io.github.cyanheads/macos-mcp-server

The listed environment variables—MACOS_SCREENSHOT_DIR, MACOS_DISPLAY_LAYOUTS, and MCP_LOG_LEVEL—appear to be local configuration values rather than API keys or account credentials. No cloud token or third-party account authorization is indicated, so credential exposure risk appears low.

Neither the materials nor the objective checks declare any remote endpoint, and the host list is empty. There is no stated evidence that screenshots, window information, or system state are transmitted to external services.

The system flags executes-code, and the description says it can control macOS settings, apps, windows, audio, displays, and Focus mode, indicating local execution and system automation capability. This is a normal high-privilege local capability for this type of tool and warrants caution, but not a high-risk rating by itself.

Based on the feature description, the tool may access a screenshot directory, display layout configuration, and local data related to window or app state, and may require macOS Accessibility, Automation, or Screen Recording permissions. The materials do not show clearly excessive privileges beyond the stated purpose, but the reachable local data and system-state scope is broad.

Positive factors include an official registry source, an auditable open-source repository, and updates within the past year, all of which materially reduce supply-chain risk. Caution is still warranted because the README is absent, the license is undeclared, and community adoption is minimal (0 stars), limiting transparency and external validation.