Safari 27 Ships an MCP Server, and Your Mac Fleet Just Gained an Agent Surface You Cannot Switch Off Centrally

WebKit announced the Safari MCP server on 1 July 2026, and it is now shipping in Safari 27 alongside macOS 27. It is the first major browser to ship a Model Context Protocol server in the box rather than as an extension or a third party bridge. The server is part of safaridriver, the WebDriver binary that has lived at /usr/bin/safaridriver for years, and it is started by an MCP client as a local subprocess. Adding it to Claude Code is a single command that points at safaridriver with an mcp flag, and the same works for Codex, Cursor, Gemini CLI or any other client that speaks the protocol.

What an agent gets is substantial. The WebKit documentation lists seventeen tools, among them create_tab, navigate_to_url, get_page_content, page_interactions for clicking, typing, scrolling and hovering, screenshot, browser_console_messages, list_network_requests and get_network_request, set_viewport_size, and evaluate_javascript. That last one is the tool worth underlining. An agent with evaluate_javascript can run arbitrary script in any page it has opened, and an agent with get_network_request can read the requests and responses that page makes. For front end debugging that is exactly the point. For a security team it means a coding agent on a developer laptop now has a first party, signed, Apple supported way to drive a real browser engine.

Apple deserves credit for the design, and it is worth being precise about it so the risk is not overstated. The server runs entirely on the local machine and makes no network calls of its own, so nothing is sent to Apple. It is off by default and needs two deliberate steps: Show features for web developers under Advanced, then Allow remote automation and external agents under Developer. Automation runs in a separate window that does not share the user profile, so the agent cannot read AutoFill data, saved passwords, cookies from the everyday browsing session or history. This is not a tool that silently hands your bank session to a model. It is closer to a well built Playwright that happens to ship with the operating system.

The gap is on the fleet management side. Coverage of the enterprise release notes for macOS 27 reports that there is no MDM payload key that specifically disables the MCP server or the external agents toggle, and that granular Safari developer restrictions are available on supervised iOS and iPadOS but not on the Mac. We have not seen Apple dispute that reading, and until a payload appears, the practical position is that any user who can open Safari settings can turn this on. For most organisations that is every developer, and in many small companies it is every staff member. A control that depends on nobody ticking a box in a settings pane is a policy, not an enforcement mechanism.

The isolation also moves the risk rather than removing it. The automation window starts clean, which means an agent that needs to test a logged in flow will be given credentials to type, usually for staging, sometimes for production, often pasted into the conversation or a config file by a developer in a hurry. Once logged in, get_network_request exposes bearer tokens and session headers to the agent context, and from there to whatever model provider the client uses and whatever logs it keeps. Pages the agent reads are untrusted input as well. A page that contains instructions aimed at the model, the familiar indirect prompt injection, now sits one tool call away from evaluate_javascript on an authenticated session. We made the same argument about agent browsers such as Cloudflare Kitesurf earlier this year: a browser controlled by an agent is a separate runtime and deserves its own control boundary.

Governance therefore has to happen at the layers you do control. The first is the MCP client. Claude Code supports managed settings that an administrator can distribute to restrict which MCP servers are allowed, and Cursor and the other enterprise clients offer comparable policy files or admin consoles, so an allow list that names the Safari server explicitly, or excludes it, is enforceable today. The second is the endpoint. EDR and process telemetry can alert when safaridriver starts with the mcp flag under a parent process that is an AI client, which gives you an inventory of who actually uses it rather than who says they do. The third is credentials: test accounts for agent driven browsing should be scoped, short lived and useless outside the environment they were issued for, and never shared with a human production login.

The framework mapping is familiar. ISO 27001 Annex A 8.19 on installation of software on operational systems and 8.9 on configuration management expect you to know and control what capabilities are enabled on endpoints, and a built in feature you cannot centrally disable should be recorded as an accepted risk with compensating controls rather than ignored. Annex A 5.17 and 8.5 cover the authentication information an agent is handed. SOC 2 CC6.1 and CC6.8 ask how you restrict logical access and prevent unauthorised software, and an auditor who knows about this release will reasonably ask how you know which laptops have it on. ISO 42001 treats each agent and its tools as part of the AI system inventory, which is where a Safari MCP entry, its owner and its permitted scope belong. Compliance platforms such as Vanta, Drata and Secureframe can collect the MDM and EDR evidence, but only if you have defined the control first.

The checklist is short. Decide whether the Safari MCP server is allowed for developers, and write that decision into your acceptable use policy and AI register. Enforce it in the MCP client configuration you distribute rather than hoping the Safari toggle stays off. Add a detection for safaridriver launched in MCP mode and review the first week of results to build a baseline. Issue dedicated, scoped test credentials for any agent that needs to log in, and ban production credentials in agent sessions outright. Tell developers plainly that pages an agent reads can carry instructions, and that network inspection output may contain secrets that end up in model context. Then watch for an Apple MDM payload in a point release and replace the compensating controls with the real one when it arrives.

Our view is that the Safari MCP server is a good tool built with more care than most agent integrations we review, and front end teams will adopt it quickly because it removes a genuine annoyance. That is exactly why it needs a governance decision now rather than after it is everywhere. The pattern will repeat: operating system and browser vendors are going to ship agent interfaces as standard features, and each one will arrive with thoughtful defaults and incomplete enterprise controls. Organisations that already manage agents through client policy, endpoint telemetry and a maintained AI inventory will absorb each new surface as a line item. Everyone else will discover it in an incident review.