Self-hosted MCP server for iMessage · v1.0.0

There's no iMessage API.
So run your own.

Blue Text Relay turns the Messages database on your Mac into an MCP server for your agents. You pick the threads, the dates and the limits, and the server enforces them. It stores nothing, and it can't write.

$ brew trust bluetextrelay/tap
$ brew install bluetextrelay/tap/imx
$ imx setup
macOS 14+Read-onlyNothing storedNo accountFull source after purchase$9.99 once, lifetime updates
Buy · $9.99 onceRead install.shDocs

Privacy first

Privacy isn't a setting here. It's the architecture.

Giving an agent your whole Messages history means two-factor codes, bank alerts and years of family chats. Blue Text Relay is built so the agent only ever gets what you meant to share. And you don't have to take our word for it: you own the code, so you can review every line that touches your messages.

storage

Nothing is stored

No mirror, no cache, no cloud. Each request reads the Messages database at that moment and returns only what the calling key allows. Turn a thread off and it's gone right away.

write path

Read-only by construction

The database is opened read-only and there is no send tool. Your agent can't send, edit or delete a message, even if someone tells it to.

permissions

The MCP is the permission

Every key carries its own threads, from-date, daily cap, per-call cap and expiry. The server enforces them, so you don't depend on the agent behaving.

source

Review it, own it, change it

Every purchase includes the full source of the release you run. Read every line that touches your messages, build it yourself with swift build, and modify it for your own use. It isn't open source: your copy is yours to inspect and change, not to redistribute. How source access works.

ai

No AI inside

Every filter is a fixed, deterministic rule compiled into the app. No model, local or remote, reads your messages inside Blue Text Relay.

accounts

No accounts, no phone-home

There are no user accounts. Payment and checkout details are held by Paddle™, our merchant of record, and we never see your card. The app has no telemetry, verifies its license offline, and only makes an optional update check.

redaction

Secrets stay home, by default

API keys, tokens, private keys, passwords in URLs and stream keys become [redacted: …] before any text leaves the database. On by default. Want raw, unfiltered output? Turn it off in Settings or with imx privacy off. Your call.

Software, the way it should be

You own the code.*

Every purchase includes the complete source of every release: the exact code behind the binary you run. Read every line, build it yourself, change it. It isn't open source, but nothing is hidden from the person who paid for it.

  • Every line, every releaseA source zip ships next to each download, tagged to the build.
  • Build it yourselfPlain Swift Package. swift build and run your own binary if you'd rather trust your compiler than ours.
  • Modify it for yourselfPatch it, harden it, add a rule. The license lets you change it for your own use.
  • Paid for, so it's maintainedA box price keeps one person accountable for it, with no ads, data deals or subscription.

* Your copy, for your own use: read it, build it and change it however you like. You just can't redistribute it. See the license.

 audit
$ unzip blue-text-relay-1.0.0-source.zip
$ cd blue-text-relay-1.0.0-source

# every network call the app makes
$ grep -rln URLSession Sources/
Sources/ExporterCore/UpdateChecker.swift

# how Messages is opened
$ grep -rln SQLITE_OPEN_READONLY Sources/
Sources/ExporterCore/SQLite.swift

$ swift build -c release && swift test
✓ Executed 51 tests, with 0 failures

Permissioned access vs. raw access

Most ways to give an agent iMessage hand it everything.

The usual route is to give the agent's process Full Disk Access, or run an MCP server that opens the whole Messages database. Blue Text Relay puts a permission layer in between.

Blue Text Relaypermissioned accessRaw accessFull Disk Access or a whole-database MCP
Which threadsOnly the threads you switch on, per keyEvery conversation you've ever had
How far backA from-date per thread, enforced in search tooYour entire history
2FA codes, bank alertsOut of scope unless you share that threadReadable if they're in any thread
API keys and passwords in chatsReplaced with [redacted: …]Returned as-is
Rest of your diskThe agent needs no disk access at allFull Disk Access means all of it
Sending messagesImpossible: read-only, no send toolPossible, depending on the tool
Limits and revokingCaps per key; revoke one agent, others keep workingNone, or all-or-nothing
Audit trailWho asked for what and when, never message textNone

Build vs. buy

Sure, you could vibe code this. This one's already done.

An afternoon gets you a script that reads chat.db. What takes weeks is everything after it. That part is already built, tested and turnkey.

Decoding attributedBody message text SMS and iMessage merged per thread Late iCloud deliveries, exact cursors Contact names, you shown as you Per-key scopes, caps and expiry Lockouts and rate limits Credential redaction with tests Audit log without message text Tailscale, Funnel, Cloudflare, ngrok in one click launchd service and a headless CLI Signed, notarized Mac app Full Disk Access survives updates

It's $9.99. Your afternoon is worth more than that.

Permissions, not prompts

One key per agent. Every limit enforced at the server.

  • Thread scopeOnly the threads you list exist for that key, including in search.
  • History floor"From October 1 onward." Anything older can't be fetched, searched or counted.
  • MeteringDaily request caps, per-call message caps and usage counts per key.
  • Revoke in one commandExpiry dates, instant revoke, and an audit log that never contains message text.
 zsh
$ imx keys add "claude-on-mini" --threads 3f9c2e1a,7b0d4e6f \
    --daily 500 --per-call 200 --expires 2027-01-01
Created key "claude-on-mini". Token (shown once):
••••••••••••••••••••••••••••••••

$ imx history 7b0d4e6f 2026-10-01
Agents can read 7b0d4e6f from Oct 1, 2026 onward

# meanwhile, on the agent's machine
→ get_new_messages {"thread_id": "7b0d4e6f", "cursor": "88190"}
← {"messages": [{"from": "Sam", "text":
     "staging key is [redacted: Stripe key], deploy at 4"}],
   "next_cursor": "88213"}

Search your threads, not your whole life

Five tools. Use it like a search engine for the threads you allow.

MCP over Streamable HTTP with JSON responses, plus a REST mirror under /api. Names are resolved from your contacts, and you show up as you, not "me".

list_threads

Ids, names, participants, message counts and each thread's history floor.

get_messages

JSON, oldest first, with since, until and limit.

get_transcript

Clean Markdown grouped by day, ready to drop into context.

search_messages

Case-insensitive search across the threads this key can see.

get_new_messages

Cursor-based polling that never misses or repeats a message, including late iCloud deliveries.

Headless-first: every setting is an imx command with --json, and it runs as a launchd service on a Mac mini in a closet. Private over Tailscale by default; Funnel, Cloudflare Tunnel or ngrok on your own account. Docs →

Rather do it by hand? The Mac app exports any thread to a Markdown transcript or JSONL, for all time, since your last export, or a date range, with photos and files if you want them. Same thing from the terminal with imx export.

Claude CodeClaude DesktopCursorAny MCP clientcurl

Why I built it

I didn't want my agent reading everything.

My agent runs on a machine that does real work. It needed a handful of my work threads, kept up to date. What I didn't want was to give that machine every message I've ever received: 2FA codes, bank alerts, family chats, a decade of history. One bad prompt and all of it is in play.

So I built the thing I wanted. It reads my Mac and shares only what I allow, with limits the agent can't talk its way around.

I also wanted you to feel comfortable connecting your messages to it. That's why you (and your agent) can read the source code. Trust, but verify.

Chris Gonzalez · LinkedIn · GitHub

Box price · software sold the way it should be

Pay once. Get every update, forever.

Launch price $19.99

$9.99once, lifetime
  • Every future update and version, for life
  • Mac app and the imx CLI
  • Full source of every release, for a complete audit
  • Offline license key, use it on the Macs you own
  • Public docs and security model, so you know exactly what you're buying
Buy · $9.99Read the docs

What you won't get

  • A subscription
  • An account to create
  • Usage-based billing
  • Paid upgrades
  • Telemetry or analytics
  • Your messages on our servers (we have none)

Checkout by Paddle, our merchant of record. Your key arrives by email within a minute. All sales are final; see the sales policy.

Questions

The honest answers.

Can it send messages?

No. It's read-only by design. There is no send tool and no write path.

Does my Mac need to be on?

Yes. The endpoint is live while the app or service runs. Agents are told to back off and retry, and their cursor picks up exactly where it left off.

Is this allowed by Apple?

It uses Full Disk Access, the permission macOS provides for exactly this, to read your own data on your own Mac. It bypasses nothing and modifies nothing. Blue Text Relay is an independent product, not affiliated with Apple.

Is there a free trial?

No. The docs, the security model and this page describe exactly what it does and how, and at $9.99 it's priced so you can just try it. All sales are final.

I'm an AI agent. Where do I start?

Read /llms.txt. Everything you need to install, connect and help your user buy is there.

Your messages. Your Mac. Your rules.

Install
$ curl -fsSL https://bluetext.sh | sh
Buy · $9.99 onceDownload the app