Apple-icloud-mcp Server

Apple-icloud-mcp is an MCP integration. Unofficial: Apple Music, iCloud Calendar/Contacts/Mail, Apple Maps and WeatherKit, no Mac needed.

Packages and local setup

The published npm package is apple-icloud-mcp, version 0.3.5. Its declared MCP transport is stdio.

The package declares APPLE_TEAM_ID: Your Apple Developer Team ID (10 characters). Needed for Apple Music (official API), Apple Maps and WeatherKit.; APPLE_KEY_ID: Key ID of a private key created in Certificates, Identifiers & Profiles → Keys with Media Services (MusicKit), MapKit JS and/or WeatherKit enabled.; APPLE_PRIVATE_KEY: Contents of that key's .p8 file (PEM; one-line values with \n escapes and base64 are accepted).; APPLE_PRIVATE_KEY_PATH: Local installs only: a path to the .p8 file instead of APPLE_PRIVATE_KEY.; APPLE_MUSIC_KEY_ID: Optional per-service override of APPLE_KEY_ID for Apple Music (pair with APPLE_MUSIC_PRIVATE_KEY).; APPLE_MUSIC_PRIVATE_KEY: Optional per-service override of APPLE_PRIVATE_KEY for Apple Music.; APPLE_MAPS_KEY_ID: Optional per-service override of APPLE_KEY_ID for Apple Maps.; APPLE_MAPS_PRIVATE_KEY: Optional per-service override of APPLE_PRIVATE_KEY for Apple Maps.; APPLE_WEATHERKIT_KEY_ID: Optional per-service override of APPLE_KEY_ID for WeatherKit.; APPLE_WEATHERKIT_PRIVATE_KEY: Optional per-service override of APPLE_PRIVATE_KEY for WeatherKit.; APPLE_WEATHERKIT_SERVICE_ID: WeatherKit only: the Services ID registered for WeatherKit (e.g. com.example.weather).; APPLE_MUSIC_DEVELOPER_TOKEN: Optional: a pre-minted Apple Music developer token (JWT) instead of signing one from the key above.; APPLE_MUSIC_USER_TOKEN: Music User Token for your library (official API), from a one-time MusicKit sign-in: npx apple-icloud-mcp music-auth. Without the Apple Developer key, ask the owner for a developer token (music-auth --print-developer-token) and run it with APPLE_MUSIC_DEVELOPER_TOKEN set. Lasts ~6 months.; APPLE_MUSIC_WEB_USER_TOKEN: Opt-in web-player mode (no developer account needed; unlocks rename/delete/remove/reorder): the media-user-token cookie from a signed-in music.apple.com tab.; APPLE_MUSIC_WEB_DEVELOPER_TOKEN: Optional override for the web-player developer token (normally read automatically from music.apple.com).; APPLE_MUSIC_STOREFRONT: Two-letter Apple Music storefront (e.g. us, gb). Default: your account's storefront, else us.; ICLOUD_USERNAME: Your Apple ID email, for iCloud Calendar, Contacts and Mail.; ICLOUD_APP_PASSWORD: An app-specific password from appleid.apple.com → Sign-In and Security → App-Specific Passwords (NOT your Apple ID password).; ICLOUD_MAIL_ADDRESS: Your @icloud.com address, only if your Apple ID email is not an iCloud address (needed for Mail).; ICLOUD_DEFAULT_CALENDAR: Calendar new events go to when none is named (default: the first writable event calendar).; APPLE_WRITE_MODE: "none" = read-only tools; "additive" = also create/append, never modify, delete or send; "all" = everything (default). Unrecognized values fail closed to "none".; APPLE_SERVICES: Comma-separated services to enable (music, calendar, contacts, mail, maps, weather, itunes). Default: all.; DISPLAY_TZ: IANA time zone (e.g. America/New_York) for displayed times and for dates you give without an offset. Set this on a hosted server, which runs in UTC.; APPLE_UNITS: "metric" (default) or "imperial" units for weather (Maps distances always show both).; APPLE_STATE_CACHE: Set to false to write nothing under $MCP_DATA_DIR/.apple-icloud-mcp: no web-player token or iCloud discovery cache, and the rejected-password latch and spent confirmation tokens then last only as long as the process.; APPLE_REQUEST_TIMEOUT_MS: Per-request timeout in milliseconds (default 30000).; APPLE_DEBUG_LOG: Set to 1 to log every upstream request line to stderr (credentials redacted).; MCP_CONFIRM_MODE: How confirm-gated writes (send mail, deletes, removing tracks, invitations) behave on a client with no prompt, like claude.ai: "ask-user" (default: preview + confirmToken, the model must get your OK), "auto", or "refuse". Unknown values mean refuse.; MCP_CONFIRM_ELICITATION: "off" never shows a confirmation prompt, so every client gets the MCP_CONFIRM_MODE flow. Set it for a client that says it can prompt but never does (the gated call hangs, e.g. opencode 2.0.x). Any other value stays "on" (with a stderr warning).; MCP_CONFIRM_TTL_SECONDS: Lifetime of a confirmToken in seconds (default 600).; MCP_CONFIRM_SECRET: Signing key for confirmTokens. Random per process by default; set it so a token issued just before a restart or redeploy still works (spent tokens are recorded on disk, so none can be replayed)..

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry · Project repository. This profile uses version 0.3.5 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related developer tools MCP servers for tools that cover the same kind of work.