Apple MCP: why it is not safe to use
We found broad delete and send capabilities plus access to local Messages data, so this skill needs careful use and tighter safeguards.
What we found
Our review did not find hidden instructions, hardcoded secrets, obfuscated code, privilege escalation, or undisclosed data transfer to a third party. The main concern is scope and sensitivity of access on the local Mac.
This skill can delete notes, folders, reminders, contacts, and calendar items, and it can send mail or messages. The README describes optional safety flags, but in normal mode these actions are available without a built in confirmation step.
We also found that the Messages component reads the local Messages database at `~/Library/Messages/chat.db` and requires Full Disk Access. Mail and Messages features can expose private communications, which raises privacy risk, especially for non-technical users.
What to do instead
Use this skill only if you need these app integrations and are comfortable granting the required macOS permissions. Prefer enabling the documented safety flags, testing in a non-critical account, and limiting use to read-only tasks where possible.
If you do not need message or mail access, choose a narrower tool that does not require Full Disk Access or that separates read access from send and delete actions.
Source: https://github.com/griches/apple-mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.