Search, read and act on Apple Notes — folders, attachments, writes off by default
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
apple_notes_findSearch the note library for everything on a topic and summarise what is actually written there — opening the notes rather than answering from titles.Search the note library for everything on a topic and summarise what is actually written there — opening the notes rather than answering from titles.
No input schema was published for this tool.
apple_notes_captureWrite something into the note library, checking first whether it belongs in a note that already exists. Requires writes to be enabled.Write something into the note library, checking first whether it belongs in a note that already exists. Requires writes to be enabled.
No input schema was published for this tool.
apple_notes_diagnosticsReport which lanes are live, which macOS permissions are granted, and what each missing one is blocking. Start here when a tool returns degraded or fails — it names the exact System Settings pane to open.Report which lanes are live, which macOS permissions are granted, and what each missing one is blocking. Start here when a tool returns degraded or fails — it names the exact System Settings pane to open.
No input schema was published for this tool.
apple_notes_list_accountsList the Notes accounts, with how many folders and notes each holds. Start here to discover account names for the other tools.List the Notes accounts, with how many folders and notes each holds. Start here to discover account names for the other tools.
No input schema was published for this tool.
apple_notes_list_foldersList folders across every account. Folders nest, so each entry carries its depth and the account it belongs to. Use the returned id with the move and create tools.List folders across every account. Folders nest, so each entry carries its depth and the account it belongs to. Use the returned id with the move and create tools.
No input schema was published for this tool.
apple_notes_create_noteCreate a note. Notes takes its title from the first line of the body, so `title` is prepended as a heading rather than set as a property.Create a note. Notes takes its title from the first line of the body, so `title` is prepended as a heading rather than set as a property.
No input schema was published for this tool.
apple_notes_update_noteReplace or append to a note's body. Editing the first line changes the title, because that is where Notes takes it from.Replace or append to a note's body. Editing the first line changes the title, because that is where Notes takes it from.
No input schema was published for this tool.
apple_notes_add_attachmentAttach a file to a note. This is the only way to put an image in a note — an <img> tag in the body creates an attachment whose bytes are never loaded.Attach a file to a note. This is the only way to put an image in a note — an <img> tag in the body creates an attachment whose bytes are never loaded.
No input schema was published for this tool.
apple_notes_move_noteprivilegedMove a note to another folder.Move a note to another folder.
No input schema was published for this tool.
apple_notes_delete_notesprivilegedDelete notes. They go to Recently Deleted rather than being destroyed, but this still requires an explicit confirm.Delete notes. They go to Recently Deleted rather than being destroyed, but this still requires an explicit confirm.
No input schema was published for this tool.
apple_notes_list_notesList notes, newest first. Returns a `ref` per note for the read and action tools. Prefers Notes' own index, which stays fast as a library grows.List notes, newest first. Returns a `ref` per note for the read and action tools. Prefers Notes' own index, which stays fast as a library grows.
No input schema was published for this tool.
apple_notes_search_notesSearch notes. `scope: "full"` (the default) matches the body text; `scope: "title"` matches only titles and previews and is the cheaper query. Returns a `ref` per hit.Search notes. `scope: "full"` (the default) matches the body text; `scope: "title"` matches only titles and previews and is the cheaper query. Returns a `ref` per hit.
No input schema was published for this tool.
apple_notes_get_noteRead one note's full text by ref. Password-protected notes report as locked rather than returning an empty body — their text is encrypted at rest.Read one note's full text by ref. Password-protected notes report as locked rather than returning an empty body — their text is encrypted at rest.
No input schema was published for this tool.
apple_notes_list_attachmentsList a note's attachments. Metadata only — retrieving the bytes needs Full Disk Access, because the scripting dictionary carries no file path.List a note's attachments. Metadata only — retrieving the bytes needs Full Disk Access, because the scripting dictionary carries no file path.
No input schema was published for this tool.
apple_notes_save_attachmentSave one attachment to disk. Needs Full Disk Access. It can only write into APPLE_NOTES_ATTACHMENT_DIR (default ~/Downloads) and will not overwrite an existing file unless you ask it to. Write-gated because it puts a file on the user's disk, even though it changes nothing in Notes.Save one attachment to disk. Needs Full Disk Access. It can only write into APPLE_NOTES_ATTACHMENT_DIR (default ~/Downloads) and will not overwrite an existing file unless you ask it to. Write-gated because it puts a file on the user's disk, even though it changes nothing in Notes.
No input schema was published for this tool.
15 of 15 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Search, read and act on Apple Notes — folders, attachments, writes off by default
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.