# Reported issues for macOS-MCP

Pod holds 17 of 17 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [macOS-MCP](/mcp/macos-mcp-jeomon).

## Most discussed

### MacOs MCP troubleshoot

Title: MacOS-MCP works manually but disconnects immediately in Claude Desktop

Hello,

I tested MacOS-MCP on macOS with Claude Desktop and found the following behavior:

What works:

* `uv` is installed correctly
* `uv run macos-mcp` works in Terminal
* manual MCP handshake works
* `initialize` works
* `tools/list` works and returns the tool list

What fails:

* when Claude Desktop starts the server, it logs:

  * `Server started and connected successfully`
  * then `Failed to spawn process: No 

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/1) · 2026-04-08 · closed · external user · 5 comments

### unresolvable Accessibility permission loop on versions below 0.3.10

[macos-mcp-accessibility-writeup.md](https://github.com/user-attachments/files/30595137/macos-mcp-accessibility-writeup.md)

Symptoms

The macos-mcp server appears in Claude, then immediately disconnects. The log repeats:

Missing permissions: Accessibility.
Required permissions not granted.
Server transport closed unexpectedly

A System Settings window opens on its own, landing on Privacy & Security > Accessibility.

The stumbling block

The error says to grant Accessibility permission, but nev

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/32) · 2026-07-31 · closed · external user · 2 comments

### Published Claude Desktop extension is v0.1.0 — ships the (already-fixed) EventObserver memory leak

## Correction

Apologies — I filed this against the **v0.1.0** build published as the Claude Desktop
extension (`ant.dir.gh.cursortouch.macos-mcp`) without first checking `main`. The
autorelease-pool leak described below is **already fixed in `main`** (now v0.3.7) by:

- `5f80964` — fix: plug AXObserver memory leak in EventObserver
- `d382a18` — fix: drain autorelease pools on secondary AX threads

So there is no leak to fix in the current source. Leaving this open only for the part that
is stil

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/19) · 2026-06-19 · closed · outside contributor · 2 comments

### Claude Desktop extension bundle is pinned at 0.3.8 while PyPI ships 0.3.17 (recurrence of #19)

## Summary

The Claude Desktop extension (`ant.dir.gh.cursortouch.macos-mcp`) currently installs **0.3.8**, while PyPI ships **0.3.17**. This is a recurrence of #19, where the published extension was stuck at v0.1.0.

## Why users cannot work around it

The bundle vendors its own source rather than resolving from PyPI:

```
# uv.lock
name = "macos-mcp"
version = "0.3.8"
source = { editable = "." }
```

Because `uv --directory <ext> run macos-mcp serve` resolves the package to the bundle's own `s

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/57) · 2026-08-16 · closed · external user · 1 comment

### Notification tool fails for any non-ASCII text (CJK, emoji): AppleScript can't parse \uXXXX escapes

**Symptom:**
`Notification(message="通知测试")` returns:
`Failed to send notification: 33:34: syntax error: Expected """ but found unknown token. (-2741)`
ASCII-only messages work fine.

**Root cause:** `Desktop.notify` in `desktop/service.py` builds the AppleScript with `json.dumps(message)`. `json.dumps` defaults to `ensure_ascii=True`, so non-ASCII characters are emitted as `\uXXXX` escapes — which AppleScript string literals don't support (only `\"`, `\\`, `\n`, `\t`, `\r`).

**Fix (verified loc

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/27) · 2026-07-10 · closed · external user · 1 comment

### Extension exits at startup under Claude Desktop: AXIsProcessTrusted() is always False because the host spawns MCP servers with disclaimed responsibility

**Environment:** macOS 26 (Tahoe), Claude Desktop, extension v0.3.8 from the Anthropic registry, uv 0.7.2.

**Symptom:** The extension shows "Server disconnected" immediately after install. Log: `Required permissions not granted: Accessibility. ... sys.exit(1)` — even though the Claude app has Accessibility granted in System Settings.

**Root cause:** Claude Desktop launches extension servers through `/Applications/Claude.app/Contents/Helpers/disclaimer`, which disclaims TCC responsibility. The 

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/26) · 2026-07-10 · closed · external user · 1 comment

### **Bug: Accessibility permission dialog rejects the bundled Python interpreter (macOS Apple Silicon)**

**Bug: Accessibility permission dialog rejects the bundled Python interpreter (macOS Apple Silicon)**

Environment:
- macOS, Apple Silicon (M-series)
- Claude Desktop, extension installed via official directory
- uv 0.11.26 installed, `uv run macos-mcp serve` connects successfully via MCP protocol
- Server logs show "Missing permissions: Accessibility" and fails to stay connected

What I tried (all unsuccessful):
1. Adding the app via System Settings > Privacy & Security > Accessibility > "+"
  

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/22) · 2026-07-07 · closed · external user · 1 comment

### v0.3.7 has three issues that prevent it from running as a Claude Desktop extension

**Title:** v0.3.7 has three issues that prevent it from running as a Claude Desktop extension

**Environment**
- macOS 26.2 (Tahoe), Apple Silicon (M1 Pro)
- Claude Desktop 1.11187.1
- uv 0.11.7
- Installed by extracting the v0.3.7 source tarball into Claude Desktop's extension folder (no pre-built `.mcpb` available for this release)

Three independent issues surface in sequence. I worked around all three with local patches — sharing in case you'd like to fix them upstream.

---

### 1. `manifes

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/12) · 2026-06-05 · closed · external user · 1 comment

## Most recent

### Shell tool child processes inherit the MCP stdin stream, hanging the client indefinitely

## Problem

`ExecuteCommand` in `src/macos_mcp/ax/core.py` spawns commands with `subprocess.run(capture_output=True, ...)` and **no `stdin=` argument**, so the child inherits fd 0.

Under the stdio transport, fd 0 *is* the JSON-RPC request stream. Any command that reads stdin — `sudo` prompting for a password, `ssh`, `git` asking for credentials, `brew`/`npm` confirmation prompts, a bare `cat` — consumes the client's protocol messages. The server never sees those requests, so it never replies, a

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/30) · 2026-07-24 · closed · outside contributor · 0 comments

### Feature request: ship a code-signed + notarized release so TCC attributes access to one named entity

## Summary

Please distribute macOS-MCP as a **Developer ID code-signed and notarized** build — ideally a small bundled helper `.app` with a proper `Info.plist` (CFBundleIdentifier / CFBundleName / CFBundleDisplayName) and an icon — with a **stable signing identity** across releases.

As shipped today (run via ad-hoc-signed Homebrew `uv` → `python3` → the `Shell` tool spawning `node`/`git`), the server's privacy grants show up in **System Settings → Privacy & Security** as multiple bare, icon-le

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/25) · 2026-07-09 · open · external user · 0 comments

### Snapshot/screenshot fails on macOS 15+: CGWindowListCreateImage returns NULL ("cannot identify image file")

## Summary

The `Snapshot` tool (with `use_vision=true`) and any other screenshot path fails on modern macOS with:

```
Error calling tool 'Snapshot': cannot identify image file '/tmp/tmpXXXXXXXX.png'
```

Even with Screen Recording permission fully granted to the host app.

## Root cause

`CaptureScreen()` in `src/macos_mcp/ax/core.py` uses `Quartz.CGWindowListCreateImage`. Apple deprecated `CGWindowListCreateImage` in macOS 14.4, and on macOS 15 (Sequoia) and later it returns `NULL` unless the

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/23) · 2026-07-07 · closed · outside contributor · 0 comments

### Bug: SyntaxError on startup — misplaced variable assignment in published wheel

### Description
uvx macos-mcp fails immediately with a SyntaxError in the published PyPI wheel. The variable _SCRAPE_MAX_CHARS = 20_000 is positioned between the @mcp.tool(...) decorator and its target function scrape_tool, which is invalid Python syntax. The decorator must be immediately followed by the function definition.

### To reproduce
uv cache clean
uvx macos-mcp

### Error output
Traceback (most recent call last):
  File ".../bin/macos-mcp", line 6, in <module>
    from macos_mcp.__main

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/9) · 2026-05-29 · closed · external user · 1 comment

### 0.3.6 is broken on import — @mcp.tool decorator placed above assignment, not function

## Summary

`macos-mcp` 0.3.6 (current PyPI latest) cannot be imported. Any client that spawns it dies immediately with a `SyntaxError` before serving a single tool call. 0.3.5 is unaffected.

## Repro

```
$ uvx --from 'macos-mcp==0.3.6' macos-mcp --help
Traceback (most recent call last):
  File ".../bin/macos-mcp", line 6, in <module>
    from macos_mcp.__main__ import main
  File ".../site-packages/macos_mcp/__main__.py", line 431
    _SCRAPE_MAX_CHARS = 20_000
    ^^^^^^^^^^^^^^^^^
SyntaxErr

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/8) · 2026-05-27 · closed · external user · 0 comments

### Memory leak in `_update_observers` (events.py:363) — AX observer refs accumulate at ~10–17 MB/min physical footprint

## Summary

`macos-mcp` exhibits a steady, linear physical footprint leak when AX-tree-reading tools are exercised in long-running sessions. Growth rate is roughly **10–17 MB/min** of activity, and the process never releases memory after the calling client stops invoking tools. On a 32 GB host left running over a couple of days, the process climbed to ~16.5 GB physical footprint and contributed to a system-level OOM. With an external watchdog reaping the process at 400 MB, we observe repeated re

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/7) · 2026-05-27 · closed · external user · 1 comment

### AX polling stalls focused Chrome on every navigation — 1-2s system-wide freeze

## Summary

The macos-mcp server holds an `AXObserver` registration on the focused
window via `AXObserverAddNotification`. When that focused window is
**Google Chrome** and the user navigates to a new page (or switches
tabs), Chrome rebuilds its accessibility tree, fires AX notifications,
and the MCP synchronously walks the new tree. Walking Chrome's AX tree
takes ~1-2 seconds and during that time the entire UI freezes
(WindowServer waits for AX RPCs).

This is reproducible on every page load, e

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/5) · 2026-05-05 · closed · external user · 1 comment

### macos-mcp instances at launch bug

# Bug Report: Claude Desktop spawns duplicate macos-mcp instances at launch, causing severe memory pressure

## Summary

Claude Desktop launches 4 simultaneous instances of the `macos-mcp` extension on startup, despite only one extension registration existing in any user-editable config. The duplication consumes ~17 GB of memory and saturates CPU, making mid-tier Macs (24 GB RAM) unusable until manually killed.

## Severity

**High.** On a 24 GB MacBook Pro M4, the 4× MCP duplication consumes 70

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/4) · 2026-05-04 · closed · external user · 0 comments

### Anthropic MCP Directory Review — MacOS MCP

Hi from Anthropic 👋

We reviewed MacOS MCP for inclusion in the Anthropic MCP Directory. We found several items that need to be addressed before we can list the server.

## Required

1. **Process execution pattern** — We observed that the `ExecuteCommand` tool runs user-supplied input via `subprocess.run(..., shell=True)` in shell mode, which allows arbitrary command execution through shell metacharacters. Please either drop `shell=True` and pass arguments as a list, implement an allowlist of pe

[Read the thread](https://github.com/CursorTouch/MacOS-MCP/issues/3) · 2026-04-20 · closed · external user · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/Jeomon/macos-mcp/issues).