Skip to main content
Glama
rodriabregu

safe-apple-notes-mcp

by rodriabregu

safe-apple-notes-mcp

A safety-first MCP server for Apple Notes on macOS, for people who want to give an AI access to their notes without handing it the keys to delete or rewrite everything unsupervised. It talks to Notes.app through AppleScript (osascript) and exposes exactly 8 tools, all scoped to one note per call, with every write and delete tool forcing a human confirmation. If you want a bigger surface — tags, attachments, checklists, tables, batch operations — use sweetrb/apple-notes-mcp instead; this project deliberately competes on safety, auditability, and size, not feature count.

Why it exists

Most Apple Notes MCP servers expose a large surface: batch delete, folder management, arbitrary overwrites. That is a lot of blast radius to hand to an LLM. This server takes the opposite bet: keep the tool list small enough to read in one sitting, make every destructive operation single-note and undo-friendly, and force a human to confirm it — structurally, not just by convention.

Related MCP server: Apple Notes MCP Server

Safety model

  • Exactly 8 tools, enforced by a test that fails if one is ever added: list_folders, list_notes, search_notes, get_note (read), and create_note, append_to_note, update_note, delete_note (write).

  • Every write/delete tool carries anthropic/requiresUserInteraction. Claude Code (>= 2.1.199) prompts a human before calling any of the four write tools — regardless of permission mode or allow rules, including bypass mode.

  • No batch operations, ever. Every tool acts on exactly one note (or lists/searches). There is no "delete these notes" or "update all notes in folder" tool, and there never will be.

  • delete_note never destroys. Notes.app moves the note to Recently Deleted, where it stays recoverable for 30 days.

  • update_note returns the previous body as undo material. Both the previous and new body come back as markdown, so the caller always has what was overwritten.

  • append_to_note never replaces. It only ever adds content to the end of a note.

  • No move, no folder create/delete/rename. Folders are read-only from this server's perspective.

  • Password-protected notes are skipped in listings (list_notes, search_notes) and rejected with a clear error everywhere else (get_note, append_to_note, update_note, delete_note). This server never attempts to unlock or bypass a locked note.

  • No network, no shell. osascript is invoked directly via stdin (execFileSync, never a shell string), and this server makes no network calls and never writes to the Notes SQLite database directly.

Comparison

Facts about sweetrb/apple-notes-mcp below were verified by reading its source: it annotates tools with readOnlyHint only (no destructiveHint, no forced-confirmation metadata) and exposes batch-delete-notes and delete-folder alongside a body-replacing update-note.

safe-apple-notes-mcp

sweetrb/apple-notes-mcp

Tool count

8

40+

Batch delete

No

Yes (batch-delete-notes, delete-folder)

Server-forced confirmation on writes

Yes (anthropic/requiresUserInteraction)

No

destructiveHint on destructive tools

Yes

No (only readOnlyHint is set)

Update returns previous body

Yes (update_note.previousBody)

No

Tags / attachments / checklists

No

Yes

SQLite metadata access

No

Optional, with Full Disk Access

Runtime dependencies

3

3

License

MIT

MIT

Tools

Tool

Confirmation required?

Input

Output

list_folders

No

{ id, name, account }[] for every folder in every account

list_notes

No

folder?, limit? (default 50, max 200)

{ id, title, folder, modifiedAt }[], newest first

search_notes

No

query, limit? (default 20, max 100)

Same shape as list_notes; case-insensitive match on title or body

get_note

No

id?, title?, format? (markdown | plaintext | html, default markdown) — exactly one of id/title

{ id, title, folder, createdAt, modifiedAt, body }

create_note

Yes

title, body (plain text), folder?

{ id, title, folder }

append_to_note

Yes

id, text (plain text)

{ id, title }

update_note

Yes

id, body (plain text), title?

{ id, title, folder, previousBody, body } (both bodies markdown)

delete_note

Yes

id

{ id, title, folder, recoverableFrom: "Recently Deleted (30 days)" }

create_note converts the plain-text body to HTML: <h1>title</h1> followed by one <div> per line (empty lines become <div><br></div>). append_to_note and update_note follow the same per-line conversion — append_to_note adds it to the end of the existing body, update_note replaces the body entirely (rebuilding the <h1> from the given title, or the note's existing title when omitted).

get_note accepts either id or title (never both) — use title when you don't have the id handy; the match is exact but case-insensitive. If the title matches more than one note, get_note reports the candidate ids instead of guessing, so you can retry with id.

Install

pnpm install
pnpm build

Use with Claude Code

claude mcp add apple-notes -s user -- node /absolute/path/to/dist/index.js

Use with Claude Desktop

Add to your Claude Desktop MCP config:

{
  "mcpServers": {
    "apple-notes": {
      "command": "node",
      "args": ["/absolute/path/to/dist/index.js"]
    }
  }
}

Permissions

The first time this server calls into Notes.app, macOS prompts for Automation permission (System Settings → Privacy & Security → Automation). Grant it to whichever process launches the server (e.g. Claude Desktop or your terminal). Without it, every tool call fails with an AppleScript permission error.

{
  "permissions": {
    "allow": [
      "mcp__apple-notes__list_folders",
      "mcp__apple-notes__list_notes",
      "mcp__apple-notes__search_notes",
      "mcp__apple-notes__get_note"
    ],
    "ask": [
      "mcp__apple-notes__create_note",
      "mcp__apple-notes__append_to_note",
      "mcp__apple-notes__update_note",
      "mcp__apple-notes__delete_note"
    ]
  }
}

The ask rules are belt-and-braces for older Claude Code versions that ignore the _meta flag — the four write/delete tools already carry anthropic/requiresUserInteraction, which forces a prompt on current versions regardless of permission mode.

Environment variables

Variable

Default

Purpose

APPLE_NOTES_MCP_TIMEOUT_MS

30000

Timeout for each osascript call, in milliseconds.

APPLE_NOTES_MCP_E2E

unset

Set to 1 to run the real-Notes.app smoke test (test/e2e).

Development

This project is built with strict TDD: every module has a test file written and run to red before its implementation exists. Unit tests live next to their module as *.test.ts; the end-to-end test lives in test/e2e and is skipped unless APPLE_NOTES_MCP_E2E=1, since it touches the real Notes.app — it stays strictly read-only, on purpose, even though delete_note and update_note exist.

pnpm test          # run all unit tests
pnpm test:watch    # watch mode
pnpm typecheck      # tsc --noEmit over src and test
pnpm lint           # eslint
pnpm build          # compile src to dist

Architecture

Hexagonal / screaming architecture: domain defines the NotesRepository port and the entities; infrastructure/applescript is the only adapter that knows osascript exists; interface/mcpServer.ts wires a NotesRepository into the 8 MCP tools without knowing whether it's talking to AppleScript or a test fake.

Roadmap

  • Folder scoping via an APPLE_NOTES_MCP_FOLDERS environment variable, to restrict every tool to an allow-listed set of folders.

  • A local audit log for every write/delete call (what was called, with what arguments, when).

  • An optional confined "create" folder, so create_note can be restricted to a single sandboxed destination.

Credits

AppleScript patterns (escaping, delimiter-based record output, timeout wrapping, password-protected note handling) were informed by reading:

This project is a from-scratch, deliberately smaller reimplementation — not a fork — built around a fixed 8-tool surface.

Available Tools

8 tools
append_to_noteAppend to noteA

Append plain text to an existing note's body. Never replaces existing content. Fails with a clear error if the note is password protected.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the note to append to.
textYesPlain text to append. Each line becomes one paragraph.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate non-read-only and non-idempotent behavior. The description adds valuable context beyond the annotations: that existing content is preserved and that password-protected notes cause a clear error. It does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core behavior is front-loaded, and the critical caveat ('Never replaces existing content') appears immediately after the verb phrase.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter append operation, the description covers the core behavior, the non-destructive guarantee, and the main failure edge case. No output schema exists, but the agent has enough to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both id and text. The description does not add meaning beyond what the schema provides, placing it at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Append'), a resource ('existing note's body'), and a scope ('plain text') in the first sentence. It also distinguishes itself from sibling update_note by explicitly saying 'Never replaces existing content.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: to add text without replacing, which contrasts with update_note. Password-protected failure is also stated. However, it does not explicitly name alternatives or give a concrete 'use X instead' routing, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_noteCreate noteA

Create a new note from a plain-text body. Each line becomes its own paragraph; the title is rendered as a heading.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesPlain-text body. Each line becomes one paragraph.
titleYesNote title.
folderNoFolder to create the note in (default account folder if omitted).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal that this is a mutating, non-idempotent operation. The description adds useful behavioral detail beyond those hints: each line becomes its own paragraph and the title is rendered as a heading. This tells the agent how content will be transformed, which is valuable for predicting the tool's effect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The core operation is front-loaded, and the formatting behavior is stated immediately in the second sentence. Every part of the description earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple create operation with three well-documented parameters and no nested objects, the description is largely complete. It covers the essential creation behavior and formatting semantics, and the schema handles parameter defaults. A minor gap is the absence of any statement about return value or behavior when the target folder does not exist, but these are not critical for selecting or invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that the title is rendered as a heading, which is not present in the title parameter description. It also reinforces the body line-to-paragraph behavior, though folder semantics are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Create a new note from a plain-text body.' It also distinguishes the operation from sibling tools like append_to_note, update_note, and delete_note by emphasizing 'new note' and describing the input format. The line-to-paragraph and title-heading details further clarify what this tool uniquely does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Create a new note' implicitly signals when to use this tool, but the description never explicitly contrasts it with alternatives such as append_to_note for existing notes or update_note for modifying notes. Usage context is implied rather than stated, and there are no explicit when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_noteDelete noteA
Destructive

Delete one note by id. Notes.app moves it to Recently Deleted, where it stays recoverable for 30 days — this never permanently destroys it. There is no batch or title-based variant.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the note to delete.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark destructiveHint=true, but the description adds important nuance: the note moves to Recently Deleted, stays recoverable for 30 days, and is never permanently destroyed. This materially changes how an agent should weigh invoking the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight, front-loaded sentences communicate scope, side effects, recovery behavior, and boundary conditions without wasted words. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter delete tool, the description covers what it does, how to invoke it, what happens to the data, and what variants do not exist. The lack of an output schema is acceptable here because the behavioral outcome is fully described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the single 'id' parameter fully. The description confirms 'by id' but adds no extra format, source, or lifecycle detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Delete one note by id') with a clear resource and scope. The 'no batch or title-based variant' line also distinguishes it from any broader deletion sibling and from note-search/lookup tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames usage as deleting a single note by id and gives a negative constraint: there is no batch or title-based variant. This tells an agent when to use this tool and when not to reach for a non-existent alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_noteGet noteA
Read-only

Fetch one note by id or by exact title, rendered as markdown, plaintext, or raw html. Exactly one of id or title must be given. A title match is case-insensitive; if it matches more than one note, the tool reports the candidates instead of guessing. Fails with a clear error if the note is password protected.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoNote id, as returned by list_notes or search_notes.
titleNoExact note title (case-insensitive). Use when the id is not known.
formatNoBody rendering format (default markdown).

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the read-only safety profile is covered. The description adds meaningful behavior: multiple title matches are reported as candidates rather than silently guessing, and password-protected notes fail with a clear error. This exceeds the annotation baseline and could reach 5, but does not describe any pagination/limitations or the shape of candidate reporting, so a 4 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences pack a verb+resource statement, the exclusive-or constraint, matching behavior, and failure behavior with no filler. The core action is front-loaded and each sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with readOnlyHint=true, destructiveHint=false, and 100% schema coverage, the description covers the main calling constraints and edge cases (ambiguous titles, protected notes, rendering formats). It does not specify the output structure, but there is no output schema and the description does mention the formats; a 4 is fair, with 5 withheld only because the candidate-reporting format is not described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description compensates by explaining the mutual-exclusion constraint ('Exactly one of id or title must be given'), the case-insensitivity of title matching, and the behavior on ambiguous titles. These add real meaning beyond the schema's field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource — 'Fetch one note by id or by exact title' — and lists the return formats (markdown, plaintext, or raw html). It distinguishes itself from sibling list/search tools by showing it returns a single note identified by id or title.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the selection condition: exactly one of id or title must be given bracket clarity? The description says the title match is case-insensitive and reports candidates instead of guessing when ambiguous; it also names failure on password-protected notes. This guides when and how to use the tool vs. alternatives like list_notes/search_notes, which are referenced by the parameter descriptions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_foldersList foldersA
Read-only

List every Notes.app folder across every account.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds the global cross-account scoping behavior, but says nothing about response format or ordering, so it adds only modest context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that states exactly what the tool does with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless read-only listing tool, the description is sufficiently complete: it names the resource, the scope, and the operation. No output schema exists, but the low complexity and sibling context do not require more.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema coverage is 100%, so the schema fully accounts for inputs. Baseline for a zero-parameter tool is 4; the description correctly signals there are no filter options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'List' with resource 'Notes.app folder' and explicitly scopes to every account. This clearly distinguishes it from sibling tools, which all operate on notes rather than folders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for obtaining the full set of folders across all accounts, which provides clear context. However, it does not explicitly state when to prefer this tool over siblings or mention any alternatives/exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_notesList notesA
Read-only

List notes, most recently modified first. Optionally restrict to one folder. Password-protected notes are skipped. Limit defaults to 50, max 200.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum notes to return (default 50, max 200).
folderNoRestrict results to this folder name.

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral details beyond that: notes are sorted by most recent modification, password-protected notes are skipped, and the limit defaults to 50. These are useful execution-relevant traits not present in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences deliver the core function, ordering, filtering, access behavior, and limit policy. Every sentence earns its place, and the most important behavior is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, read-only, and has complete schema coverage, so the description covers the essential invocation details. However, there is no output schema and the description does not state what the returned notes contain (metadata vs full content), nor does it explicitly say that omitting folder lists all folders. A little more return-value context would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents folder and limit fully. The description repeats that limit defaults to 50 and max is 200, and that folder restricts results, but adds no meaning beyond the existing parameter descriptions. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'List notes, most recently modified first.' It also clarifies scope with optional folder restriction. It does not explicitly distinguish itself from sibling search_notes, but the verb 'list' plus the ordering makes the core purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance about when to use this tool versus search_notes, get_note, or list_folders. The only usage-related hint is 'Optionally restrict to one folder,' which implies use cases but does not name alternatives or exclusions explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_notesSearch notesA
Read-only

Case-insensitive search over note title and plaintext body. Password-protected notes are skipped. Limit defaults to 20, max 100.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum notes to return (default 20, max 100).
queryYesText to search for in the note title or body.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral details: case-insensitive matching, plaintext-body search, skipping password-protected notes, and the default/max limit. Return format and pagination are not mentioned, but the tool is a simple search operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences with no filler. Key information is front-loaded, and every sentence contributes: search scope, matching behavior, exclusions, and limit defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with only two parameters, a complete input schema, and annotations covering the read-only safety profile, this description is sufficient. An agent can correctly invoke it knowing what it searches, what it skips, and how the limit behaves.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds semantic value beyond the schema by specifying that matching is case-insensitive and limited to plaintext bodies, which clarifies how the query parameter behaves.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('search') and resource ('notes'), and further narrows scope to 'title and plaintext body'. This clearly differentiates it from siblings like list_notes (listing) and get_note (retrieving a single note).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the use case clear: case-insensitive text search across titles and bodies, with password-protected notes skipped. It does not explicitly name alternatives like list_notes or get_note or state when not to use it, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_noteUpdate noteA
Destructive

Replace an existing note's body, and optionally its title. Unlike append_to_note, this overwrites the note's existing content; the previous body is returned as undo material. Fails with a clear error if the note is password protected.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the note to update.
bodyYesNew plain-text body. Each line becomes one paragraph.
titleNoNew title. When omitted, the note's existing title is kept.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by disclosing that the previous body is returned as undo material and that the tool fails with a clear error for password-protected notes. These are important behavioral details not available from the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences of dense, useful information with no filler. It front-loads the core behavior, then adds the key sibling distinction, return value, and failure mode. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers all essential aspects: what is overwritten, what is returned, the failure condition, and how it differs from a closely related sibling. No output schema exists, but the description still communicates the key return behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents all three parameters with descriptions, including the optionality of title and the plain-text nature of body. The description reinforces that body is replaced and title is optional but does not add significant semantic detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Replace') and resource ('an existing note's body, and optionally its title'), making the tool's function immediately clear. It also explicitly distinguishes itself from the sibling append_to_note by stating that this tool overwrites content rather than appends.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the alternative append_to_note and explains the key difference: update_note overwrites existing content while append_to_note presumably adds to it. This gives an agent a clear decision rule for selecting between the two tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0
    • First observedappend_to_note
    • First observedcreate_note
    • First observeddelete_note
    • First observedget_note
    • First observedlist_folders
    • First observedlist_notes
    • First observedsearch_notes
    • First observedupdate_note

TDQS

A4.2/5.0

Scored across 8 tools

Disambiguation5/5

Each tool targets a distinct action: listing folders, listing notes, searching, fetching, creating, appending, deleting, and updating. Even the closely related append_to_note and update_note are clearly separated by replace vs. non-destructive append semantics.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case: list_, search_, get_, create_, append_to_, delete_, update_. The naming is predictable and makes the intent of each tool immediately clear.

Tool Count5/5

Eight tools is well-scoped for an Apple Notes MCP server. The set covers the core note lifecycle plus listing and searching without unnecessary redundancy or bloat.

Completeness4/5

The core note lifecycle is well covered: create, read, update, append, delete, list, and search. Minor gaps exist around folder management, such as no create/move/restore operations, but these do not block primary note workflows.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers