ModelsAtlas
Explore
Atlas / MCP servers / mb-dev / macOS UI Automation

macOS UI AutomationSAFE

mcp/mb-dev/macos-ui-automation
MCP server by mb-dev · Audited 2026-10-08
⚑ Report / re-scanSource ↗
Verdict
SAFE
Grade
B
Trust score
86 /100
Exposed tools
8 8r · 0w · 0d
Transport
sse · streamable-http
License
—
Stars
33
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Like Playwright, but for native macOS applications. Control any Mac app with natural language through Claude - perfect for developing and testing Mac applications with AI assistance.

[](https://www.python.org/downloads/) [](https://modelcontextprotocol.io/) [](https://opensource.org/licenses/MIT)

🎯 What is this?

This is an MCP (Model Context Protocol) server that gives Claude the ability to see and interact with any macOS application - just like Playwright does for web browsers, but for native Mac apps.

Perfect for:

  • 🧪 Testing Mac applications - "Test the login flow in my app"
  • 🔍 App development - "Check if all buttons are properly labeled"
  • 🤖 UI automation - "Fill out this form and submit it"
  • 📱 App exploration - "Show me all the interactive elements in Finder"

🚀 Quick Start

1. Install

git clone https://github.com/mb-dev/macos-ui-automation-mcp.git
cd macos-ui-automation-mcp
uv sync

2. Set Up Accessibility Permissions

⚠️ Critical: Enable accessibility for your parent application:

  • If using Terminal: Add Terminal to System Settings → Privacy & Security → Accessibility
  • If using VS Code: Add VS Code to System Settings → Privacy & Security → Accessibility
  • If using Claude Code: Add Claude Code to System Settings → Privacy & Security → Accessibility

The parent app needs permission because it's the one actually executing the MCP server.

3. Configure Claude Code

Add to your Claude Code MCP settings:

{
"mcpServers": {
"macos-ui-automation": {
"command": "uv",
"args": [
"--directory",
"/absolute/path/to/macos-ui-automation-mcp",
"run",
"macos-ui-automation-mcp"
]
}
}
}
Read from source at commit 6d57a10179bfOBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add macos-ui-automation-mcp -- uvx macos-ui-automation-mcp
claude-desktop
{
  "mcpServers": {
    "macos-ui-automation-mcp": {
      "command": "uvx",
      "args": [
        "macos-ui-automation-mcp"
      ]
    }
  }
}
03

Exposed tools (8)

8 read · 0 write · 0 destructive.

ToolRiskDescription
check_accessibility_permissionsreadCheck if accessibility permissions are properly configured.
click_at_positionreadClick at a specific screen position using coordinates.
click_element_by_selectorreadClick a UI element using accessibility actions (AXPress) via JSONPath selector.
find_elementsreadFind UI elements matching a JSONPath selector.
get_app_overviewreadGet a quick overview of all running applications with shallow UI inspection.
get_element_detailsreadGet detailed information about a specific UI element.
list_running_applicationsreadList all currently running applications with basic info.
type_text_to_element_by_selectorreadType text into a UI element using JSONPath selector.
04

Trust audit

SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
sse,streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
CONTRIBUTING.md:18
curl -LsSf https://astral.sh/uv/install.sh | sh

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha 6d57a10179bffull audit observations/trust-audit/mcp-server/mb-dev__macos-ui-automation.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-086d57a10179bfSAFEB86first audit
06

Questions

What tools does macOS UI Automation expose?

8 in total: 8 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is macOS UI Automation safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does macOS UI Automation need?

No credential environment variables were found in its source, so it appears to need none.

How does macOS UI Automation run?

It speaks sse and streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as macos-ui-automation-mcp.

How current is this page?

The grade is for one exact copy of the source (6d57a10179bf), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement