Safari MCP
A native MCP server that lets Claude, or any MCP client, drive Safari on macOS: read a page, click and type, take screenshots, and watch the console and the network. The browser-agent tools most people use are built around Chrome; this is the same idea for the browser a Mac already has.
Why this shape
Safari's extension model is not built for an agent quietly operating the browser. An extension cannot do most of what automation needs without the user in the loop, so Safari MCP does the heavy lifting natively. A single Swift program speaks MCP over stdio and works Safari from the outside: page actions run through Apple Events, screenshots come from the window server, and real keyboard and mouse input, when it is needed, goes through Core Graphics. The extension is kept to the one job only an extension can do, which is seeing inside the page.
Because it drives the Safari that is already running, it works in the browser you actually use, with the tabs you have open, rather than a separate automated copy.
How it works
There are 28 tools. Tab and window control covers listing, opening, closing and
switching tabs, navigation, reload, back and forward, and resizing. Reading a page
is either its text or a list of the elements you can act on, each tagged with a
short reference the model uses in its next call, and find and
inspect narrow that down. Acting covers clicking, typing, setting
values, scrolling, waiting for something to appear, uploading files, the clipboard,
storage, running JavaScript, and screenshots, which work even when the window is in
the background or covered.
The computer tool handles anything a reference cannot reach. By default
it sends synthetic events inside the tab, which works in the background and shows a
cursor overlay so you can see what the agent is doing; asked for real input, it
moves the actual mouse instead, which needs the window in front.
The extension wraps the page's console and its fetch and XHR calls and
streams what it sees to the server over a local WebSocket, so the agent can read
console errors and network requests the way a developer would in Web Inspector.
Several agent sessions can share one bridge: the first becomes the broker, the rest
join it, and if the broker exits another takes over.
Sites you allow
Page actions and JavaScript are gated per site. The first time an agent tries to act on an origin, a native dialog asks you to allow or deny it, and the allowlist is kept on disk where you can see it. The agent can list and revoke what it has been given but cannot grant itself anything. Captured network traffic has its credentials stripped by default: authorization headers, cookies and API keys are redacted unless a call explicitly asks for them.
Where it stands
Version 0.1.0, Apache-2.0, written in Swift with a small JavaScript extension and no third-party runtime dependencies in the server. It needs macOS 13 or later, Xcode to build the extension, and Safari's “Allow JavaScript from Apple Events” setting. Its sibling, macMCP, takes the same approach to native Mac apps.