An iMessage MCP server that never hands over your messages

Why connect an assistant to iMessage at all

Years of your life are in Messages: who sent which link, what you promised, where the group chat decided to eat. An assistant that can see that answers real questions — what was the site Maya sent, who do I know at that company, what did I say I'd send Jonas. The usual way to get there is to export the database and paste it in, which hands a provider everything you ever wrote.

What an iMessage MCP server usually does

Most open-source iMessage MCP servers open ~/Library/Messages/chat.db and expose tools that read message text, and often send messages too. That gives the model full transcripts and a way to act. It is powerful, and it means every prompt can carry your friends' words to whichever company runs the model.

What Sanctuary's does instead

Sanctuary is a Mac app that reads Messages, Contacts and Apple Mail on your machine and builds a library: every link with its sender, conversation and summary, a card for each person, the open loops between you. Its MCP server exposes that library, not the conversations.

The always-on tools are metadata only: search links by keyword, everything a person sent, links that came up with someone, links on a topic, what arrived this week. Titles, senders, sites and summaries — never message text. A second tier, off by default, adds person and context tools; it is behind a switch in the app because what it returns can carry more.

Set up in one command

The server ships as an npm package and registers itself with Claude Desktop.

1. Install Sanctuary and let it index Messages.
2. In Terminal, run: npx -y @linksanctuary/mcp init
3. Restart Claude Desktop. The Sanctuary tools appear in the tools list.
4. To share the richer person tools, turn on Connected chat apps in the app's Profile. Turn it off and they disappear on the next call.

It never sends

There is no send tool, no draft tool, no write path. The server is read-only against the library, and the library is read-only against Messages. Sanctuary as a whole holds that line: its agents suggest and never send.

What can leave the Mac

Whatever an MCP tool returns goes to the connected app and its model provider. That is the entire point of the tiers: the metadata tools return link titles and senders, and you decide whether the context tier is on. Nothing else about the library leaves. The privacy policy lists every request the app can make, and the public security page shows the audit.