Atlas / MCP servers / sweetrb / apple-notes-mcp

apple-notes-mcpBLOCK

mcp/sweetrb/apple-notes-mcp

MCP server for Apple Notes - read, search, create, edit, organize, and export notes on macOS via Claude and other AI assistants

Verdict
BLOCK
Grade
F
Trust score
56 /100
Exposed tools
33 24r · 5w · 4d
Transport
stdio
License
MIT
Stars
151
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server that lets Claude (Claude Code and Claude Desktop), Codex, and other MCP clients read, search, create, edit, organize, and export notes in Apple Notes on macOS. It runs locally on your Mac and talks to Notes through AppleScript, Apple Shortcuts, and read-only access to the Notes database.

Beyond creating and editing notes, it manages folders and accounts, native tags, checklists, tables, pinned notes, links, and attachments. It can also export notes as Markdown (through templates you can edit in a local web editor), HTML (with classic drawings as SVG), or JSON, read audio transcripts and drawings, link to single paragraphs with anchors that survive edits, and run a query language across your whole library.

[](https://www.npmjs.com/package/apple-notes-mcp) [](https://www.npmjs.com/package/apple-notes-mcp) [](https://www.npmjs.com/package/apple-notes-mcp) [](https://github.com/sweetrb/apple-notes-mcp/actions/workflows/ci.yml) [](https://scorecard.dev/viewer/?uri=github.com/sweetrb/apple-notes-mcp) [](https://www.apple.com/macos/) [](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io)

Read from source at commit 79ac6a862c7dOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add apple-notes-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "apple-notes-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (33)

24 read · 5 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
Alphareadis in folder
Codingreadhas tag #Coding
EditorialreadHouse style
Scansreadhas Scans attachments
aread
analyze-svgread
applescriptCoredestructiveCreate, read, search, update, move, and delete notes and folders through Notes.app
audioTranscriptionreadRead the transcripts Notes stored for a note
bread
backgroundOperationsBridgereadNative background edits through the Background Operations bridge, verified by exact-ID database readback
bulletListreadAn <h2> section heading followed by a native <ul> bullet list
checklistTogglereadCheck or uncheck an existing checklist item in place
codeSpanreadA <tt> code span — the tag is dropped, only its text survives
delete-folder-by-iddestructive
delete-markdown-templatedestructive
fullDiskAccessReadsreadRead-only reads of the Notes database: queries, checklist state, metadata, links, note structure, tables, native objects, tags, smart folders, special and recent notes, folder tree, Paper and attachment exports, Markdown and HTML exports, and sync detail
futureThingreadx
headingAndParagraphsreadAn <h1> title and two <div> paragraphs separated by a spacer row
inlineEmphasisreadInline <b> and <i> emphasis inside a paragraph div
list-markdown-templatesread
markdownNoteBridgewriteCreate a note from Markdown with real Title, Heading, and Subheading styles through the Create Markdown Note bridge
markdownTemplateLibrarydestructiveValidate, save, list, show and delete Markdown export templates (local JSON files; exporting with one still needs Full Disk Access)
nativeTagsBridgewriteAdd real Notes tags through the Native Tags bridge
obsidianreadObsidian-style Markdown: YAML front matter (title, dates, folder, tags, id), image-URL link cards as images, attachments copied to <file>.assets
paragraphLinksreadList a note
save-markdown-templatewrite
shortcutsBridgeswriteRun the optional native-write Shortcut bridges in the background
show-markdown-templateread
smartFolderswriteCreate or edit Smart Folders and their tag rules
spacerRunsreadConsecutive <div><br></div> spacer rows between two paragraphs
standard-markdownreadThe default export-notes-markdown output
svgAnalysisreadAnalyze a local SVG file for conversion into editable strokes: classification, required losses, and a digest
validate-markdown-templateread
04

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/index.ts:862
`Absolute path of a local UTF-8 file to use as the body instead of content (pass exactly one). The same locations save-attachment may write to are allowed (home, temp, /Volumes), except hidden paths (
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/tools/directOperations.ts:242
"Use when: adding one local file to an exact note without replacing its body.\nReturns: the new attachment id, byte count, attachment name, and post-write content hash after exact byte verification.\n
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/tools/markdownTemplates.ts:163
"Safety: read-only. Pass exactly one of name (a saved or built-in template), template (JSON object or text) or templateFile. templateFile reads only a regular .json file in home, temp or /Volumes, ref
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/tools/svgAnalysis.ts:84
"Safety: read-only and local. Opens no Notes data and makes no network request. Reads only a regular file in home, temp or /Volumes, refusing hidden paths (~/.ssh, .env) and ~/Library outside iCloud D
Why it matters. touches a credential store
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
CLAUDE.md:458
When a user is setting up the server or reports permission errors, you can suggest they run `apple-notes-mcp setup --permissions` in their terminal. It reports Full Disk Access, Automation of Notes.ap
Why it matters. asks the agent to act without the user's knowledge
MEDIUMInventory / provenance · inv.binary · CWE-1104
shortcuts/Apple Notes MCP - Background Operations v5.shortcut
Apple Notes MCP - Background Operations v5.shortcut
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
shortcuts/Apple Notes MCP - Create Markdown Note.shortcut
Apple Notes MCP - Create Markdown Note.shortcut
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
shortcuts/Apple Notes MCP - Native Tags.shortcut
Apple Notes MCP - Native Tags.shortcut
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/services/notesExportTemplate.test.ts:167
const secret = "hunter2-SECRET-VALUE";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/tools/svgAnalysis.test.ts:159
const secret = "hunter2-SECRET-VALUE";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/utils/templateAssets.test.ts:223
const secret = "hunter2-SECRET-VALUE";
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
applescriptCore, delete-folder-by-id, delete-markdown-template, markdownTemplateLibrary
Why it matters. 4 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.binary · CWE-1104
src/utils/fixtures/background-probe-table.gz
background-probe-table.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/utils/pasteboardFreeze.test.ts:338
const main = new Function("ObjC", "$", `${PASTEBOARD_FREEZE_JXA}\nreturn run;`)(ObjC, $) as (
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/utils/readAllowedTextFile.test.ts:80
writeFileSync(join(dir, ".ssh", "id_ed25519"), "PRIVATE KEY");
Why it matters. touches a credential store
LOWPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/services/broker.test.ts:116
if (cmd === "/bin/launchctl" && args[0] === "bootstrap")
LOWPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/services/broker.test.ts:118
if (cmd === "/bin/launchctl" && args[0] === "print") return overrides.print ?? SERVICE_ABSENT;
LOWPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/services/broker.test.ts:119
if (cmd === "/bin/launchctl" && args[0] === "bootout")
LOWPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/services/broker.test.ts:121
if (cmd === "/bin/launchctl") return { status: 0 };
LOWPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
src/services/broker.test.ts:587
expect(calls.some(([cmd]) => cmd === "/bin/launchctl")).toBe(false);
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/createNoteTool.test.ts:259
const response = await createNote({ title: "Plan", contentPath: "/etc/hosts" });
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/services/attachmentSave.test.ts:119
const r = manager.saveAttachmentById("x-coredata://A/ICNote/p1", "att-1", "/etc/evil.png");
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/services/notesExportTemplate.test.ts:338
const escapeOut = "/etc/out.md";
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/services/permissions.test.ts:58
execPath: "/usr/local/bin/node",
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/services/permissions.test.ts:117
expect(fda.fix).toContain("/usr/local/bin/node");

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 79ac6a862c7dfull audit observations/trust-audit/mcp-server/sweetrb__apple-notes-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1179ac6a862c7dBLOCKF56first audit
06

Questions

What is the apple-notes-mcp MCP server?

MCP server for Apple Notes - read, search, create, edit, organize, and export notes on macOS via Claude and other AI assistants

What tools does apple-notes-mcp expose?

33 in total: 24 read-only, 5 that write, and 4 that can delete or overwrite (applescriptCore, delete-folder-by-id, delete-markdown-template, markdownTemplateLibrary). Every one is listed on this page with its risk.

Is apple-notes-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (56/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does apple-notes-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does apple-notes-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as apple-notes-mcp at 2.15.0.

How current is this page?

The grade is for one exact copy of the source (79ac6a862c7d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement