Provides read-only access to iCloud Drive, enabling folder listing, filename search, file downloads, and text extraction from common document formats.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@icloud-docs-mcp search my iCloud Drive for the filename 'taxes'."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Read-only Model Context Protocol server for iCloud Drive.
Source: js713-lab/icloud4u-mcp. The installable package and CLI are named icloud-docs-mcp.
It lists a folder, searches by filename, downloads files, and extracts text from common documents. There is no default Apple ID, no bundled documents, and no company-specific search logic.
Apple does not publish a third-party iCloud Drive API. This server uses the unofficial pyicloud library. Apple can change endpoints without notice.
Not Mail, Calendar, Contacts, or Notes
Not a hosted / HTTP MCP (it runs locally over stdio)
Not a 2FA prompt inside the model session
Not upload, rename, or delete
Related MCP server: mcp-server-drive
This is not an Apple product. Apple does not publish a third-party iCloud Drive API. The unofficial client can break when Apple changes endpoints, and using it may conflict with Apple's terms. Use it at your own risk, locally, on an account you control.
Do not expose this server on the network. Cookiejar files are login credentials: never commit them, never paste them into issues, and never check in .env. See SECURITY.md.
The status tool returns the configured Apple ID and local cache paths so a client can tell whether login succeeded. It never returns a password.
Python 3.10+
From this repository:
git clone https://github.com/js713-lab/icloud4u-mcp.git
cd icloud4u-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .Install from GitHub:
pip install git+https://github.com/js713-lab/icloud4u-mcp.gitOr, once the package is on PyPI:
pip install icloud-docs-mcpCopy .env.example to .env and set ICLOUD_USERNAME to your Apple ID. .env is gitignored.
cp .env.example .envThe MCP process will not wait for a 2FA code. Log in in a real terminal:
export ICLOUD_USERNAME='you@example.com'
icloud-docs-mcp loginYou will be prompted for the password and, if Apple asks, a 6-digit device code. A trusted cookiejar is stored under:
$XDG_DATA_HOME/icloud-docs-mcp/<sanitized-username>/(~/.local/share/icloud-docs-mcp/... if XDG_DATA_HOME is unset.)
If a tool returns NEED_LOGIN or NEED_2FA, run icloud-docs-mcp login again, then retry.
icloud-docs-mcp statusTool | Purpose |
| Session health. Returns the Apple ID and cache paths, never a password. |
| One directory. Empty path is Drive root (or |
| Filename/path query, optional |
| Copy Drive files to the local cache. Returns paths, not bytes. |
| Download if needed; extract text from pdf, docx, xlsx, txt, csv. |
Search and read_text are capped so MCP clients with a small result limit are not flooded.
Variable | Required | Meaning |
| yes | Apple ID. No default. |
| no | Login CLI prompts if unset. Avoid putting this in the MCP env. |
| no | Cookiejar directory override. |
| no | Local download cache. |
| no | Drive folder prefix; all tools are scoped under it. |
Default command (no args) speaks MCP on stdio:
icloud-docs-mcp[mcp_servers.icloud_docs]
command = "icloud-docs-mcp"
env = { ICLOUD_USERNAME = "${ICLOUD_USERNAME}" }
startup_timeout_sec = 45
tool_timeout_sec = 180
tool_timeouts = { search = 180, download = 300, read_text = 180 }{
"mcpServers": {
"icloud-docs": {
"command": "icloud-docs-mcp",
"env": {
"ICLOUD_USERNAME": "<your-apple-id>"
}
}
}
}Use an absolute path to the venv binary if the client does not inherit your PATH.
Grok can also load .mcp.json from this repo:
grok plugin install js713-lab/icloud4u-mcp --trustThat only starts the server. You still need pip install icloud-docs-mcp (or pip install -e .) and icloud-docs-mcp login on the machine.
To publish a release to PyPI and the official MCP Registry, see PUBLISH.md.
pip install -e ".[dev]"
pytestTests mock Apple. CI must never log into iCloud. See CONTRIBUTING.md.
MIT. Security reports: SECURITY.md.
Download Drive files to the local cache directory. Returns local paths, not bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. It does disclose the key side effect (writes to a local cache) and the return semantics (local paths, not bytes), but it omits details such as caching behavior, auth requirements, force-refresh, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the action front-loaded. Every clause earns its place: destination, side effect, and output format are each addressed without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a one-parameter schema and an output schema, the description is mostly complete: it names the action, destination, and return semantics. The main gap is parameter format/examples, but the tool is simple enough that the description covers the essential context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does not clarify what the 'paths' parameter accepts – Drive paths, filenames, globs, or IDs – besides the generic implication from 'Download Drive files.' An agent cannot reliably construct correct arguments from this.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource – 'Download Drive files' – and adds a concrete destination ('to the local cache directory'). It also distinguishes output behavior from siblings by adding 'Returns local paths, not bytes.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like read_text, search, or list_folder. The verb 'Download' implies the use case, but no explicit when/when-not or alternative exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List one iCloud Drive folder (not recursive). Empty path is the configured root.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses the non-recursive behavior and the empty-path root behavior, which are useful. However, it doesn't mention whether it returns folders, files, both, or any permission/error context. The output schema exists but the description doesn't add much beyond the basic behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and the key non-recursive caveat. Every word earns its place; no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with one optional parameter and an output schema, the description is mostly adequate. It covers the main behavioral caveats (non-recursive, empty path root). It lacks explicit guidance on output format or error cases, but the output schema likely covers return values. Given no annotations, a bit more context about what entries look like would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains that empty path means the configured root, which adds meaning to the default value. However, it doesn't describe the expected path format (e.g., relative vs absolute, separators) or what happens with invalid paths. The single parameter is simple, so the gap is moderate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('one iCloud Drive folder'), and clarifies it is not recursive. It distinguishes itself from search and read_text siblings by focusing on folder listing, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: to list a single folder's immediate contents, with empty path meaning the configured root. It doesn't explicitly state when not to use it or mention alternatives like search for broader queries, but the non-recursive note gives some usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Download a Drive file if needed and return extracted text (pdf, docx, xlsx, txt).
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must handle transparency itself. It discloses that the tool may download a file as a side effect and that it returns extracted text, but it does not mention permissions, size limits, file modifications, or failure behavior. Useful but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence conveys the main action, the conditional download side effect, and supported formats. There is no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with an output schema, this description covers the essential invocation context: what to pass, what it operates on, what it returns, and which formats are accepted. It does not specify path syntax or edge-case behavior, but those are minor gaps given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only 'path' with 0% documentation coverage, so the description must compensate. It adds meaning by indicating path refers to a Drive file and enumerating accepted formats (pdf, docx, xlsx, txt). It does not clarify path syntax or identifiers, but it gives enough semantic context for the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb phrase ('return extracted text') and identifies the resource ('Drive file') and supported formats (pdf, docx, xlsx, txt). It does not explicitly contrast with siblings like download or search, so it is clear but not strongly differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when text extraction from a Drive file is neededhol, but it gives no explicit guidance about when to prefer this tool over alternatives, especially the nearby download tool. It states a conditional action ('if needed') without specifying the condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search Drive filenames and paths. Optional ext filter like pdf or .docx. Capped.
| Name | Required | Description | Default |
|---|---|---|---|
| ext | No | ||
| path | No | ||
| limit | No | ||
| query | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The only behavioral detail is 'Capped,' which is ambiguous and does not explain the cap size, pagination behavior, or result format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded, with no filler. 'Capped' is cryptic but still brief; the main weakness is under-specification rather than wordiness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists, the description is incomplete for a 4-parameter search tool. It lacks context for path, limit, cap behavior, and how this tool should be selected over list_folder or other siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It partially explains ext with examples and implies query semantics, but path and limit are not explained, and the 'Capped' note is not connected to the limit parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches Drive filenames and paths, with a specific verb and resource. It does not explicitly differentiate from siblings list_folder or read_text, but the search-focused purpose is evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when the tool should be used: when the agent needs to search Drive by filename or path. However, it provides no explicit guidance about when not to use it or which sibling alternatives might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check whether the Apple ID session is trusted and iCloud Drive is reachable.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. 'Check' implies a read-only, non-destructive operation, but it does not mention potential side effects, return format, or any error handling. It does not describe what happens if the session is not trusted or iCloud Drive is unreachable, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that immediately states the purpose. It is concise, with no redundant words, and the key action and targets are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with no parameters and an output schema exists (not shown but referenced in context). The description adequately explains what the tool checks, which is sufficient for an agent to decide to call it. Since output schema covers return values, the description need not elaborate further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The schema coverage is trivially 100% with no parameters to describe. The description does not need to add parameter semantics since none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb 'Check' and identifies the resources: 'Apple ID session' and 'iCloud Drive'. It specifies the checks performed (trusted, reachable), distinguishing it from sibling tools that handle listing, searching, downloading, or reading text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives or when not to use it. It does not mention prerequisites, typical scenarios, or relationship to sibling tools. The purpose implies it might be used before other operations, but this is not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0downloadlist_folderread_textsearchstatusScored across 5 tools
Each tool maps to a distinct operation: session status, folder listing, filename search, file download, and text extraction. The only possible overlap is download/read_text, but their return types and stated purposes are clearly separated.
Most names follow a simple verb-first style, but status is a noun and search is a bare verb without an object. Still, there is no mixed casing or confusing verb variants, so the pattern remains readable and predictable.
Five tools is well-scoped for a targeted iCloud Drive document access server. There are no redundant or superfluous tools; each one contributes to the core workflow.
The core read-oriented workflow is covered: verify connectivity, navigate folders, search, download, and extract text. Missing write/management operations like upload or delete appear outside this server's stated purpose, though recursive listing or metadata access would be minor enhancements.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Search, browse, and read your Dropbox files. Find documents by name or content, list folders, and…
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Browse and manage files in your Moxt AI workspace from any MCP client.
