macos-automator-mcp

The server's core functionality involves executing arbitrary AppleScript/JXA code, either directly provided by the client or sourced from its knowledge base, via `osascript`. This grants high privileges to the executing AI, including the ability to run shell commands (`do shell script`) and interact with the file system and other applications. While placeholder substitution includes escaping, it cannot mitigate malicious logic within the scripts themselves. Network requests can be made from JXA scripts via the Objective-C bridge, potentially exposing data or fetching malicious content. The README explicitly highlights the critical need for user-granted macOS Automation and Accessibility permissions, indicating a high-trust environment is required. If the AI agent itself is compromised or unconstrained, it could pose significant risks.