worth trying next.
Message text reaches AppleScript as an osascript argument (on run argv)
rather than being interpolated into script source, so a body containing a
double quote is inert rather than a syntax error or an injection.
Sending attachments is not wired up, though the file direct parameter means
it is in reach.
Development
python3 tests/test_db.py # SQL, decoder, and search-index tests
python3 tests/test_send.py # compose URLs, send guards, argv safety
uv run python tests/test_preview.py # MCP Apps preview: tool metadata, resource, result shapes
python3 tools/probe_schema.py # verify the real chat.db (needs Full Disk Access)
./build.sh # test, validate manifest, pack the .mcpbtests/test_db.py builds throwaway databases with the real schema, so the SQL
can be validated without Full Disk Access or a real message history. One of them
buries a match under 3000 newer messages, which is the regression test for the
truncated-search bug described above.
tests/test_send.py never sends anything or opens a window: it covers the URL
builder, the guard clauses, and the exact osascript argv — so it is safe
anywhere, and correspondingly cannot tell you whether Apple's send works.
tests/test_preview.py runs the server in-process through the MCP SDK's
in-memory transport (so it needs the project environment, hence uv run),
against the same synthetic database, with a stub in place of the contact
resolver so it never scripts Messages.app.
None of the suites touch the real search index; each injects a temporary one.
License
MIT
Available Tools
9 toolscompose_messageA
Open Messages with a recipient and text prefilled, WITHOUT sending.
This is the safe way to write a message: it puts the text in front of the
user in Messages and stops, so they read it and press send themselves.
Prefer it over send_message, and use it whenever the conversation does
not exist yet — send_message can only reply to an existing one.
Args: handle: Recipient phone number or email, e.g. "+15551234567". body: Text to prefill. May be empty to just open the conversation. service: "imessage" or "sms" — which transport Messages preselects.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| handle | Yes | ||
| service | No | imessage |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| body | No | |
| note | No | |
| sent | No | |
| handle | Yes | |
| opened | No | |
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly covers the safety profile: the tool prefills the message, stops, and leaves sending to the user. It also states behavior for empty body and service transport selection, which goes beyond basic schema details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the most important fact (does not send), then gives the safety rationale, routing guidance, and compact parameter docs. Every sentence adds value and none are redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple three-parameter compose action with an output schema, and the description covers all parameters, the core behavior, the user-visible side effect, and the distinction from send_message. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the only source of parameter meaning. It compensates fully: handle gets a concrete example, body explains prefill behavior and emptiness, and service gets explicit valid values and meaning ('which transport Messages preselects').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: 'Open Messages with a recipient and text prefilled, WITHOUT sending.' It immediately distinguishes itself from send_message and names exactly what the tool does not do, so an agent can tell it apart from the sibling tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit routing guidance: 'Prefer it over send_message, and use it whenever the conversation does not exist yet — send_message can only reply to an existing one.' This tells the agent when to choose this tool and when to choose the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentA
Retrieve an attachment's bytes, base64-encoded.
Args:
attachment_id: Attachment id from get_message.
| Name | Required | Description | Default |
|---|---|---|---|
| attachment_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| size | Yes | |
| filename | Yes | |
| mime_type | Yes | |
| data_base64 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the retrieval behavior and the base64 encoding, but it does not mention potential side effects, error conditions, size limitations, or response structure. For a read-only retrieval tool this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is minimal and focused: one clear sentence defining the operation, followed by a short, relevant parameter note. Every word contributes to understanding the tool's purpose and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a single parameter and an output schema, the description covers the key operational detail (base64 encoding) and parameter origin. It does not explain what the returned object looks like, but the presence of an output schema reduces the need for that in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds valuable meaning by explaining where attachment_id originates (`from get_message`). This goes beyond the schema's bare integer type and helps the agent source the correct identifier.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Retrieve an attachment's bytes' with the encoding detail (base64). This clearly distinguishes it from sibling tools like get_message, which retrieves message metadata rather than binary content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It specifies that the attachment_id comes from `get_message`, which gives clear contextual guidance on how this tool fits into a workflow. It does not explicitly discuss alternatives or when-not-to-use, but the associated source of the ID is a strong usage signal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_chat_messagesA
Read messages from one conversation, returned oldest-first.
In Claude the result renders as an inline card, so don't repeat its contents in your reply — a one-line summary or the answer to the user's question is enough.
Args:
chat_id: Conversation id from list_chats.
limit: Maximum messages to return (default 50).
before_id: Return messages older than this message id, to page back
through history.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| chat_id | Yes | ||
| before_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the burden and does disclose meaningful behavior: oldest-first ordering, paging semantics via before_id, and Claude-side rendering as an inline card. It stops short of stating read-only safety, rate limits, or default truncation consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then the rendering caveat, then args. Every sentence is useful, though the Claude-specific rendering note is slightly verbose for an agent-facing definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain return values, and params are all covered. For a scoped, read-only read tool this is close to complete; the only gaps are the missing explicit read-only/rate-limit framing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: chat_id is tied to list_chats, limit is defined as max messages with default 50, and before_id is explained as "older than this message id, to page back through history." It could go further on boundary behavior, but all three params are meaningfully covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Read messages") scoped to "one conversation," and adds the ordering guarantee (oldest-first). It implicitly separates itself from conversation-wide search, though it does not name search_messages or get_message explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: it tells the agent to page back with before_id and points at list_chats for the chat_id source, plus a rendering hint. There is no explicit when-to-use-this-vs-search_messages/get_message guidance or when-not condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageA
Read one message in full, including attachments and delivery times.
In Claude the result renders as an inline card, so don't repeat its contents in your reply — a one-line summary or the answer to the user's question is enough.
Args:
message_id: Message id from search_messages or get_chat_messages.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| id | Yes | |
| date | No | |
| guid | Yes | |
| text | No | |
| sender | No | |
| chat_id | No | |
| is_read | No | |
| service | No | |
| tapback | No | |
| chat_name | No | |
| date_read | No | |
| is_edited | No | |
| is_unsent | No | |
| is_from_me | No | |
| attachments | No | |
| sender_name | No | |
| reply_to_guid | No | |
| date_delivered | No | |
| has_attachments | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It discloses the return content (attachments, delivery times) and that it renders as an inline card, which is useful for response formatting. However, it does not state whether it requires authentication, whether it is read-only (implied by 'Read'), or any rate limits or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and result content, then a separate practical instruction about rendering, then the argument. It is appropriately sized for a simple getter. The 'Args:' section is slightly redundant given the schema, but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required param, output schema exists), the description provides enough to invoke correctly and sets expectations about the return format. Missing explicit usage boundaries against sibling list/search tools, but overall complete for this scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the message_id parameter has no schema-level description; the description alone documents it as 'Message id from search_messages or get_chat_messages'. For a single required parameter with zero coverage, this is the minimum viable but still does not explain format or constraints beyond the example source.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (one message) with explicit scope ('in full, including attachments and delivery times'). It is clear this retrieves a single message, distinguishing it from list_chats, get_chat_messages, and search_messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicitly guides the agent by naming the source of message_id ('from search_messages or get_chat_messages'), establishing the prerequisite discovery step. It does not explicitly state when-not to use it (e.g., versus get_chat_messages for bulk retrieval), leaving a small gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statsA
Overview of the Messages database: message and chat totals, unread count, attachment count, a per-service breakdown (iMessage / SMS / RCS), and the date range covered.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| by_service | No | |
| attachments | Yes | |
| group_chats | Yes | |
| total_chats | Yes | |
| database_bytes | No | |
| newest_message | No | |
| oldest_message | No | |
| total_messages | Yes | |
| unread_messages | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes the content returned, which implies a read-only aggregate query, but it does not explicitly state that it does not modify data or that it reflects the current database state. The disclosure is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the resource ('Messages database') and then lists the key statistics returned. There is no fluff or redundancy; every phrase adds informational value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only statistics tool with an output schema, the description provides sufficient context on what to expect: totals, counts, breakdown, and date range. No critical missing information is apparent; an agent can correctly decide when and how to invoke this tool based on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema is trivially complete. The description goes beyond the schema by explaining the kind of information returned, which is useful for an agent deciding whether to call it. Baseline for zero-parameter tools is 4, and the description earns it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides an overview of the Messages database with specific aggregate statistics (message/chat totals, unread count, attachment count, per-service breakdown, date range). This distinguishes it from sibling tools like list_chats or get_chat_messages, which fetch individual records rather than summary data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when a high-level overview of the entire database is needed, but it does not explicitly state when to choose this over alternatives, nor does it mention exclusions or alternatives. The usage context is clear but left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_chatsA
List conversations, most recently active first.
In Claude the result renders as an inline card, so don't repeat its contents in your reply — a one-line summary or the answer to the user's question is enough.
Args: limit: Maximum conversations to return (default 30). offset: Conversations to skip, for paging through the list.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the ordering guarantee and the host-side rendering behavior (inline card, don't repeat contents), which is genuinely useful context, but it never states read-only semantics, page-size limits, or what happens when limit exceeds the total conversation count.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and ordering are front-loaded in the first sentence, followed by the host-rendering note and compact parameter list. The Claude-specific rendering paragraph is somewhat verbose but earns its place by preventing duplicated output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. For a zero-annotation list tool the description covers purpose, ordering, paging, and host display adequately; the only real gap is not routing the agent away from sibling retrieval/search tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must document the parameters and it does: limit as maximum conversations to return with default 30, and offset as conversations to skip for paging. It adds meaning for offset beyond the bare schema, though it adds little beyond the schema's own default for limit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List conversations') plus the sort order ('most recently active first'), which the agent cannot infer elsewhere. It does not, however, name or distinguish itself from the closest siblings (get_chat_messages, search_messages), so differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'List conversations' — browsing rather than reading or searching a specific conversation. There is no explicit statement of when to prefer this over search_messages or get_chat_messages, and no prerequisites or exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_search_indexA
Update the local search index, and report on it.
search_messages keeps this current on its own, so calling this is
optional. It is useful for warming the index deliberately — the first
build on a large history decodes every message and takes a while — and for
forcing a full rebuild.
Args: rebuild: Discard the index and decode every message again. Needed only to pick up edits to messages older than the recent-edit window.
| Name | Required | Description | Default |
|---|---|---|---|
| rebuild | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | No | |
| added | No | |
| built | No | |
| rebuilt | No | |
| removed | No | |
| scanned | No | |
| seconds | No | |
| updated | No | |
| built_at | No | |
| watermark | No | |
| index_bytes | No | |
| indexed_messages | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It openly states that the first build decodes every message and takes a while, and that rebuild discards the index and decodes everything again, which communicates the costly and somewhat destructive nature of a rebuild. It could go further on side effects or performance expectations, but the key behavioral traits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a one-line summary, a clearly labeled usage rationale, and an Args section that explains the only parameter. Every sentence contributes useful information, and the key facts are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one parameter, an output schema, and no annotations, the description provides all essential context: what the tool does, when it is needed, and what the rebuild flag means. The wording about the optional nature and the purpose of rebuilding makes this fully actionable for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates by explaining the single parameter 'rebuild' in meaningful terms: it discards the index, decodes every message again, and is needed only to pick up edits older than the recent-edit window. This adds substantial decision-making value beyond the bare boolean schema definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Update the local search index') and a reporting behavior, so an agent knows exactly what the tool does. It also distinguishes itself from search_messages, which maintains the index automatically, preventing confusion among sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says calling this tool is optional because search_messages keeps the index current, then gives concrete use cases: warming the index deliberately and forcing a full rebuild. This gives an agent clear conditions for when to invoke this tool versus relying on search_messages.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesA
Search message bodies across every conversation, over all history.
Backed by a local index of decoded message bodies, which is brought up to date automatically. The first search on a large history has to build that index and may take a while; later searches are fast.
In Claude the result renders as an inline card, so don't repeat its contents in your reply — a one-line summary or the answer to the user's question is enough.
Args:
query: Text to look for (case-insensitive substring match). Leave it
out to search on the filters alone — chat_id plus a date range
with no search term reads one conversation newest-first.
limit: Maximum messages to return (default 30).
chat_id: Restrict to one conversation from list_chats.
from_me: True for only messages you sent, False for only received.
after: Only messages at or after this time.
before: Only messages at or before this time.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | ||
| limit | No | ||
| query | No | ||
| before | No | ||
| chat_id | No | ||
| from_me | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| query | Yes | |
| total | Yes | |
| messages | No | |
| truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so well: it discloses that results come from a local decoded-body index kept up to date automatically, that the first search on a large history is slow while later ones are fast, and that results render as an inline card that shouldn't be repeated. It does not state the ordering of global (non-chat-scoped) results or any permission/auth constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose, then index/latency behavior, then rendering guidance, then the arg list — a sensible order with no filler. The rendering note is arguably tangential to tool selection but is genuinely useful invocation context, so the extra length is defensible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter search tool with no annotations and 0% schema coverage, the description covers purpose, latency behavior, output rendering, and every parameter. The output schema handles return values, so the only mild gap is the unspecified ordering of results when no chat_id is given.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must supply all parameter meaning, and it documents every one of the six: query as case-insensitive substring, limit as max results with default 30, chat_id scoped to list_chats, from_me sent/received polarity, and after/before as inclusive 'at or after'/'at or before' bounds. The inclusive boundary semantics are extra information the schema's date-time types do not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with explicit scope: 'Search message bodies across every conversation, over all history.' It distinguishes itself from the narrower retrieval siblings by emphasizing 'every conversation' and full history, though it never names an alternative like get_chat_messages. Adding the case-insensitive substring detail further pins down what 'search' means here.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete conditions: leave query out to search filters alone, and 'chat_id plus a date range with no search term reads one conversation newest-first.' It also points to list_chats as the source of chat_id. It stops short of explicitly saying when to prefer this over get_chat_messages or refresh_search_index.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send a message to an existing conversation. This delivers immediately.
IRREVERSIBLE — the message goes out as soon as this runs, and scripting
cannot unsend it. Confirm the exact recipient and wording with the user
before calling, and pass confirm=True to acknowledge that. If they have
not clearly asked for it to be sent, use compose_message instead and let
them press send.
Messages picks the transport (iMessage, SMS, or RCS) for the conversation
itself, which is why this addresses a chat rather than a raw handle. To
start a new conversation, use compose_message.
Args:
chat_id: Conversation id from list_chats.
body: Text to send.
confirm: Must be True. A guard against sending by accident.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| chat_id | Yes | ||
| confirm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| body | Yes | |
| sent | No | |
| chat_id | Yes | |
| chat_guid | Yes | |
| chat_name | No | |
| characters | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden — and it delivers. It discloses immediacy ('delivers immediately'), irreversibility ('scripting cannot unsend it'), automatic transport selection (iMessage/SMS/RCS), and why the tool addresses a chat rather than a raw handle. This is precisely the behavioral context an agent needs before invoking an irreversible action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with the critical IRREVERSIBLE warning front-loaded immediately after the one-line purpose. The compose_message alternative is mentioned twice, but each mention serves a distinct routing case. Slightly longer than strictly necessary, yet every sentence carries safety-relevant content, so the length is earned.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a safety-critical, irreversible tool with zero annotations and zero schema descriptions, this is remarkably complete: it covers safety guardrails, when-to-use routing, transport behavior, parameter sourcing, and the confirm requirement. An output schema exists, so return values need not be documented. Nothing essential for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate — it does fully. chat_id is sourced from list_chats, body is defined as text, and confirm is documented as 'Must be True' with its safety purpose explained. Notably, the schema marks confirm as optional with default false, and the description corrects this dangerous ambiguity by stating the requirement explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Send a message to an existing conversation') with an unambiguous verb+resource pair. It distinguishes itself from sibling compose_message by explicitly scoping to existing conversations, and from the read-only siblings by naming the mutation it performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names compose_message as the alternative in two distinct routing conditions: when the user has not clearly asked for sending, and when starting a new conversation. Also instructs the agent to confirm recipient and wording with the user before calling, leaving no ambiguity about when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.2.2- First observed
compose_message - First observed
get_attachment - First observed
get_chat_messages - First observed
get_message - First observed
get_stats - First observed
list_chats - First observed
refresh_search_index - First observed
search_messages - First observed
send_message
TDQS
Scored across 9 tools
Each tool has a clear primary purpose: listing chats, reading messages, single-message lookup, attachments, stats, compose, send, and index refresh are all distinct. The only mild overlap is between get_chat_messages and search_messages when search is given a chat_id with no query term, but the descriptions explicitly clarify this boundary.
All tools use snake_case with a verb_noun shape (list_chats, get_message, send_message, compose_message, search_messages, refresh_search_index). No mixed conventions or vague standalone verbs.
Nine tools is well-scoped for a Messages client: a compact read/search surface plus the two write paths (compose/send) and one maintenance operation. Nothing feels redundant or missing by count.
Core lifecycle is covered: discover chats, read messages, search, fetch attachments, send and draft messages, plus stats and index maintenance. Minor gaps remain (e.g. group-chat creation or participant management, reactions, marking read), but agents can work around them.
Maintenance
Related MCP Connectors
Let ChatGPT, Claude & Cursor use your Mac: email, calendar, iMessage, Teams, files. Local, free.
MCP connector for iMessage & Contacts via a local Mac agent + Vercel relay
Connect any mailbox to Claude, ChatGPT & AI: read, send, reply, schedule & search emails.
Carbon Voice MCP serves as a bridge that connects AI assistants like ChatGPT, Claude, and Cursor to a user's Carbon Voice account, turning voice messages and conversations into a private, on-demand knowledge base. It provides 28 specialized tools for comprehensive voice messaging management, including creating and sending messages, accessing conversation history with instant transcription, running AI actions (summarization, TLDR generation, meeting notes), and managing workspace collaboration through folders, contacts, and team communications.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables Claude to send and read iMessages on macOS, with smart contact lookup, message history retrieval, and cross-conversation search using natural language commands.5MIT
- AlicenseNot gradedqualityDmaintenanceEnables Claude to read and search through iMessage, SMS, and RCS conversations, including mixed-protocol group chats with Android users. It decodes binary message data from the macOS Messages database to provide a comprehensive view of message history.8MIT
- AlicenseNot gradedqualityDmaintenanceEnables Claude to send and read iMessages on macOS, with human approval required for sending and no auto-replies.31Apache 2.0
- AlicenseAqualityDmaintenanceConnects Claude Desktop to iMessage on macOS, enabling reading conversations, searching messages, sending texts, and managing attachments.77MIT