MrGo2/icloud-mcp v2.1.0

v2.1.0 — Official SDK, dual-mode everywhere, one-click install

on GitHub

The biggest release since launch.

Security

• Input validation on all 41 tools (zod v4). This closes an AppleScript injection class found in an internal audit.
• Supply-chain hardening: .npmrc with ignore-scripts, pinned lockfile.

Protocol

• Migrated from a hand-rolled JSON-RPC layer to the official @modelcontextprotocol/server v2 SDK. Dual-era support: legacy 2024-11-05 clients through the 2026-07-28 revision.
• Tool annotations and titles on all 41 tools; structured output (outputSchema) on all 15 list-* tools.
• set-mode now emits tools/list_changed.

Features

• Email and Calendar are fully dual-mode. LOCAL uses Mail.app and Calendar.app via AppleScript with no credentials; CLOUD uses IMAP/CalDAV and works on any OS. Closes #1.
• New update-event tool. The CalDAV path is experimental: a property-preserving merge keeps RRULE, attendees and alarms intact.
• Messages: list-chats, read-messages, react-message via the imsg CLI.
• Contacts: full email/phone arrays, digit-normalized phone search, accounts and groups.
• .env now loads from the server directory (closes #3), and contacts search no longer stops at the first 50. Thanks @vvshakirov and @cam8001 for the reports and PRs.

Install

• npm: npx -y mcp-icloud
• Claude Desktop: download mcp-icloud-2.1.0.mcpb below, then Settings > Extensions > Install Extension
• Breaking: requires Node 20 or newer

51 tests, CI on Node 20 and 22.