Claude Desktop's Info.plist missing TCC usage strings, blocks all EventKit-based MCP servers

Summary

Claude Desktop on macOS cannot use any MCP server that touches Apple's TCC-protected frameworks (EventKit, Contacts, Photos, Reminders, etc.) because Claude.app's Info.plist declares no usage description strings for those APIs. macOS silently denies access without ever surfacing a permission prompt.

Environment

• macOS: 26.x (Darwin 25.4.0 / Tahoe)
• Claude Desktop: latest as of 2026-05-28
• Test MCP: PsychQuant/che-ical-mcp v1.10.0 (Apple-notarized EventKit binary, installed via .mcpb)

Reproduction

1. Install any EventKit-based MCP server in Claude Desktop. I used che-ical-mcp via its signed/notarized .mcpb (https://github.com/PsychQuant/che-ical-mcp).
2. Ask Claude Desktop to list calendars or reminders.
3. Result: Error: Calendar access denied. No system permission dialog is shown.
4. System Settings → Privacy & Security → Calendar does not list Claude. The + button to manually add an app was removed in modern macOS, so there is no GUI workaround.

Verification of root cause

$ /usr/libexec/PlistBuddy -c "Print" /Applications/Claude.app/Contents/Info.plist | grep -iE "Calendar|Reminder|NSCalendarsUsage|NSEventKit"
# (no output — no TCC usage strings declared)

$ codesign -d --entitlements - /Applications/Claude.app 2>&1 | grep -iE "calendar|reminder|eventkit"
# (no output — no relevant entitlements)

The MCP binary itself declares the right strings and is signed/notarized by Developer ID Application: CHE CHENG (6W377FS7BS):

$ codesign -d /Applications/Claude.app/Contents/Helpers/disclaimer 2>&1 | grep Identifier
Identifier=disclaimer
TeamIdentifier=Q6L2SF6YDW

$ spctl -a -vv "~/Library/Application Support/Claude/Claude Extensions/local.mcpb.che-cheng.che-ical-mcp/server/CheICalMCP"
accepted
source=Notarized Developer ID

When the MCP binary calls EKEventStore.requestFullAccessToEvents, macOS attributes the request to the responsible process — Claude.app, via its disclaimer helper. Because Claude.app declares no NSCalendarsFullAccessUsageDescription, TCC returns .denied synchronously without prompting the user. The che-ical-mcp v1.10.0 server log confirms this:

07:11:17.044  tools/call: list_events
07:11:17.088  Error: Calendar access denied  (44 ms — synchronous deny, no prompt)

Impact

This blocks every macOS-native MCP server that uses Apple's TCC-protected frameworks, not just che-ical-mcp. Affected classes include:

• Calendar / Reminders (EventKit)
• Contacts
• Photos
• iMessage / Messages
• Mail.app via AppleScript
• Notes.app
• Microphone / Camera / Screen Recording

These MCPs work in Claude Code (when the launching terminal — e.g., iTerm2 — has its own TCC grant), but are unusable in Claude Desktop.

Proposed fix

Add the relevant Info.plist usage strings to Claude.app's bundle. For the EventKit case:

<key>NSCalendarsFullAccessUsageDescription</key>
<string>Claude uses Calendar access on behalf of MCP servers that integrate with your calendar.</string>
<key>NSRemindersFullAccessUsageDescription</key>
<string>Claude uses Reminders access on behalf of MCP servers that integrate with your reminders.</string>

For complete MCP-ecosystem support, the same treatment is needed for:

• NSContactsUsageDescription
• NSPhotoLibraryUsageDescription
• NSMicrophoneUsageDescription
• NSCameraUsageDescription
• Apple Events / Automation (for AppleScript-driven MCPs)
• Possibly com.apple.security.personal-information.calendars and .reminders entitlements

These are one-time additions; once shipped, all current and future MCPs in those categories will work without further config.

Workaround for affected users

Use Claude Code (CLI) instead of Claude Desktop for MCP servers in this class. The MCP binary inherits TCC from the terminal application (iTerm2, Terminal.app) that launched Claude Code, which can be granted normally via the system prompt.

---