{ "markdown": "# Unofficial Apple Music MCP\n\n\n\n**Let Claude play your music. Download, drag, double-click. That's the install.**\n\n

\n \"Claude\n

\n\n

\n One request. A real playlist, playing, with the explicit versions left out.\n

\n\n

\n \n ⬇ Download for Apple Silicon\n \n  · \n \n ⬇ Download for Intel\n \n
\n \n Not sure which? Apple menu → About This Mac. \"Apple M1/M2/M3…\" is Apple Silicon.\n \n
\n \n notarized by Apple · no terminal · no developer account ·\n all downloads & checksums\n \n

\n\n---\n\n## Ask for music in plain English\n\n*\"Build my kid a Hogwarts birthday playlist. Soundtracks only, nothing scary.\"*\n\n*\"I've worn out The Heist. What should I try next?\"*\n\n*\"More like that Eric Ericson choir record, but skip the Christmas half.\"*\n\nClaude does the work in the Music app you already have. The playlist it builds\nis a real playlist. It syncs to your phone.\n\n| | |\n|---|---|\n| **Playlists** | Make them, add to them, reorder, rename, sort into folders, delete |\n| **Your library** | Search it, browse it, rate songs, mark favorites, see what you played |\n| **Playback** | Play, pause, skip, seek, shuffle, repeat, volume, AirPlay |\n| **The full catalog** | Search all of Apple Music, play it, add it to your library |\n\nPlaying or adding music you don't already own needs an Apple Music\nsubscription. That's Apple's rule, not this server's. Everything else works\nwithout one.\n\n## Install\n\n

\n \"The\n

\n\n**You need** macOS 12 or later and the Music app signed in to your Apple\naccount. Playing or adding catalog music needs macOS 14 or later.\n\n1. [**Download the app**](https://github.com/jaminben/secure-applemusic-mcp-for-osx/releases/latest/download/UnofficialAppleMusicMCP-macos-arm64.zip)\n for Apple Silicon, or the [Intel build](https://github.com/jaminben/secure-applemusic-mcp-for-osx/releases/latest/download/UnofficialAppleMusicMCP-macos-x86_64.zip).\n2. Unzip it. Drag **UnofficialAppleMusicMCP.app** to your Applications folder.\n3. Double-click it once.\n\nThat's the whole install. No Python, no Homebrew, no Terminal. The app brings\neverything it needs with it.\n\nApple notarized these builds, so the app just opens. No \"unidentified\ndeveloper\" warning, no right-click trick, no trip to System Settings.\n\n> **Drag it to Applications first.** If you open it from your Downloads folder,\n> macOS runs it from a temporary copy that vanishes when you quit, and the\n> background helper ends up pointing at a file that no longer exists.\n\nThe setup window then asks you three questions. You can skip any of them.\n\n| It asks | What happens | Why |\n|---|---|---|\n| Install the background helper? | Adds a small program that starts when you log in | This is what lets the permission belong to the app instead of to your terminal |\n| Set up your AI apps? | Adds one entry to Claude Desktop, Claude Code, Cursor, Windsurf, Codex or VS Code | So they can find it. Your other tools stay put, and it backs up every file first |\n| Allow access to Music? | Shows the standard macOS permission box | Approving it here means the permission lands on this app |\n\nRestart the AI apps you picked, and you're done.\n\n> **Building it yourself?** Sign it. See [From source](#from-source). macOS ties\n> the Music permission to a signature. An unsigned app looks like a brand new\n> app on every rebuild, so it will ask for permission again each time.\n\n## Why it asks for so little\n\nSoftware can reach whatever you let it reach. That matters more than usual\nhere, because this software takes its orders from an AI.\n\nThe most capable Apple Music server I found needs a macOS permission called\n**Accessibility**. The name misleads. It has nothing to do with screen readers\nor assistive technology. It lets one app drive another: type keystrokes, click\nbuttons, read what's on your screen.\n\nmacOS will not limit it to one app. You grant it for everything or not at all.\n\nSo a music server holding that permission can also type into your email. And it\ntakes its instructions from a model reading text nobody has vetted: track\nnames, playlist titles, whatever it just searched. A booby-trapped playlist\ntitle becomes a keystroke.\n\nThis fork deleted that code. It asks for three things instead:\n\n| It gets | It does not get |\n|---|---|\n| **Control of the Music app**, and nothing else. Revoke it in System Settings any time | The Accessibility permission. There is no code left that could use it |\n| **A connection to Apple Music**, so it can add songs to your library | Any browser, your cookies, your tabs |\n| **One background program**, started when you log in | Your terminal's permissions, or anything else on your Mac |\n\nThat's the whole list, and\n[a test suite](tests/test_capability_invariants.py) fails the build if any of it\ncreeps back.\n\nIt still plays the entire Apple Music catalog. Most servers pay for that with\nthe permission above. This one goes through Apple's own MusicKit, signed with\nthe app's identity: one approval box, no developer account, and no password or\nkey stored anywhere on your Mac.\n\n> **\"Secure\" is the goal, not a certificate.** Nobody independent has audited\n> this. The claims worth trusting are the ones a test can check, and those are\n> listed below.\n\n### Why an app instead of a command\n\nmacOS blames the parent. When your AI app launches a helper program, the\npermission lands on the AI app, not the helper. The usual setup therefore hands\n\"control Music\" to your entire terminal, and to everything you ever run from it.\n\nThis app splits in two instead:\n\n```\nClaude Desktop ──stdio──▶ shim ──unix socket (0600)──▶ helper ──▶ Music.app\n no permissions owns the grant\n```\n\nThe shim talks to Claude and cannot touch Music. The helper owns the permission\nand is started by macOS itself. You get one row in System Settings you can\nswitch off, and your terminal gets nothing.\n[docs/PERMISSIONS.md](docs/PERMISSIONS.md) has the details.\n\n## What it will never do\n\n| | |\n|---|---|\n| **No Accessibility** | No fake keystrokes, no fake clicks, no reading other apps' windows |\n| **No browser** | No Playwright, no Chrome driven from inside the app |\n| **No reading your browser** | Never touches Safari cookies or runs JavaScript in your tabs |\n| **No opening links** | It reads Apple Music links, it never hands them to a browser |\n| **No shell** | It runs exactly one program: `osascript`, with a timeout |\n| **No stored passwords** | There is nothing in `~/.config` worth stealing |\n| **No private APIs** | Only `api.music.apple.com` and Apple's public search API |\n\nEvery row is a test in [`tests/test_capability_invariants.py`](tests/test_capability_invariants.py),\nrunning as its own CI job. Deleting a subsystem is a one-time event. Keeping it\ndeleted is a property.\n\n## For developers\n\nA hardened fork of [epheterson/applemusic-mcp](https://github.com/epheterson/applemusic-mcp).\nUpstream does more and always will: Windows and Linux, the Chrome and Safari web\nplayers, and the Up Next queue, which lived inside the web player and could not\nsurvive its removal. This fork trades those for a smaller blast radius and an\ninstaller your relatives can use.\n\n### With pip, pipx or uvx\n\nThe wheel carries the same signed MusicKit helper the app does, so this is a\nfull install, not a reduced one.\n\n```bash\npipx install secure-applemusic-mcp-for-osx # or: uv tool install …\n```\n\n> Every [release](https://github.com/jaminben/secure-applemusic-mcp-for-osx/releases/latest)\n> also has the wheel attached with checksums, if you would rather verify a file\n> first.\n\nThere's no setup window on this path, so two steps are yours.\n\n**1. Add it to your MCP client.** For Claude Desktop, in\n`~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n```json\n{\n \"mcpServers\": {\n \"unofficial-apple-music\": {\n \"command\": \"secure-applemusic-mcp\",\n \"args\": [\"serve\"]\n }\n }\n}\n```\n\nFor Claude Code: `claude mcp add unofficial-apple-music -- secure-applemusic-mcp serve`.\nOther clients take the same command in their own config file. Use the full path\nif it isn't on your client's `PATH`, since GUI apps often don't inherit a shell\n`PATH`. `which secure-applemusic-mcp` prints what to paste.\n\n**2. Approve Apple Music once.** Restart the client, then ask it to run\n`config(action='signin')`. A native prompt appears and nothing is stored. Until\nyou do, everything works except adding music you don't already own.\n\nThe wheel is macOS-only and covers both chips. `pip` refuses to install it\nelsewhere rather than hand you a build with no MusicKit.\n\n### From source\n\n```sh\ngit clone https://github.com/jaminben/secure-applemusic-mcp-for-osx\ncd secure-applemusic-mcp-for-osx\n./install.sh --scoped --sign \"My Local Signing Cert\" # or plain ./install.sh\ntools/make-signing-cert.sh # one-off local signing cert\nSIGN_ID=\"Apple Music MCP Self-Signed\" make app # build a signed .app\n```\n\n`install.sh` builds a private `0700` virtualenv from the checkout you're\nstanding in. Nothing is piped from the network into a shell. Plain\n`./install.sh` skips the bundle and sets up the simpler unscoped stdio server.\n\nWithout the bundled MusicKit helper, a source checkout falls back to an optional\nApple Developer token (`login --dev`), which also unlocks richer catalog\nmetadata, charts and recommendations.\n\n### Sharing a build you made\n\nThe [release](https://github.com/jaminben/secure-applemusic-mcp-for-osx/releases/latest)\nis notarized, so it opens on anyone's Mac with nothing to click past. Just send\nthem the right one: `-arm64` for Apple Silicon, `-x86_64` for Intel.\n\nYour own build is different. Self-signed is not notarized, macOS refuses it on\nfirst open, and the old right-click trick no longer works. Your friend would\nneed:\n\n> System Settings → Privacy & Security → scroll down → **Open Anyway**\n\nSelf-signing still earns its keep, because it gives the app a stable identity\nand the Music permission survives rebuilds.\n\nTo hand yours over as cleanly as the release, sign with a **Developer ID\nApplication** certificate and notarize. `make release` runs the whole sequence,\nincluding stapling the ticket into the bundle. (A zip made *before* stapling\nstill needs the network to validate, which is the usual reason a \"notarized\" app\ngets refused on someone else's machine.)\n\n```sh\nSIGN_ID=\"Developer ID Application: Your Name (TEAMID)\" make release\n```\n\nNotary credentials are documented at the top of\n[`tools/notarize.sh`](tools/notarize.sh). It needs a paid Apple Developer\naccount ($99/yr). Nothing else about the app changes.\n\n### Tracking upstream\n\nMIT, © Eric Pheterson, retained in full. Forked at `0acf697`; upstream history\nis preserved in git and in [CHANGELOG-upstream.md](CHANGELOG-upstream.md).\n\nWe take upstream security and correctness fixes to the modules we kept, and\nignore feature commits touching deleted subsystems. The deletions are large, so\ncherry-pick by file rather than merging:\n\n```sh\ngit fetch upstream --tags\ngit log --oneline fork-base..upstream/main -- src/applemusic_mcp/applescript.py\n```\n\nThe capability tests are the safety net for a cherry-pick that would drag a\ndeleted capability back in.\n\n## Uninstall\n\nDrag the app to the Trash, then paste this into Terminal:\n\n```sh\nlaunchctl bootout gui/$(id -u)/io.github.jaminben.secure-applemusic-mcp\nrm -f ~/Library/LaunchAgents/io.github.jaminben.secure-applemusic-mcp.plist\ntccutil reset AppleEvents io.github.jaminben.secure-applemusic-mcp\n```\n\nRemove the `unofficial-apple-music` entry from Claude Desktop's config; a backup\nsits next to it. To clear the cache and audit log too, delete\n`~/.config/applemusic-mcp` and `~/.cache/applemusic-mcp`. From a source install:\n`./install.sh --uninstall`.\n\n> **Never give this the Accessibility permission.** It cannot use it. If\n> anything asks you for it, that's a bug. Please report it.\n\n## Security\n\n[SECURITY.md](SECURITY.md) has the threat model, what is and isn't reachable,\nand the risks that remain: the Music app itself is not sandboxed, prompt\ninjection is real, and this server has no sandbox of its own.\n\nThree problems inherited from upstream are fixed here: an Apple Music link check\nthat could be fooled, a path-traversal guard on the `exports://` resource that\ndid nothing, and destructive operations that acted on a substring guess.\n[CHANGELOG.md](CHANGELOG.md#fixed--inherited-security-issues) has the details\nand [DISCLOSURE.md](DISCLOSURE.md) tracks how they were reported upstream.\n\n## Questions\n\n**Do I need an Apple Developer account, an API key, or a `.p8` file?**\nNo. Apple's MusicKit signs each request using the app's own signature plus your\none-time approval. There is no key to make, paste or store. The optional\ndeveloper token only raises Apple's rate limit for bulk jobs like importing a\nhuge playlist.\n\n**Do I need an Apple Music subscription?**\nNot for your own library, your playlists, or local playback. Yes for playing or\nadding anything from Apple's catalog.\n\n**Does it work on Windows or Linux?**\nNo. It drives the Mac Music app directly. Use\n[upstream](https://github.com/epheterson/applemusic-mcp) if you need those.\n\n**Which AI apps does it work with?**\nClaude Desktop, Claude Code, Cursor, Windsurf, Codex and VS Code. The setup\nwindow finds the ones you have and configures them for you.\n\n**Does anything get stored or sent anywhere?**\nNo password is stored, because there isn't one. The app talks to Apple and to\nnothing else. No tracking, no third-party service, no account with this project.\n\n**What will macOS ask me for?**\nTwo things: permission to control the Music app, and permission to use Apple\nMusic. It never asks for Accessibility, never drives a browser, and never sends\nfake clicks.\n\n**How do I update it?**\nDownload the latest zip, replace the app, restart your AI app. The download\nlinks above always point at the newest release.\n\n**Is this made by Apple?**\nNo. It's an independent project, not affiliated with, endorsed by or supported\nby Apple. \"Apple Music\" and \"MusicKit\" are Apple's trademarks.\n\n## Other Apple Music MCP servers\n\nFull write-up with sources in [docs/COMPARISON.md](docs/COMPARISON.md). The\nshort version:\n\n| | Best for | Needs a dev account | Install |\n|---|---|---|---|\n| [kennethreitz/mcp-applemusic](https://github.com/kennethreitz/mcp-applemusic) | Something tiny you can read in one sitting | no | clone + edit JSON |\n| [epheterson/applemusic-mcp](https://github.com/epheterson/applemusic-mcp) | **Most features**; Windows/Linux; Up Next queue | no | pip/uvx + edit JSON |\n| [Cifero74/mcp-apple-music](https://github.com/Cifero74/mcp-apple-music) | The official REST API | **yes** | wizard + edit JSON |\n| **this fork** | Anyone who doesn't want to open Terminal | no | **double-click** |\n\nWorth knowing if you're choosing: kennethreitz's server drops tool parameters\nstraight into AppleScript without escaping them, so a quote mark in a track or\nplaylist name breaks out of the string. Reported with a fix as\n[issue #8](https://github.com/kennethreitz/mcp-applemusic/issues/8).\n", "bytes": 16156, "sha": "39bbfdd6452c214dfadd18e35fb2f92968df40af3ed820471d061080b1c29da5", "repo_slug": "jaminben/secure-applemusic-mcp-for-osx", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_jaminben_secure_applemusic_mcp_45489dca/readme" }