Apple ShortcutsSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server that lets AI assistants like Claude control Apple Shortcuts automations. This enables AI models to trigger shortcuts and automate tasks on macOS in a safe and controlled way.
What is MCP? 🤔
The Model Context Protocol (MCP) is a system that lets AI apps, like Claude Desktop, connect to external tools and data sources. It gives a clear and safe way for AI assistants to work with local services and APIs while keeping the user in control.
What does this server do? 🚀
The Apple Shortcuts MCP server:
- Enables AI assistants to list available shortcuts
- Allows running shortcuts by name with optional input parameters
- Provides a simple interface for automation control
Prerequisites 📋
Before you begin, ensure you have:
- Node.js (v18 or higher)
- Claude Desktop installed
- macOS with Shortcuts app configured
Configuration to use Apple Shortcuts Server ⚙️
Here's the Claude Desktop configuration to use the Apple Shortcuts server:
{
"mcpServers": {
"apple-shortcuts": {
"command": "npx",
"args": ["-y", "mcp-server-apple-shortcuts"]
}
}
}Build Apple Shortcuts Server and run locally 🛠️
- Clone this repository:
git clone [email protected]:recursechat/mcp-server-apple-shortcuts.git
- Install dependencies:
npm install
- Build project
npm run build
Here's the Claude Desktop configuration to use the Apple Shortcuts server with a local build:
{
"mcpServers": {
"apple-shortcuts": {
"command": "npx",
"args": ["/path/to/mcp-server-apple-shortcuts/build/index.js"],
}
5d24afa55e1fOBSERVED · 2026-10-03Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-server-apple-shortcuts -- npx -y [email protected]
{
"mcpServers": {
"mcp-server-apple-shortcuts": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
list_shortcuts | read | List all available shortcuts |
run_shortcut | write | Run a Shortcuts automation by name |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, shx, zod, @types/node, typescript
Gates applied: no_behavioural_pass.
5d24afa55e1ffull audit observations/trust-audit/mcp-server/recursechat__apple-shortcuts.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-03 | 5d24afa55e1f | SAFE | B | 89 | first audit |
Questions
What tools does Apple Shortcuts expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Apple Shortcuts safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Apple Shortcuts need?
No credential environment variables were found in its source, so it appears to need none.
How does Apple Shortcuts run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-server-apple-shortcuts at 1.0.1.
How current is this page?
The grade is for one exact copy of the source (5d24afa55e1f), read on 2026-10-03. The repository is watched and re-audited when it changes.