Ten of the eleven tools only read the local databases; sending is the one with an effect outside the machine, which makes the risk easy to reason about before you grant anything. The permissions are granular rather than one switch, which is why two of the tools are diagnostics — a failed read tells you which of the three you are missing.
A read-mostly bridge to the local macOS Messages and AddressBook databases, opened read-only, with a single tool that sends — and that one drives Messages.app only when the client calls it.
- Recent messages across all conversations or filtered to one contact or a named group chat, as plain text with timestamps and participants
- Fuzzy search across local message text inside a time window, with a similarity threshold you set and scores returned alongside the matches
- Attachments found by date range, sender and MIME type as metadata first, then one fetched by id — small images inline, HEIC converted to PNG, and a local path for anything larger
- Contacts resolved by approximate name into a numbered list with confidence scores, returning send-ready numbers the message tools accept
- One outgoing message to a person or a group, over iMessage with SMS or RCS fallback for eligible phone recipients, with a reachability check available first
- Named group chats listed with the chat ids that reads and sends both accept
- Separate diagnostics for Messages database access and AddressBook access, reporting the permission or path error behind a failed read
macOS only, with Messages open, signed in and already able to send an ordinary message, plus uv and Python 3.10 or newer. The permissions are the actual install work: grant Full Disk Access to whatever launches the server — your MCP client, or the terminal you start it from — and quit and reopen that app afterwards. macOS then asks separately for Contacts access on the first name lookup and for permission to control Messages on the first send.
One command — uvx mac-messages-mcp