Mac MCP 2.2.1

Mac MCP 2.2.1 brings everything since 2.2.0: agents that work together, more of your Mac within reach, and automation you can leave running. It is the signed stable checkpoint stable-2.2.1-r3 (commit 8d6454d).

Website: https://bulutarkan.github.io/mac-mcp/

Install

• Package (Apple Silicon, macOS 14+): download Mac-MCP-2.2.1-stable-2.2.1-r3-arm64.pkg below and open it.
• Terminal: curl -fsSL https://raw.githubusercontent.com/bulutarkan/mac-mcp/main/install.sh | bash
• npm (macOS 13+, Apple Silicon or Intel): npx @bulutarkan/mac-mcp install

Already installed? Run mac-mcp update or use Updates in the menu bar app; package installs update by opening this package. Your settings, keys and the permissions you granted are kept.

Agents that work at the same time can talk to each other

The agents of a team, the session that started it (the lead) and Mac MCP sessions in a named room can message each other with the new team_messages tool.

• Messages reach an agent on their own after its next step, even when it only uses its own CLI's tools and never calls Mac MCP. This works in all ten supported agents: Claude Code, Codex, OpenCode, Kilo Code, Grok Build, Cline, Antigravity, pi and Goose through their own hooks, plugins or extensions, and Kimi Code by checking its inbox. Nothing is interrupted, and each message is shown once.
• Every Mac MCP session knows the tool, so a lead can pass on a change of plan to running agents instead of restarting them. A message from the lead updates the agent's task; messages from other agents are information, never instructions.
• Agents write only when a teammate's work would otherwise go wrong or to answer a question, at most 10 messages each; the sender is told when nobody will see a message.
• Each agent gets a messaging-only token and private copies of its CLI settings; your own ~/.codex and other CLI settings are never changed.
• On by default; Settings › Subagents › Messages Between Agents turns it off.

Agents can work on a desktop of their own

When you ask, an agent takes a desktop of its own in Mission Control and uses your real apps and accounts there, while nothing appears on the desktops you are looking at and your focus stays put. Safari and apps you are using open there too. Your windows are never moved or closed, and agents still work alongside you by default.

More of your Mac and your services

• Messages: read a chat and search across chats, read-only, without opening Messages, through a small helper you give Full Disk Access (Settings › Apps › Reading Messages).
• Connect a Service: GitHub, Notion, Slack and Google Drive in a few clicks from Settings › MCP Servers, with keys in your login Keychain. Your own MCP servers (by URL or command) are offered to every AI app and agent under the same rules.
• Ask about your documents: pick folders and ask about what is in them, with file and page; scanned PDFs and images are read on your Mac with on-device OCR. The index repairs itself if it is damaged.
• Your Mac's own apps: reminders, notes, free time, contacts and Shortcuts, plus a "Run Mac MCP Recipe" action for Shortcuts and Siri.
• Memory that learns on its own: agents remember lasting preferences and facts without being asked; the server refuses secrets.
• Agent Skills installed for your CLI agents are found and indexed by themselves.

Automation you can leave running

• Scheduled Tasks run AI tasks, scripts and recipes on a schedule or when a file arrives, with an optional usage limit, checks that a run made what it should (files, a web page or one of your read-only MCP tools), and catch-up after sleep.
• A run that went wrong says so: runs that never started are noticed, a stopped run keeps what it did, and the report offers Resume, Check Again and Diagnose.
• Approved scripts stay as approved: a script that changes after you approved it waits for your review. Data handed to the agent has its secrets masked.

Settings and everyday use

• Settings has a grouped sidebar that scrolls to what a link opens, Permissions & Safety in plain words, what agents can do in each app, Team History for past agent teams, and a Usage pane that leads with an overview.
• Every install tells you when an update is ready: install.sh, npm and package installs alike.
• The menu tells your conversations from the agents you hand work to. Interrupted installs and updates put themselves right.
• Less needless work on frequent paths: file listing, folder watching, the dashboard and the Live Island do far less, and cut results say so and can be continued.
• Also since 2.2.0 r1: the agent cursor on the desktop, session details in the menu, seven more AI apps and agents (Antigravity, pi, Cline, Kilo Code, Goose, Kimi Code, Grok Build), whole browser pages in one call, a CLI with a look of its own and the new Mac MCP mark.

Fixes

• An agent's typed summary, which wait_agents shows the lead, now carries the agent's answer in the language it answered in.
• Two agents starting at the same moment on a fresh install no longer make one of them fail with "database is locked".
• On Python 3.10 and 3.11, your own MCP servers and services connect (Connect a Service, the Test button, mac-mcp mcp test) instead of failing with "Attempted to exit cancel scope in a different task"; on 3.10, a connection error is reported instead of a NameError.
• On Python 3.10 to 3.12, find_files with a folder in its pattern (**/*.md, docs/*) works.
• An external MCP tool with a description or idempotency_key parameter no longer breaks the tool list.

The full list is in the CHANGELOG.

About the package

The .pkg is not signed with an Apple Developer ID and not notarized. The first time you open it, macOS blocks it: open System Settings › Privacy & Security and choose Open Anyway. It is for Apple Silicon Macs with macOS 14 or later. Its contents are the signed stable checkpoint named above (see release.json inside), and its SHA-256 is in the .sha256 file next to it:

73d08bfa3b0a94642b51f4522c1077e360beba3d84df501a6843b7251ebcf811  Mac-MCP-2.2.1-stable-2.2.1-r3-arm64.pkg

Mac MCP 2.2.1 r2

Superseded by Mac MCP 2.2.1 r3, which also fixes connecting your own MCP servers on Python 3.10 and 3.11 and find_files folder patterns on Python 3.10 to 3.12. Use r3; existing installs get it with mac-mcp update.

Mac MCP 2.2.1 brings everything since 2.2.0: agents that work together, more of your Mac within reach, and automation you can leave running. It is the signed stable checkpoint stable-2.2.1-r2 (commit 61c5e93).

Website: https://bulutarkan.github.io/mac-mcp/

Install

• Package (Apple Silicon, macOS 14+): download Mac-MCP-2.2.1-stable-2.2.1-r2-arm64.pkg below and open it.
• Terminal: curl -fsSL https://raw.githubusercontent.com/bulutarkan/mac-mcp/main/install.sh | bash
• npm (macOS 13+, Apple Silicon or Intel): npx @bulutarkan/mac-mcp install

Already installed? Run mac-mcp update or use Updates in the menu bar app; package installs update by opening this package. Your settings, keys and the permissions you granted are kept.

Agents that work at the same time can talk to each other

The agents of a team, the session that started it (the lead) and Mac MCP sessions in a named room can message each other with the new team_messages tool.

• Messages reach an agent on their own after its next step, even when it only uses its own CLI's tools and never calls Mac MCP. This works in all ten supported agents: Claude Code, Codex, OpenCode, Kilo Code, Grok Build, Cline, Antigravity, pi and Goose through their own hooks, plugins or extensions, and Kimi Code by checking its inbox. Nothing is interrupted, and each message is shown once.
• Every Mac MCP session knows the tool, so a lead can pass on a change of plan to running agents instead of restarting them. A message from the lead updates the agent's task; messages from other agents are information, never instructions.
• Agents write only when a teammate's work would otherwise go wrong or to answer a question, at most 10 messages each; the sender is told when nobody will see a message.
• Each agent gets a messaging-only token and private copies of its CLI settings; your own ~/.codex and other CLI settings are never changed.
• On by default; Settings › Subagents › Messages Between Agents turns it off.

Agents can work on a desktop of their own

When you ask, an agent takes a desktop of its own in Mission Control and uses your real apps and accounts there, while nothing appears on the desktops you are looking at and your focus stays put. Safari and apps you are using open there too. Your windows are never moved or closed, and agents still work alongside you by default.

More of your Mac and your services

• Messages: read a chat and search across chats, read-only, without opening Messages, through a small helper you give Full Disk Access (Settings › Apps › Reading Messages).
• Connect a Service: GitHub, Notion, Slack and Google Drive in a few clicks from Settings › MCP Servers, with keys in your login Keychain. Your own MCP servers (by URL or command) are offered to every AI app and agent under the same rules.
• Ask about your documents: pick folders and ask about what is in them, with file and page; scanned PDFs and images are read on your Mac with on-device OCR. The index repairs itself if it is damaged.
• Your Mac's own apps: reminders, notes, free time, contacts and Shortcuts, plus a "Run Mac MCP Recipe" action for Shortcuts and Siri.
• Memory that learns on its own: agents remember lasting preferences and facts without being asked; the server refuses secrets.
• Agent Skills installed for your CLI agents are found and indexed by themselves.

Automation you can leave running

• Scheduled Tasks run AI tasks, scripts and recipes on a schedule or when a file arrives, with an optional usage limit, checks that a run made what it should (files, a web page or one of your read-only MCP tools), and catch-up after sleep.
• A run that went wrong says so: runs that never started are noticed, a stopped run keeps what it did, and the report offers Resume, Check Again and Diagnose.
• Approved scripts stay as approved: a script that changes after you approved it waits for your review. Data handed to the agent has its secrets masked.

Settings and everyday use

• Settings has a grouped sidebar that scrolls to what a link opens, Permissions & Safety in plain words, what agents can do in each app, Team History for past agent teams, and a Usage pane that leads with an overview.
• Every install tells you when an update is ready: install.sh, npm and package installs alike.
• The menu tells your conversations from the agents you hand work to. Interrupted installs and updates put themselves right.
• Less needless work on frequent paths: file listing, folder watching, the dashboard and the Live Island do far less, and cut results say so and can be continued.
• Also since 2.2.0 r1: the agent cursor on the desktop, session details in the menu, seven more AI apps and agents (Antigravity, pi, Cline, Kilo Code, Goose, Kimi Code, Grok Build), whole browser pages in one call, a CLI with a look of its own and the new Mac MCP mark.

Fixes

• An agent's typed summary, which wait_agents shows the lead, now carries the agent's answer in the language it answered in.
• Two agents starting at the same moment on a fresh install no longer make one of them fail with "database is locked".
• On Python 3.10, an error from a connected MCP server is reported instead of stopping with a NameError.
• An external MCP tool with a description or idempotency_key parameter no longer breaks the tool list.

The full list is in the CHANGELOG.

About the package

The .pkg is not signed with an Apple Developer ID and not notarized. The first time you open it, macOS blocks it: open System Settings › Privacy & Security and choose Open Anyway. It is for Apple Silicon Macs with macOS 14 or later. Its contents are the signed stable checkpoint named above (see release.json inside), and its SHA-256 is in the .sha256 file next to it:

3b4b29fadb90eca82dcd8e78780e9aafa4214b0f85ec15c079c5904e6255e635  Mac-MCP-2.2.1-stable-2.2.1-r2-arm64.pkg

Mac MCP 2.2.0 r2

Mac MCP 2.2.0 r2 is a signed stable checkpoint on the 2.2.0 line (stable-2.2.0-r2, commit 1ff9a19). The version stays 2.2.0. Existing installs get it with mac-mcp update or the Updates section of the menu bar app; package installs get it by installing this package. Permissions you already granted to Mac MCP carry over: the Mac MCP Server helper that holds them is unchanged.

Website: https://bulutarkan.github.io/mac-mcp/

New: the agent cursor on the desktop

When an agent clicks, types, scrolls or presses a control in another app's window in the background, a cursor glides there and shows the step (for example "Clicking Button"). Your own pointer does not move.

• It sits with the window being driven, not above everything: a window you have in front covers it.
• It ignores the mouse, never takes focus and never appears in screenshots, so agents do not see it in their own captures. It carries only a verb and a control kind, never titles or typed text.
• On by default; turn it off in Settings › Activity & Notifications › Agent cursor on the desktop.

New: session details in the menu

Each session under Sessions shows how long it has been open and how many tool calls it made, plus a queued or undelivered prompt. Click it for a small panel with its status, start time, call count, the calls running now and the current or last tool.

Seven more AI apps and agents

Antigravity, pi, Cline, Kilo Code, Goose, Kimi Code and Grok Build can be connected as AI apps (in the tour, in Settings › Connections and with mac-mcp connect --client …) and turned on as delegated agents in Settings › Subagents. They are off until you turn them on. Each agent runs with only the scoped Mac MCP server, and its tool calls, token usage and failures show in run reports, the menu and the island.

Browser

• Whole pages in one call: the new read action returns a page's full text, after scrolling so content that loads on scroll is there. A review page that took an agent 35 calls now reads in about 6 seconds.
• Extraction you can trust: one field shape for extraction; a missing field, a broken selector or a broken regex is an error instead of the whole page. Scripts, styles and hidden content are left out, and results say how many matched and where they were cut. scan reads and scrolls several times in one call and can be continued.

The CLI has a look of its own

In a terminal, mac-mcp, status, start, stop, restart, doctor and the other commands open with the same header, line up their facts and end with one sentence, plus the command to run next when something is wrong. Scripts, the menu app and the installer get exactly the output they got before. A Cloudflare token or a login password typed into the terminal is no longer echoed.

A new Mac MCP mark

One thin line draws an M, and the browser companion's pointer carries on its right leg. It is the new app icon (with hand-tuned small sizes), the menu bar icon (dimmed while the server is stopped, with a dot while work runs), and the mark in the menu, the island, the tour, the site, the demo video, the mobile page and the dashboard. The Mac MCP Server helper keeps its old icon on purpose, so your permissions are not asked for again.

Fixes

• Turning the agent cursor back on, or the Live Island off, now lasts; before, it held only until Settings reopened or the app relaunched.
• Opening Settings no longer closes the Live Island.
• The island no longer shows a finished agent as still working.
• Native scrolls work on SwiftUI and background windows; saved logins stay on their own site.

The full list is in the CHANGELOG.

Install with the package (Apple Silicon)

Mac-MCP-2.2.0-stable-2.2.0-r2-arm64.pkg installs Mac MCP for your account only. It needs no administrator password and no Terminal, Xcode tools, Git, Homebrew or Python. Installing it over an older package keeps your settings, API key and tokens.

This package is not signed with an Apple Developer ID and is not notarized. macOS blocks the first open: go to System Settings → Privacy & Security and choose Open Anyway. The code inside is exactly this signed checkpoint: release.json in the package names stable-2.2.0-r2 and its commit. To check the download, compare it with the .sha256 file:

shasum -a 256 -c Mac-MCP-2.2.0-stable-2.2.0-r2-arm64.pkg.sha256

Requirements: Apple Silicon Mac, macOS 14 or newer. Intel Macs and macOS 13 use install.sh.

Mac MCP 2.2.0 r1

Mac MCP 2.2.0 is the first signed stable checkpoint of 2.2.0 (stable-2.2.0-r1, commit 05b6e68). Existing installs get it with mac-mcp update or the Updates section of the menu bar app; package installs get it by installing this package. Permissions you already granted to Mac MCP carry over.

Website: https://bulutarkan.github.io/mac-mcp/

New: Scheduled Tasks (experimental)

Let your AI work on a schedule. Settings › Scheduled Tasks runs AI tasks (a prompt for a Codex, Claude Code or OpenCode agent) and script tasks (a file or command) once, daily, weekly, monthly, every few hours or on a cron expression, in local time.

• Cards show the last result and an Up next strip; each task has Run now, Pause and Edit, and the New Task sheet says in one sentence when the task will run.
• Every run has a report: the result as formatted text, and the agent's steps (its thinking, tool calls and commands) with token usage and cost where the provider reports them. A failed run says why, in the provider's own words.
• Runs missed while the Mac slept or Mac MCP was stopped are recorded as Skipped with the reason instead of running late.
• AI apps can suggest tasks with the scheduled_tasks tool. Nothing they suggest runs until you approve it in Settings.

New: the live activity island

An optional island beside the notch shows what your AI is doing. It is off by default: turn it on in Settings › Activity & Notifications › Live activity (Off, Bubble or Notch island).

• At rest it shows the Mac MCP mark. While a tool runs, the app it uses turns in one slot and a tick follows; only things that need you slide a row down.
• Hover it for Needs you, Now, Recent and Scheduled, also when nothing is running. Long titles scroll while hovered.

Security fix

The guard against sending secrets out now also looks inside encoded payloads: base64/base64url, hex and percent-encoding, two layers deep, including tokens inside JSON. Before, a secret read on this Mac could be sent without approval by encoding it first. Encryption, or splitting a secret across requests, is not detected.

Also in 2.2.0

• A product page with a 40-second demo, and a README that starts with what Mac MCP does.
• Codex agents start again when your Codex config has the keyless mac-mcp entry, and work on Python 3.10.
• Settings panes share one header and margin.

Install with the package (Apple Silicon)

Mac-MCP-2.2.0-stable-2.2.0-r1-arm64.pkg installs Mac MCP for your account only. It needs no administrator password and no Terminal, Xcode tools, Git, Homebrew or Python. Installing it over an older package keeps your settings, API key and tokens.

This package is not signed with an Apple Developer ID and is not notarized. macOS blocks the first open: go to System Settings → Privacy & Security and choose Open Anyway. The code inside is exactly this signed checkpoint: release.json in the package names stable-2.2.0-r1 and its commit. To check the download, compare it with the .sha256 file:

shasum -a 256 -c Mac-MCP-2.2.0-stable-2.2.0-r1-arm64.pkg.sha256

Requirements: Apple Silicon Mac, macOS 14 or newer. Intel Macs and macOS 13 use install.sh.

Mac MCP 2.1.9 r10

Mac MCP 2.1.9 r10 is a signed stable checkpoint (stable-2.1.9-r10, commit 78bc0c1). Existing installs get it with mac-mcp update or the Updates section of the menu bar app; package installs get it by installing this package. Permissions you already granted to Mac MCP carry over.

New: Settings › Privacy

One place for what Mac MCP may look at, what it keeps and where your data can go. Mac MCP enforces every rule itself, so an AI app cannot turn them off.

• Pause observation: Mac MCP stops reading the screen, web pages, the clipboard and your voice, and starts no agents, until you turn it off. File and command tools keep working.
• Private mode: work continues, but nothing about it is kept: no activity history, usage, memories, lessons or run timelines.
• Both are also in the menu bar (More → Pause Observation / Private Mode), and the menu shows Paused or Private.
• Never observe these apps / sites: no screenshot, window read, page read or action in them. A whole-screen screenshot is refused while an excluded app is on screen. Tab lists show excluded sites without title or address.
• Also never observe: optionally treat password managers, banking and finance sites, or health portals as excluded. They are recognized automatically, which can miss some, so add the ones that matter to your lists too.
• What Mac MCP keeps: every local store with what it holds, how long it is kept, its size and whether only your account can read it. Move one store or all Mac MCP data to the Trash (Mac MCP restarts around it; nothing is erased until you empty the Trash). FileVault status is shown, and you can keep Mac MCP data out of Time Machine backups.
• Where your data can go: connected AI apps, the public tunnel, agent providers, voice transcription and decision acceleration, each marked on or off.
• From the terminal: mac-mcp privacy delete (preview first) and mac-mcp status show the same.

Browser actions say what actually happened

Each browser_act action now reports an outcome: confirmed when its result was checked, page_reacted when the page changed but nothing checked the intended result (a menu closing is not a link copied), and unconfirmed, failed or blocked. Add expect ({text: 'Pending review'}, {gone: 'Choose an image'}, a selector or a URL change) to check a result; an unmet expect stops the batch and is never retried automatically, so nothing is submitted twice. Editors that rewrite punctuation (smart quotes, dashes) no longer report input_not_applied. The tool now says up front that typing replaces the whole field, and requests to edit only part of a field are refused.

Also in this checkpoint

• One-click connect in Settings › Connections › AI Clients, as in the tour. Apps added earlier by hand, with Mac MCP's key in their settings, show Update to move to the keyless setup.
• Start at login: the menu bar app opens at login and shows Starting… until the server is ready, instead of nothing for a minute.
• Restarts and updates finish even while an AI app keeps a connection open.

Install with the package (Apple Silicon)

Mac-MCP-2.1.9-stable-2.1.9-r10-arm64.pkg installs Mac MCP for your account only. It needs no administrator password and no Terminal, Xcode tools, Git, Homebrew or Python. Installing it over an older package keeps your settings, API key and tokens.

This package is not signed with an Apple Developer ID and is not notarized. macOS blocks the first open: go to System Settings → Privacy & Security and choose Open Anyway. The code inside is exactly this signed checkpoint: release.json in the package names stable-2.1.9-r10 and its commit. To check the download, compare it with the .sha256 file:

shasum -a 256 -c Mac-MCP-2.1.9-stable-2.1.9-r10-arm64.pkg.sha256

Requirements: Apple Silicon Mac, macOS 14 or newer. Intel Macs and macOS 13 use install.sh.

Mac MCP 2.1.9 r9

Mac MCP 2.1.9 r9 is a signed stable checkpoint (stable-2.1.9-r9, commit 21c8c74). Existing installs get it with mac-mcp update or the Updates section of the menu bar app. Package installs get it by installing this package.

New: a first-run tour

After install, a short tour opens: four animated slides about what Mac MCP does, then live setup steps.

• Start: Mac MCP is already running when the tour opens; the package starts it, and the menu bar app appears before the tour.
• Permissions: press Allow and macOS shows its own prompt naming Mac MCP. Turn it on and the tour takes care of the rest; the server restarts by itself so the permission applies right away.
• Connect your AI app: the tour lists the AI apps on this Mac (Claude Desktop, Claude Code, Codex, OpenCode, ChatGPT), each with one button. Mac MCP adds itself to the app; there is no command to paste and no key to copy. For ChatGPT, the connector address is copied to the clipboard.
• First request: a read-only request to try in your AI app; the tour shows when it arrives.

Reopen the tour any time from the menu bar app (More → Take the Tour…) or Settings → Get Started.

Permissions now belong to Mac MCP

macOS used to list Mac MCP's permissions under "Python". The server now runs under a small Mac MCP Server helper, so Accessibility and Screen Recording are granted to Mac MCP.

After updating, allow Accessibility and Screen Recording once more, this time for Mac MCP (open the tour from the menu, or Settings → Permissions). The old "Python" entries can be removed from System Settings.

One-click connect from the command line

mac-mcp clients                          # AI apps on this Mac and which already have Mac MCP
mac-mcp connect --client claude-desktop  # or claude-code, codex, opencode
mac-mcp connect --client chatgpt         # copies the connector address to the clipboard

Apps are set up with mac-mcp stdio, a small bridge to the running server. No address or API key is written into any app's config. The bridge survives server restarts, waits briefly for a server that is starting, and never resends a request that was cut off.

Also in this checkpoint

• Start at login: Mac MCP starts again after a reboot when it was left running.
• mac-mcp repair and mac-mcp uninstall: both preview their changes first.
• Get Started checklist in Settings, from install to a first request that works.
• Updates keep permissions working: the updater starts the server again under Mac MCP Server, and server shutdown is limited to 5 seconds so open connections cannot stall a restart or update.
• system_info reports the macOS version.

r7 and r8 were intermediate checkpoints on the way to this one and were not published as packages.

Install with the package (Apple Silicon)

Mac-MCP-2.1.9-stable-2.1.9-r9-arm64.pkg installs Mac MCP for your account only. It needs no administrator password and no Terminal, Xcode tools, Git, Homebrew or Python. Installing it over an older package keeps your settings, API key and tokens.

This package is not signed with an Apple Developer ID and is not notarized. macOS blocks the first open: go to System Settings → Privacy & Security and choose Open Anyway. The code inside is exactly this signed checkpoint: release.json in the package names stable-2.1.9-r9 and its commit. To check the download, compare it with the .sha256 file:

shasum -a 256 -c Mac-MCP-2.1.9-stable-2.1.9-r9-arm64.pkg.sha256

Requirements: Apple Silicon Mac, macOS 14 or newer. Intel Macs and macOS 13 use install.sh.

Mac MCP 2.1.9 r6

Mac MCP 2.1.9 r6 is a signed stable checkpoint (stable-2.1.9-r6, commit 835cb05). Existing installs get it with mac-mcp update or the Updates section of the menu bar app.

New: install with a package (Apple Silicon)

Mac-MCP-2.1.9-stable-2.1.9-r6-arm64.pkg installs Mac MCP without Terminal, Xcode tools, Git, Homebrew or Python:

• installs the menu bar app and the MCP server for your account only, with no administrator password
• ships its own Python 3.14 and every dependency, verified against the project's hash-locked requirements (about 90 MB)
• starts the server and the app when it finishes; local-only access, with public endpoints and subagent providers off until you turn them on
• installing a newer package over an older one keeps your settings, API key and tokens; a failed install or upgrade puts the previous version back
• refuses to touch an existing install.sh/source installation; keep updating that one with mac-mcp update

This package is not signed with an Apple Developer ID and is not notarized. macOS blocks the first open: go to System Settings → Privacy & Security and choose Open Anyway. The code inside is exactly this signed checkpoint (release.json in the package names stable-2.1.9-r6 and its commit). To check the download, compare it with the .sha256 file:

shasum -a 256 -c Mac-MCP-2.1.9-stable-2.1.9-r6-arm64.pkg.sha256

Requirements: Apple Silicon Mac, macOS 14 or newer. Intel Macs and macOS 13 use install.sh.

Also in this checkpoint

• Run evidence timeline (#108): every computer_plan and recipe run gets a run ID and a sanitized timeline in the dashboard; optional before/after screenshots, never kept while a password or one-time-code field is on screen.
• Signed skill and recipe catalog (#146): browse, review and install signed catalog packs from the dashboard or mac-mcp catalog.
• Browser visual companion: a graphite arrow cursor with a short action label, smoother movement, and range sliders that drag without the Chrome debugger.
• Package-aware updates: on a package install, mac-mcp update, the update tool, doctor and the menu app point to the newest package instead of the Git updater.
• Installer fix: install.sh now works when run from inside a Mac MCP checkout.

Mac MCP v2.1.9

Mac MCP 2.1.9 brings Mac MCP into ChatGPT itself with a native plugin panel, and makes everyday browser work, approvals, updates and restarts more dependable.

Highlights

• Mac MCP panel inside ChatGPT: open Mac MCP from the ChatGPT sidebar in full screen or as a side panel in any chat. A compact black-and-white panel shows tool activity, delegated agents and 7-day token usage, and refreshes only when you ask.
• Default agent from ChatGPT: choose the provider, model and reasoning ChatGPT delegates to. Models come from your own provider accounts and every choice is validated by the server.
• ChatGPT-only and permission-bound: other MCP clients never see the panel; every action passes the normal permission profiles and approvals, and no keys or tokens are sent to it.
• Agent visibility: optional activity bubbles and agent completion notifications on the Mac.
• Optional Server Approval (Off / Critical / High Risk) with Allow Once / Block confirmation for risky actions.
• Smoother browser work: whole forms in one step without stealing focus, stable Safari tab tracking across site changes and tab shuffling, better click verification, page images on Google Sheets–style pages, and better picks between look-alike targets (plus an optional Decision Acceleration layer).
• Setup and history: mac-mcp connect-config, a safe transaction history dashboard, and read-only memory/Agent Skills REST APIs.
• Dependable updates and restarts: CLI updates survive their own restart, mac-mcp restart no longer leaves the server stopped, background jobs track surviving children, and update operations keep your own Git identity.

See CHANGELOG.md for the full list.

Stable channel: stable-2.1.9-r1.

Mac MCP v2.1.8

Mac MCP 2.1.8 makes long-running Computer Use lighter, safer in the background, and easier to inspect.

Highlights

• Unified low-context perception pipeline with semantic-first observation, conditional reuse, targeted visuals, and OCR-last fallback.
• Background native window capture, zero-focus semantic input, and human/agent workspace arbitration.
• Usage visibility now separates MCP payload metering from provider-reported Codex/OpenCode delegated-agent token usage.
• Codex read_only and scoped workspace_write are restored behind a Mac MCP-enforced macOS Seatbelt boundary.
• Operations dashboard scrolling/card clipping fixes and a responsive Usage heatmap that no longer pushes the Settings window sideways.

Stable channel: stable-2.1.8-r1.

Mac MCP v2.1.7

Mac MCP 2.1.7 focuses on safer long-running operation, durable update recovery, and a cleaner paired mobile experience.

Highlights

• Secure paired /mobile dashboard with persistent devices, manual pairing, lifecycle-aware Sessions, and compact tool-aware icons.
• Idle delegated Agents collapse by default on mobile while remaining available with a smooth disclosure control.
• Durable updater progress and recovery state across prepare, backup, update, sync, dependencies, restart, health, rollback, and recovery.
• Stronger restart/process identity checks, foreign-listener/PID-reuse protection, transactional dependency activation, and post-update product-health gating.
• Event-driven/delta-aware Computer Use improvements, stricter browser effect verification, safer trusted Chrome pointer dispatch, and foreground-capability hardening.
• Typed delegated-agent result envelopes, safer fan-in, whole-run filesystem undo, and unified tool discovery/invocation semantics.

Verification

• Signed stable checkpoint: stable-2.1.7-r1
• Release commit: a004217aed48
• Full local Python suite: 1006/1006 passed
• Native app temp build: 2.1.7 (218) with deep codesign verification passed
• Quality Gates, Verified Release Channel, Native App Build, Dependency Audit, and Security Regression all passed in CI