Mac Organiser MCP

Mac Organiser MCP

Reminders, Calendar and Notes for your AI assistant, on your terms.

Only the lists, calendars and folders you choose. Nothing else leaves the app.

WHY · TOOLS · PRIVACY · QUICK START · CONFIGURATION · HOW IT WORKS

Why

Most Apple MCP servers paste whatever the model sends straight into an AppleScript or a shell command. That means any text the model reads, such as a web page, an email or a shared Reminders list someone else can edit, can become a command running as you. They also tend to hand the model everything: every reminder, every note, every calendar.

This one takes the opposite approach on both counts:

• 🔒 Nothing the model sends can ever run as code. Each app has one fixed script, and your data travels to it only as a value.
• 🫥 Your assistant sees only what you allow. Lists, calendars and folders outside your allowlist are filtered inside the app itself, so they never reach the server, let alone the model.
• ✉️ Nothing outward-facing. It can't invite anyone, notify anyone or load anything from the internet.

[!IMPORTANT]

Anything a tool returns is sent to your model provider as part of the conversation. Allowlists are your main control over what that can include, so keep them tight.

What your assistant can do

Each app is off until you enable it. Writes can be switched off per app, and deletes are always opt-in.

Dates are ISO 8601: 2026-10-29, 2026-10-29T14:00 (your local time) or 2026-10-29T14:00+11:00.

Private by default

Never returned, whatever you set: event attendees, reminder creation and modification dates, the *Recently Deleted* notes folder, and the contents of locked notes.

Quick start

Requirements

Install

Nothing to install: your MCP client runs it from npm with npx -y mac-organiser-mcp, as in the configs below.

Run from source instead

git clone https://github.com/nicksull/mac-organiser-mcp ~/repos/mac-organiser-mcp

cd ~/repos/mac-organiser-mcp npm ci npm run build

Then use node and the full path to dist/index.js in place of npx and -y mac-organiser-mcp.

Works with

It's a standard Model Context Protocol server that runs locally over stdio, so it isn't tied to any one assistant. Every client needs the same three things: the command npx, the arguments -y mac-organiser-mcp, and your settings as environment variables.

[!WARNING]

You *can* put a local MCP server behind a public HTTPS tunnel so ChatGPT can reach it, but don't do that with this one. It would put your Reminders, Calendar and Notes on an internet-facing endpoint, which defeats the point of the design.

Claude Code

claude mcp add -s user mac-organiser \

-e MAC_ORGANISER_APPS=reminders,calendar,notes \ -e REMINDERS_LISTS="Reminders,Groceries" \ -e CALENDAR_CALENDARS="Work,Home" \ -e NOTES_FOLDERS="AI" \ -- npx -y mac-organiser-mcp

Claude Desktop · Cursor · Windsurf

All three use the same mcpServers shape:

{

"mcpServers": { "mac-organiser": { "command": "npx", "args": ["-y", "mac-organiser-mcp"], "env": { "MAC_ORGANISER_APPS": "reminders,calendar,notes", "REMINDERS_LISTS": "Reminders,Groceries", "CALENDAR_CALENDARS": "Work,Home", "NOTES_FOLDERS": "AI" } } } }

[!IMPORTANT]

- GUI apps don't load your shell PATH. If Node comes from nvm, fnm or asdf, set "command" to the output of which npx (e.g. /Users/you/.nvm/versions/node/v22.x.x/bin/npx).

- Claude Desktop only reads its config at launch, so quit it fully (⌘Q) and reopen after editing.

VS Code

VS Code uses servers and an explicit type:

{

"servers": { "mac-organiser": { "type": "stdio", "command": "npx", "args": ["-y", "mac-organiser-mcp"], "env": { "MAC_ORGANISER_APPS": "reminders,calendar,notes", "REMINDERS_LISTS": "Reminders,Groceries", "CALENDAR_CALENDARS": "Work,Home", "NOTES_FOLDERS": "AI" } } } }

OpenAI Codex CLI

[mcp_servers.mac-organiser]

command = "npx" args = ["-y", "mac-organiser-mcp"]

[mcp_servers.mac-organiser.env] MAC_ORGANISER_APPS = "reminders,calendar,notes" REMINDERS_LISTS = "Reminders,Groceries" CALENDAR_CALENDARS = "Work,Home" NOTES_FOLDERS = "AI"

Config formats change between client versions; if one doesn't match, check that client's MCP docs.

[!TIP]

A dedicated Notes folder (say, AI) makes a great allowlist: a scratchpad your assistant can read and write, while the rest of your notes stay out of reach.

Permissions

macOS asks once per app the first time it's used. Click Allow.

[!NOTE]

These permissions belong to the host app (Terminal, Cursor, VS Code, Claude Desktop…), not to this server. Anything else running inside that app gets the same access. The first Calendar call waits up to 40 seconds for you to answer the prompt.

Configuration

Everything is an environment variable. Flags take 1, true or yes.

If an app is enabled without its required allowlist, it stays off and the server says why on stderr.

How it works

flowchart LR

client["AI client (Claude, Cursor, Codex…)"] -->|"tool call (JSON)"| zod

subgraph server["Mac Organiser MCP · Node"] zod["Validate every argument (zod: IDs, dates, lengths)"] exec["execFile osascript no shell"] zod --> exec end

subgraph mac["Inside the Apple app"] script["Fixed JXA script request arrives as one JSON value"] filter{"In your allowlist?"} data[("Reminders · Calendar · Notes")] script --> filter filter -->|yes| data filter -.->|no: 'not found'| script end

exec -->|argv| script data -->|only allowed fields| exec exec -->|result| client

Why injection can't happen

The usual pattern builds a script out of the model's text, so a stray ' or " turn