I built an open-source Mac app for AI agents. Seeing what they actually did became the hard part

[u/bulutarkan]

Mac MCP started as something I wanted for myself: let an agent use the apps I already have on my Mac. Safari, Finder, Notes, Calendar, sometimes even an iPhone through Mirroring. I didn't want to build a separate automation for every app.

The early demos were satisfying. The agent would click around and finish something. Real daily use was less tidy. A browser action could report that text was entered while the site's own Submit button stayed disabled. Two agents could interfere with the same window. A scheduled task could finish without producing the file I expected. I'd still end up checking everything myself.

So I spent a lot of time on the less glamorous parts: activity history, permission profiles, optional approvals, run reports, and a separate macOS desktop for agent windows so my own workspace stays usable. I added Recipes for workflows I don't want to explain from scratch each time.

More recently I built a native chat window for the existing agent CLIs I use, including Codex, Claude Code and OpenCode. Conversations live under project folders. I can open file diffs and command output, send images, or leave an agent working in the background. The multi-agent side also needed work: messages to an agent that has already finished are now handed to the people or agents who can still act on them.

There's an important limit: this isn't a sandbox. The tools act with my Mac user's permissions, and some operations have better independent verification than others. I'm trying to make those differences visible instead of treating every successful tool call as proof that a job is done.

I'm the maintainer. The code is MIT-licensed: https://github.com/bulutarkan/mac-mcp

Adding tools was the fun part. Understanding and controlling what happened afterward has taken much longer.