What happened
Carl Mercier’s iMessage Bridge is a menu-bar app for macOS 14 or later. Its public page describes connecting agents such as Claude Code, Grok and Cursor to a Mac’s Messages history and send capability. Users can ask an agent to find messages needing replies, catch up on a group chat, search for what someone said earlier, or draft and send a text. The agent communicates with the app; the app reads message history and sends through Messages.app. The agent does not directly touch the Messages database.
Access is approved separately for each agent. When a new agent connects, it displays a six-digit code on the Mac; nothing is shared until the user approves it. Each agent can be configured as read-only or allowed to read and send, limited to selected conversations, and revoked at any time. By default, every outgoing message triggers a prompt on the Mac for the user to check before it is sent. The user can also designate people the agent may text without asking each time.
The app includes an optional screening step for incoming messages. The project warns that anyone who can text the user could write instructions an agent might follow; screening checks messages and hides suspicious ones before they reach the agent. A local model, downloaded from the app’s Safety page, is about 270 MB and runs on the Mac. The page also says users can add a TypeSafe API key for better coverage; screening is active when either option is on. These are described as protections, not as a guarantee that prompt injection will be prevented.
Setup requires granting Full Disk Access to iMessage Bridge. Sending also requires requesting macOS permission to control Messages. The recommended path is to download the DMG from the latest release, move the app to Applications, open it, grant the permissions, then copy the setup prompt into an agent capable of running commands on the Mac. Homebrew installation is also supported with brew install --cask cmer/tap/imessage-bridge. The page estimates installation takes about five minutes. It does not state a price; the project is MIT licensed.
The app says everything runs on the Mac and accepts connections only from it unless network access is enabled. Requests appear on an Activity page, and message text is not logged there. However, messages an agent reads are sent to that agent’s AI provider, as with other information shared with that agent. Advanced setup covers Claude Desktop, Cursor, manual connection and access from another computer.
What the archive adds
This is a new tool, but it sits near two distinct threads in the archive. Ponte connected coding agents across developers over an encrypted MCP channel; iMessage Bridge instead exposes a personal messaging account through a local app with scoped permissions. An earlier Telegram post described Codex on Mac using iMessage and Shortcuts to control an iPhone. The new detail here is a packaged, per-agent permission and confirmation model for reading and sending messages.
Trend signal
The release supports agent security moving to runtime boundaries: control is implemented through the app’s access scopes, approval flow, send confirmation and screening of inbound content, rather than relying only on an agent prompt. It is a small product example, not evidence that these controls reliably block attacks or are becoming a general standard.
Why it matters
Messaging is a consequential surface for agents: it contains private context and enables the agent to speak as the user. iMessage Bridge makes the boundary visible and configurable. A builder can distinguish the ability to read from the ability to send, scope access to conversations, and require human review for an external action. Those are useful design choices for any integration that gives an agent access to personal or organizational communications.
The trade-off is that controls add setup and review work, while broader access can make an agent more useful. The app’s local screening option also illustrates that incoming content should be treated as potentially adversarial, even when it arrives through an ordinary conversation. For teams, the key product question is not simply whether an agent can use a channel, but which operations it can perform, on whose behalf, and with what review path. The source describes this design, but does not establish its security effectiveness under attack.
Limits and uncertainty
The supplied project page does not provide independent security testing, a threat model, or evidence that screening catches prompt injection reliably. It does not quantify performance, supported message volume, battery or resource use, or the consequences of enabling network access. It also does not state a price beyond the MIT license, adoption figures, or support guarantees. Messages read by an agent are sent to its AI provider, so local app operation does not mean all message data stays on the Mac. The page’s claims describe the product’s intended behavior, not an external audit.
Reader takeaway
iMessage Bridge is a concrete example of giving an agent access to a sensitive channel without handing it unrestricted database access: approve each agent, scope its permissions, and keep a human confirmation step for sends by default. Builders should treat those as useful controls to evaluate, not as proof that the integration is safe or that message content stays local.