safe-apple-notes-mcp
Provides tools for interacting with Apple Notes on macOS, allowing listing folders and notes, searching, reading note contents, and creating, appending, updating, and deleting notes (with forced human confirmation for writes).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@safe-apple-notes-mcpsearch my notes for 'flight itinerary' and show the top match"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
safe-apple-notes-mcp
A safety-first MCP server for Apple Notes
on macOS, for people who want to give an AI access to their notes without
handing it the keys to delete or rewrite everything unsupervised. It talks to
Notes.app through AppleScript (osascript) and exposes exactly 8 tools, all
scoped to one note per call, with every write and delete tool forcing a human
confirmation. If you want a bigger surface — tags, attachments, checklists,
tables, batch operations — use
sweetrb/apple-notes-mcp instead;
this project deliberately competes on safety, auditability, and size, not
feature count.
Why it exists
Most Apple Notes MCP servers expose a large surface: batch delete, folder management, arbitrary overwrites. That is a lot of blast radius to hand to an LLM. This server takes the opposite bet: keep the tool list small enough to read in one sitting, make every destructive operation single-note and undo-friendly, and force a human to confirm it — structurally, not just by convention.
Related MCP server: Apple Notes MCP Server
Safety model
Exactly 8 tools, enforced by a test that fails if one is ever added:
list_folders,list_notes,search_notes,get_note(read), andcreate_note,append_to_note,update_note,delete_note(write).Every write/delete tool carries
anthropic/requiresUserInteraction. Claude Code (>= 2.1.199) prompts a human before calling any of the four write tools — regardless of permission mode or allow rules, including bypass mode.No batch operations, ever. Every tool acts on exactly one note (or lists/searches). There is no "delete these notes" or "update all notes in folder" tool, and there never will be.
delete_notenever destroys. Notes.app moves the note to Recently Deleted, where it stays recoverable for 30 days.update_notereturns the previous body as undo material. Both the previous and new body come back as markdown, so the caller always has what was overwritten.append_to_notenever replaces. It only ever adds content to the end of a note.No move, no folder create/delete/rename. Folders are read-only from this server's perspective.
Password-protected notes are skipped in listings (
list_notes,search_notes) and rejected with a clear error everywhere else (get_note,append_to_note,update_note,delete_note). This server never attempts to unlock or bypass a locked note.No network, no shell.
osascriptis invoked directly via stdin (execFileSync, never a shell string), and this server makes no network calls and never writes to the Notes SQLite database directly.
Comparison
Facts about sweetrb/apple-notes-mcp below were verified by reading its
source: it annotates tools with readOnlyHint only (no destructiveHint,
no forced-confirmation metadata) and exposes batch-delete-notes and
delete-folder alongside a body-replacing update-note.
|
| |
Tool count | 8 | 40+ |
Batch delete | No | Yes ( |
Server-forced confirmation on writes | Yes ( | No |
| Yes | No (only |
Update returns previous body | Yes ( | No |
Tags / attachments / checklists | No | Yes |
SQLite metadata access | No | Optional, with Full Disk Access |
Runtime dependencies | 3 | 3 |
License | MIT | MIT |
Tools
Tool | Confirmation required? | Input | Output |
| No | — |
|
| No |
|
|
| No |
| Same shape as |
| No |
|
|
| Yes |
|
|
| Yes |
|
|
| Yes |
|
|
| Yes |
|
|
create_note converts the plain-text body to HTML: <h1>title</h1>
followed by one <div> per line (empty lines become <div><br></div>).
append_to_note and update_note follow the same per-line conversion —
append_to_note adds it to the end of the existing body, update_note
replaces the body entirely (rebuilding the <h1> from the given title, or
the note's existing title when omitted).
get_note accepts either id or title (never both) — use title when you
don't have the id handy; the match is exact but case-insensitive. If the title
matches more than one note, get_note reports the candidate ids instead of
guessing, so you can retry with id.
Install
pnpm install
pnpm buildUse with Claude Code
claude mcp add apple-notes -s user -- node /absolute/path/to/dist/index.jsUse with Claude Desktop
Add to your Claude Desktop MCP config:
{
"mcpServers": {
"apple-notes": {
"command": "node",
"args": ["/absolute/path/to/dist/index.js"]
}
}
}Permissions
The first time this server calls into Notes.app, macOS prompts for Automation permission (System Settings → Privacy & Security → Automation). Grant it to whichever process launches the server (e.g. Claude Desktop or your terminal). Without it, every tool call fails with an AppleScript permission error.
Recommended Claude Code permissions
{
"permissions": {
"allow": [
"mcp__apple-notes__list_folders",
"mcp__apple-notes__list_notes",
"mcp__apple-notes__search_notes",
"mcp__apple-notes__get_note"
],
"ask": [
"mcp__apple-notes__create_note",
"mcp__apple-notes__append_to_note",
"mcp__apple-notes__update_note",
"mcp__apple-notes__delete_note"
]
}
}The ask rules are belt-and-braces for older Claude Code versions that
ignore the _meta flag — the four write/delete tools already carry
anthropic/requiresUserInteraction, which forces a prompt on current
versions regardless of permission mode.
Environment variables
Variable | Default | Purpose |
|
| Timeout for each |
| unset | Set to |
Development
This project is built with strict TDD: every module has a test file written
and run to red before its implementation exists. Unit tests live next to
their module as *.test.ts; the end-to-end test lives in test/e2e and is
skipped unless APPLE_NOTES_MCP_E2E=1, since it touches the real Notes.app —
it stays strictly read-only, on purpose, even though delete_note and
update_note exist.
pnpm test # run all unit tests
pnpm test:watch # watch mode
pnpm typecheck # tsc --noEmit over src and test
pnpm lint # eslint
pnpm build # compile src to distArchitecture
Hexagonal / screaming architecture: domain defines the NotesRepository
port and the entities; infrastructure/applescript is the only adapter that
knows osascript exists; interface/mcpServer.ts wires a NotesRepository
into the 8 MCP tools without knowing whether it's talking to AppleScript or a
test fake.
Roadmap
Folder scoping via an
APPLE_NOTES_MCP_FOLDERSenvironment variable, to restrict every tool to an allow-listed set of folders.A local audit log for every write/delete call (what was called, with what arguments, when).
An optional confined "create" folder, so
create_notecan be restricted to a single sandboxed destination.
Credits
AppleScript patterns (escaping, delimiter-based record output, timeout wrapping, password-protected note handling) were informed by reading:
This project is a from-scratch, deliberately smaller reimplementation — not a fork — built around a fixed 8-tool surface.
Available Tools
8 toolsappend_to_noteAppend to noteA
Append plain text to an existing note's body. Never replaces existing content. Fails with a clear error if the note is password protected.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Id of the note to append to. | |
| text | Yes | Plain text to append. Each line becomes one paragraph. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-idempotent behavior. The description adds valuable context beyond the annotations: that existing content is preserved and that password-protected notes cause a clear error. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core behavior is front-loaded, and the critical caveat ('Never replaces existing content') appears immediately after the verb phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter append operation, the description covers the core behavior, the non-destructive guarantee, and the main failure edge case. No output schema exists, but the agent has enough to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both id and text. The description does not add meaning beyond what the schema provides, placing it at the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Append'), a resource ('existing note's body'), and a scope ('plain text') in the first sentence. It also distinguishes itself from sibling update_note by explicitly saying 'Never replaces existing content.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: to add text without replacing, which contrasts with update_note. Password-protected failure is also stated. However, it does not explicitly name alternatives or give a concrete 'use X instead' routing, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_noteCreate noteA
Create a new note from a plain-text body. Each line becomes its own paragraph; the title is rendered as a heading.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | Plain-text body. Each line becomes one paragraph. | |
| title | Yes | Note title. | |
| folder | No | Folder to create the note in (default account folder if omitted). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal that this is a mutating, non-idempotent operation. The description adds useful behavioral detail beyond those hints: each line becomes its own paragraph and the title is rendered as a heading. This tells the agent how content will be transformed, which is valuable for predicting the tool's effect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler. The core operation is front-loaded, and the formatting behavior is stated immediately in the second sentence. Every part of the description earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple create operation with three well-documented parameters and no nested objects, the description is largely complete. It covers the essential creation behavior and formatting semantics, and the schema handles parameter defaults. A minor gap is the absence of any statement about return value or behavior when the target folder does not exist, but these are not critical for selecting or invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that the title is rendered as a heading, which is not present in the title parameter description. It also reinforces the body line-to-paragraph behavior, though folder semantics are left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Create a new note from a plain-text body.' It also distinguishes the operation from sibling tools like append_to_note, update_note, and delete_note by emphasizing 'new note' and describing the input format. The line-to-paragraph and title-heading details further clarify what this tool uniquely does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Create a new note' implicitly signals when to use this tool, but the description never explicitly contrasts it with alternatives such as append_to_note for existing notes or update_note for modifying notes. Usage context is implied rather than stated, and there are no explicit when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_noteDelete noteADestructive
Delete one note by id. Notes.app moves it to Recently Deleted, where it stays recoverable for 30 days — this never permanently destroys it. There is no batch or title-based variant.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Id of the note to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already mark destructiveHint=true, but the description adds important nuance: the note moves to Recently Deleted, stays recoverable for 30 days, and is never permanently destroyed. This materially changes how an agent should weigh invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight, front-loaded sentences communicate scope, side effects, recovery behavior, and boundary conditions without wasted words. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter delete tool, the description covers what it does, how to invoke it, what happens to the data, and what variants do not exist. The lack of an output schema is acceptable here because the behavioral outcome is fully described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single 'id' parameter fully. The description confirms 'by id' but adds no extra format, source, or lifecycle detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Delete one note by id') with a clear resource and scope. The 'no batch or title-based variant' line also distinguishes it from any broader deletion sibling and from note-search/lookup tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly frames usage as deleting a single note by id and gives a negative constraint: there is no batch or title-based variant. This tells an agent when to use this tool and when not to reach for a non-existent alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_noteGet noteARead-only
Fetch one note by id or by exact title, rendered as markdown, plaintext, or raw html. Exactly one of id or title must be given. A title match is case-insensitive; if it matches more than one note, the tool reports the candidates instead of guessing. Fails with a clear error if the note is password protected.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Note id, as returned by list_notes or search_notes. | |
| title | No | Exact note title (case-insensitive). Use when the id is not known. | |
| format | No | Body rendering format (default markdown). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the read-only safety profile is covered. The description adds meaningful behavior: multiple title matches are reported as candidates rather than silently guessing, and password-protected notes fail with a clear error. This exceeds the annotation baseline and could reach 5, but does not describe any pagination/limitations or the shape of candidate reporting, so a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences pack a verb+resource statement, the exclusive-or constraint, matching behavior, and failure behavior with no filler. The core action is front-loaded and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with readOnlyHint=true, destructiveHint=false, and 100% schema coverage, the description covers the main calling constraints and edge cases (ambiguous titles, protected notes, rendering formats). It does not specify the output structure, but there is no output schema and the description does mention the formats; a 4 is fair, with 5 withheld only because the candidate-reporting format is not described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description compensates by explaining the mutual-exclusion constraint ('Exactly one of id or title must be given'), the case-insensitivity of title matching, and the behavior on ambiguous titles. These add real meaning beyond the schema's field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource — 'Fetch one note by id or by exact title' — and lists the return formats (markdown, plaintext, or raw html). It distinguishes itself from sibling list/search tools by showing it returns a single note identified by id or title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the selection condition: exactly one of id or title must be given bracket clarity? The description says the title match is case-insensitive and reports candidates instead of guessing when ambiguous; it also names failure on password-protected notes. This guides when and how to use the tool vs. alternatives like list_notes/search_notes, which are referenced by the parameter descriptions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersList foldersARead-only
List every Notes.app folder across every account.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds the global cross-account scoping behavior, but says nothing about response format or ordering, so it adds only modest context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states exactly what the tool does with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless read-only listing tool, the description is sufficiently complete: it names the resource, the scope, and the operation. No output schema exists, but the low complexity and sibling context do not require more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema coverage is 100%, so the schema fully accounts for inputs. Baseline for a zero-parameter tool is 4; the description correctly signals there are no filter options.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'List' with resource 'Notes.app folder' and explicitly scopes to every account. This clearly distinguishes it from sibling tools, which all operate on notes rather than folders.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for obtaining the full set of folders across all accounts, which provides clear context. However, it does not explicitly state when to prefer this tool over siblings or mention any alternatives/exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_notesList notesARead-only
List notes, most recently modified first. Optionally restrict to one folder. Password-protected notes are skipped. Limit defaults to 50, max 200.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum notes to return (default 50, max 200). | |
| folder | No | Restrict results to this folder name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral details beyond that: notes are sorted by most recent modification, password-protected notes are skipped, and the limit defaults to 50. These are useful execution-relevant traits not present in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver the core function, ordering, filtering, access behavior, and limit policy. Every sentence earns its place, and the most important behavior is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, read-only, and has complete schema coverage, so the description covers the essential invocation details. However, there is no output schema and the description does not state what the returned notes contain (metadata vs full content), nor does it explicitly say that omitting folder lists all folders. A little more return-value context would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents folder and limit fully. The description repeats that limit defaults to 50 and max is 200, and that folder restricts results, but adds no meaning beyond the existing parameter descriptions. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'List notes, most recently modified first.' It also clarifies scope with optional folder restriction. It does not explicitly distinguish itself from sibling search_notes, but the verb 'list' plus the ordering makes the core purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus search_notes, get_note, or list_folders. The only usage-related hint is 'Optionally restrict to one folder,' which implies use cases but does not name alternatives or exclusions explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_notesSearch notesARead-only
Case-insensitive search over note title and plaintext body. Password-protected notes are skipped. Limit defaults to 20, max 100.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum notes to return (default 20, max 100). | |
| query | Yes | Text to search for in the note title or body. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral details: case-insensitive matching, plaintext-body search, skipping password-protected notes, and the default/max limit. Return format and pagination are not mentioned, but the tool is a simple search operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact sentences with no filler. Key information is front-loaded, and every sentence contributes: search scope, matching behavior, exclusions, and limit defaults.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with only two parameters, a complete input schema, and annotations covering the read-only safety profile, this description is sufficient. An agent can correctly invoke it knowing what it searches, what it skips, and how the limit behaves.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds semantic value beyond the schema by specifying that matching is case-insensitive and limited to plaintext bodies, which clarifies how the query parameter behaves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('search') and resource ('notes'), and further narrows scope to 'title and plaintext body'. This clearly differentiates it from siblings like list_notes (listing) and get_note (retrieving a single note).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the use case clear: case-insensitive text search across titles and bodies, with password-protected notes skipped. It does not explicitly name alternatives like list_notes or get_note or state when not to use it, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_noteUpdate noteADestructive
Replace an existing note's body, and optionally its title. Unlike append_to_note, this overwrites the note's existing content; the previous body is returned as undo material. Fails with a clear error if the note is password protected.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Id of the note to update. | |
| body | Yes | New plain-text body. Each line becomes one paragraph. | |
| title | No | New title. When omitted, the note's existing title is kept. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations by disclosing that the previous body is returned as undo material and that the tool fails with a clear error for password-protected notes. These are important behavioral details not available from the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences of dense, useful information with no filler. It front-loads the core behavior, then adds the key sibling distinction, return value, and failure mode. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, the description covers all essential aspects: what is overwritten, what is returned, the failure condition, and how it differs from a closely related sibling. No output schema exists, but the description still communicates the key return behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents all three parameters with descriptions, including the optionality of title and the plain-text nature of body. The description reinforces that body is replaced and title is optional but does not add significant semantic detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Replace') and resource ('an existing note's body, and optionally its title'), making the tool's function immediately clear. It also explicitly distinguishes itself from the sibling append_to_note by stating that this tool overwrites content rather than appends.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly names the alternative append_to_note and explains the key difference: update_note overwrites existing content while append_to_note presumably adds to it. This gives an agent a clear decision rule for selecting between the two tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0- First observed
append_to_note - First observed
create_note - First observed
delete_note - First observed
get_note - First observed
list_folders - First observed
list_notes - First observed
search_notes - First observed
update_note
TDQS
Scored across 8 tools
Each tool targets a distinct action: listing folders, listing notes, searching, fetching, creating, appending, deleting, and updating. Even the closely related append_to_note and update_note are clearly separated by replace vs. non-destructive append semantics.
All tool names follow a consistent verb_noun pattern in snake_case: list_, search_, get_, create_, append_to_, delete_, update_. The naming is predictable and makes the intent of each tool immediately clear.
Eight tools is well-scoped for an Apple Notes MCP server. The set covers the core note lifecycle plus listing and searching without unnecessary redundancy or bloat.
The core note lifecycle is well covered: create, read, update, append, delete, list, and search. Minor gaps exist around folder management, such as no create/move/restore operations, but these do not block primary note workflows.
Maintenance
Related MCP Connectors
Search, read, and write your Apple Notes from ChatGPT/Claude via a local Mac agent + MCP relay.
- aNotepadOAuthcom.anotepad
AI access to your aNotepad online notes: read, search, write, and organize via 22 tools.
Create, search, and update notes in an xNotepad AI notebook, with semantic search and AI Q&A.
Search, read, create and edit your Memol notes from Claude. Team note-taking with AI search.
Related MCP Servers
- FlicenseAqualityDmaintenanceEnables interaction with Apple Notes on macOS through AppleScript, allowing users to list, search, read, create, update, and delete notes across accounts and folders.71-
- AlicenseAqualityDmaintenanceEnables AI assistants to read, create, search, update, and delete Apple Notes through natural language conversation, using JXA to communicate directly with the Notes app.83,611 npm28MIT
- AlicenseAqualityDmaintenanceEnables AI clients to search, read, create, update, move, and delete Apple Notes on macOS via AppleScript automation.103,611 npm2MIT
- AlicenseAqualityDmaintenanceEnables LLMs to create, read, and append notes in Apple Notes through AppleScript, with append-only operations restricted to a single folder for safety.4MIT