Skip to content

Add safety disclaimer to README and DMG installer #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frouaix merged 2 commits into from
Feb 22, 2026
Merged

Add safety disclaimer to README and DMG installer #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06c03f8
Add safety disclaimer to README and DMG installer
frouaix Feb 22, 2026
440d2c0
Fix EPIPE race on executor stdin write
frouaix Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,19 @@

A local MCP server that exposes controlled AppleScript automation tools to MCP clients on macOS.

> [!CAUTION]
> **This software can read, create, modify, and delete your personal data** across Notes, Calendar, Reminders, Mail, Contacts, Messages, Photos, Music, Finder, and Safari.
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The caution banner claims the server can "read, create, modify, and delete" data across all listed apps. That’s not accurate given current adapter capabilities (e.g., Messages explicitly has no create/update/delete; Photos and Music also have no update/delete; Safari has no update). Consider rewording to reflect that capabilities vary by app and operation mode (e.g., read access across apps, and create/modify/delete only for some apps/tools).

Suggested change
> **This software can read, create, modify, and delete your personal data** across Notes, Calendar, Reminders, Mail, Contacts, Messages, Photos, Music, Finder, and Safari.
> **This software can read your personal data across** Notes, Calendar, Reminders, Mail, Contacts, Messages, Photos, Music, Finder, and Safari, **and, depending on the app and operation mode, may be able to create, modify, or delete data in some of these apps.**

Copilot uses AI. Check for mistakes.
>
> By running this server you are granting an AI model the ability to interact with your macOS applications on your behalf. Although multiple safety layers exist (operation modes, per-app allowlists, destructive-action confirmation), **no automated safeguard is foolproof**. An unexpected prompt, a misconfigured policy, or a model hallucination could result in **data loss, disclosure of private information, or unintended actions** such as sending messages or emails.
>
> **You are solely responsible for:**
> - Reviewing and understanding the [configuration](#configuration) and [policy model](#policy-model) before enabling any app
> - Starting in `readonly` mode and only escalating when you understand the consequences
> - Keeping the number of enabled apps to the minimum you actually need
> - Never running in `full` mode unattended
>
> This project is provided **as-is, with no warranty**. See [LICENSE](LICENSE).

## Overview

MCP-AppleScript provides a secure bridge between the [Model Context Protocol](https://modelcontextprotocol.io/) and macOS automation via AppleScript. It consists of two components:
Expand Down
4 changes: 3 additions & 1 deletion packages/mcp-server/src/exec/executor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,9 @@ export async function runExecutor(
});
});

// Write request JSON to stdin and close
// Write request JSON to stdin and close.
// Ignore EPIPE — the child may exit before reading all input.
child.stdin.on("error", () => {});
const requestJson = JSON.stringify(request);
child.stdin.write(requestJson);
child.stdin.end();
Expand Down
13 changes: 13 additions & 0 deletions scripts/build-dmg.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,19 @@ cat > "$STAGING/INSTALL.txt" <<'INSTALL_EOF'
MCP-AppleScript Bridge Server
==============================

⚠️ WARNING — READ BEFORE USE ⚠️

This software can read, create, modify, and delete your personal data
across Notes, Calendar, Reminders, Mail, Contacts, Messages, Photos,
Music, Finder, and Safari.
Comment on lines +57 to +59
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This warning states the server can "read, create, modify, and delete" personal data across all listed apps, but several shipped adapters don’t support some of those operations (e.g., Messages has no create/update/delete; Photos/Music have no update/delete; Safari has no update). Please rephrase to avoid overstating capabilities (e.g., read access across apps, with create/modify/delete varying by app and mode).

Suggested change
This software can read, create, modify, and delete your personal data
across Notes, Calendar, Reminders, Mail, Contacts, Messages, Photos,
Music, Finder, and Safari.
This software can read your personal data across Notes, Calendar,
Reminders, Mail, Contacts, Messages, Photos, Music, Finder, and Safari,
and may be able to create, modify, or delete data depending on the app
and the configured mode.

Copilot uses AI. Check for mistakes.

By running this server you grant an AI model the ability to interact
with your macOS applications. No automated safeguard is foolproof.
Start in readonly mode, enable only the apps you need, and never run
in full mode unattended.

Provided as-is with no warranty. See LICENSE.

Installation:
1. Copy "mcp-applescript" to /usr/local/bin/ (or another directory in your PATH):
sudo cp mcp-applescript /usr/local/bin/
Expand Down
Loading