AirMCP

AirMCP

Safe action layer for your Apple workspace. AirMCP lets Siri, Shortcuts, Claude, Codex, Cursor, Raycast, opencode, Gemini CLI, Xcode agents, and any MCP-capable AI read, organize, and act across your Mac apps with approval gates for sensitive actions, HMAC-chained audit logs, rate limits, OAuth scopes, and local-first controls. The broad Apple + Google Workspace tool catalog is the surface; the workflow engine, semantic memory, Swift bridges, and governance layer are the runtime underneath.

Part of: Human-Controlled AI Systems · Research Program 1 (anchor — Apple-side agent governance).

Requires: macOS for the server. The recommended desktop path is the AirMCP menubar app: it owns the loopback HTTP runtime, while Claude/Codex/Cursor attach to it as clients. The direct CLI server (npx -y airmcp) still works for development and loads a curated starter module set (~111 tools); --full (or AIRMCP_FULL=true) enables all 29 modules / 286 tools. Most tools are pure JXA and work on macOS 14+ with no extra setup. Swift-backed tools — HealthKit, on-device semantic search, recurring events/reminders, photo import/delete/classify, Vision, Speech, Location, Bluetooth, and Apple Intelligence previews — need the optional Swift bridge — build it from a source checkout with npm run swift-build (it is shipped in neither the npm tarball nor the .mcpb bundle; the bundled macOS app does carry it); without it those tools return a clear "Swift bridge not found" error and everything else keeps working. FoundationModels-backed Apple Intelligence and AskAirMCPIntent additionally require macOS 26+ on Apple Silicon and an opt-in Swift build with AIRMCP_ENABLE_FOUNDATION_MODELS.

Available in multiple languages at the project landing page.

What this is — at a glance

• Currently implemented — 286 tools across 29 modules (a curated starter set loads by default; --full enables all; Swift-backed tools need the optional bridge, see Requires above); HMAC-chained audit log with tamper-detection test suite; default HITL approval per destructive/sensitive call; rate limit (60/min + 10 destructive/hr); allowNetwork inbound HTTP exposure policy (RFC 0002); OAuth 2.1 + Resource Indicators (RFC 0005 Steps 1+2 — RS256/ES256 JWT, scope gate, .well-known/oauth-protected-resource per RFC 9728); sessionless .well-known/mcp.json discovery; 228 Shortcuts/AppIntents auto-generated from the tool manifest; native SwiftUI menubar app (ad-hoc signed; Developer ID notarization pending); Claude Code plugin package (.claude-plugin/plugin.json + .mcp.json at repo root, with the .mcp.json invocation pinned to the same npm version as the manifest so the marketplace SHA-approval and the installed runtime always agree). On every CI run, npm run mcp:validate boots the built dist/index.js under a pinned @modelcontextprotocol/inspector --cli and checks the tools/list response for JSON-RPC envelope drift, embedded error envelopes, and zero-tool responses — this is a wire-shape gate, not a substitute for the HMAC / HITL / audit primitives, which have their own tests.