mac_messages_mcp

The application requires 'Full Disk Access' permission on macOS for the terminal or AI application, which grants high privileges and should be granted with caution. It interacts with macOS system services (AppleScript) and SQLite databases. While efforts are made to sanitize user inputs for AppleScript commands using string replacement to prevent injection, and parameterized queries are used for SQLite, direct interaction with shell commands (`subprocess.run(cmd, shell=True)`) in `get_addressbook_contacts_subprocess` is generally discouraged even if the command string is static. If exposed via `mcp-proxy` for Docker, binding to `0.0.0.0` is a network security risk if not properly restricted or authenticated in production.