Skip to content

Security: sweetrb/apple-numbers-mcp

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
1.x.x

Reporting a Vulnerability

If you discover a security vulnerability, please report it by emailing:

rob@superiortech.io

Please include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

You will receive a response within 48 hours acknowledging receipt. Security issues will be prioritized and addressed as quickly as possible.

Security Considerations

This MCP server:

  • Runs locally on your machine
  • Uses the numbers-parser Python library to read/write .numbers files, and AppleScript to drive Numbers.app for formatting and formulas
  • Saves file modifications atomically (temp file + os.replace) so an interrupted write cannot corrupt the target file
  • Does not transmit data to external servers
  • Does not store credentials or passwords

The formatting/formula tools require macOS automation permission for Numbers.app. These permissions are managed by macOS and can be revoked at any time in System Settings → Privacy & Security → Automation.

There aren't any published security advisories