The Safari MCP server is a Safari 27 feature that lets AI coding agents like Claude Code and Codex open tabs, read pages and take screenshots on your Mac. It’s off by default, and you turn it on with two checkboxes in Safari’s settings.
Here’s the short version of what you need to know before you flip those switches:
- It ships in Safari 27 and Safari Technology Preview 247, per Apple’s WebKit team.
- It exposes 17 browser tools, from reading page content to taking screenshots.
- It runs locally and makes no network calls of its own.
- Your agent, not Apple, receives whatever it captures.
That last point is the one most people skim past, so we’ll come back to it.
What the Safari MCP server actually does
MCP, short for Model Context Protocol, is the common plug that lets AI tools talk to apps. Safari now speaks it natively through its own safaridriver tool, so any MCP-compatible agent can connect without a browser extension.
Apple’s WebKit announcement lists 17 tools. They cover tab control (create, switch, close), navigation, reading page content, listing network requests, console messages, JavaScript evaluation, dialogs, screenshots and viewport or media emulation.
In plain terms, an agent can load your site, check how it renders, read the console errors and tell you what broke. That’s handy when you’re debugging layout bugs or slow requests and don’t want to copy and paste logs by hand.
How to enable the Safari MCP server in Safari 27
The setup takes about two minutes, and Apple confirms it’s switched off until you do this yourself. Follow these steps in order:
- Open Safari, then go to Settings > Advanced and tick the option to show features for web developers.
- Go to Settings > Developer and tick “Allow remote automation and external agents.”
- Add the server to your agent. For Claude Code, run
claude mcp add safari-mcp -- "/usr/bin/safaridriver" --mcp. - For Codex, run the same command with
codexin place ofclaude.
Other agents can use a standard mcp.json entry that points the command at /usr/bin/safaridriver with the single argument --mcp. You can name the server anything you like, so “safari” works fine.
If you’d rather test with the preview browser first, the setup is nearly identical. The table below shows the only differences.
| Setup detail | Safari 27 | Safari Technology Preview 247 |
|---|---|---|
| Driver path | /usr/bin/safaridriver | Inside the Safari Technology Preview app bundle |
| Suggested server name | safari-mcp | safari-mcp-stp |
| Settings to tick | Web developer features, plus remote automation and external agents | Same two settings |
Practical jobs to hand your agent
According to 9to5Mac’s summary of the WebKit post, an agent can check things like form states, computed styles, accessibility problems and load performance. That makes it a decent second pair of eyes on a page you just changed.
A good first prompt is simple: “Open my staging site, resize to a phone viewport and tell me what looks broken.” The agent can set the viewport, take a screenshot and read the console in one pass.
Another useful trick is asking it to list network requests and flag the slowest ones. You still decide what to fix, but the digging is done for you.
What your agent can and can’t see
Apple says the server runs entirely on your machine, makes no network calls and can’t reach personal Safari data like AutoFill or other browsing activity. That’s a solid design for a feature that touches a browser.
But page content, screenshots and console logs still flow to the agent you connect. What happens next depends on that agent and the model behind it, which Apple can’t control.
There’s also a general risk with any browsing agent: a web page can contain text that tries to trick it into doing something you didn’t ask. Stick to sites you control or trust.
So treat it like handing a colleague your screen. Use it on a staging site or a throwaway tab, not while your banking page is open. Apple’s own advice is to only use agents you trust.
The catch for companies that manage Macs
IT teams have a different worry. According to Forkast, Apple’s enterprise release notes list no MDM setting to disable the MCP server on macOS, even though supervised iPhones and iPads can lock Safari down fully.
That’s the outlet’s reading of the release notes, so check Apple’s current documentation before writing policy. Even so, the feature is off by default and needs a manual opt-in, which limits the risk for now.
If you manage a fleet, it’s worth asking developers to report when they enable it. We covered the wider macOS 27 rollout in our macOS 27 release date guide, and the trend of apps adding MCP servers is growing, as seen with Nanoleaf’s MCP server for ChatGPT and Claude.
Frequently Asked Questions
Is the Safari MCP server turned on by default?
No. You have to enable web developer features in Safari’s Advanced settings, then allow remote automation and external agents in the Developer tab.
Which AI tools work with it?
Any agent that supports MCP over a local command. Apple’s post gives ready-made commands for Claude and Codex, plus a generic config for others.
Does Apple get my browsing data?
Apple says no. The server makes no network calls and sends captured data only to the agent you run.
Can the agent see my passwords or AutoFill?
Apple says the server has no access to personal Safari information such as AutoFill. It can still read whatever is shown on the pages it controls, though.
Should you turn it on?
If you build or test websites, yes, and it’s a real time-saver. Keep it off the rest of the time, and never leave it enabled while you’re signed in to anything sensitive with an agent attached.
Leave a Reply