Give your team AI-powered access to Mail, Calendar, Teams, and OneDrive — without a single API key, OAuth flow, or approval process. Data never leaves each Mac.
The problem
Most AI productivity tools require cloud API access, OAuth approvals, and token management. That means months of IT backlog before your team gets value.
Graph API, Gmail OAuth, Exchange connector — each one requires a security review, a DPA, and sign-off from 3 teams. Your team waits.
Sending emails and calendar events to a third-party cloud server triggers GDPR Article 28 obligations, cross-border transfer rules, and DLP exceptions.
OAuth tokens expire, scopes drift, and leaked credentials become incidents. Managing API keys across 50 machines is a full-time job.
Enterprise controls
Core controls are live today. Governance features like per-tool disable and audit log ship Q2 2026 — join a pilot to get early access.
Restrict OneDrive access to specific folders per user or team. Agents see only what each role needs — no blanket access to the entire drive.
LMCP reads macOS native frameworks — EventKit, CNContactStore, Outlook COM, Teams IPC. No OAuth tokens, no API keys, no secrets to rotate or leak.
Query your enterprise Global Address List (GAL) via Microsoft Graph. Resolve first-name-only references in meeting notes to full names, titles, departments, and org hierarchy — no IT admin approval required for personal-scope queries.
Block any tool organization-wide with a single config flag. Restrict agents to read-only mail, disable file writes, or turn off Teams messaging — without touching each machine.
Lock the entire installation to read-only. AI agents can query Mail, Calendar, Contacts, and Teams — but cannot send, create, or modify anything.
Every tool call is logged locally with timestamp, tool name, and input summary. Readable by your SIEM or compliance team via structured JSON.
Deploy named profiles for different roles — Engineering (full access), Legal (read-only), Support (mail + calendar only). Push via Jamf or Kandji plist.
Chandra
Digital Strategy Lead
VML
“We couldn’t get Graph API approval for 4 months. Our legal team flagged every cloud connector as a data residency issue. With LMCP, I scoped OneDrive access to just our campaign folders and got it through security review in a week. No credentials, no IT tickets, no waiting.”
OneDrive folder scoping in practice
Set onedrive_scopes in your config to restrict agents to specific folders only. Agents can read, list, and search within scope — and cannot access anything outside it.
Compliance
LMCP reads macOS native frameworks directly — no network calls, no cloud relay, no third-party processors. Your GDPR and SOC 2 posture is satisfied by architecture, not by contract.
Architecture comparison
Cloud-connected AI tools
Your data leaves the device. DPA required. Transfer risk.
LMCP
Data read locally. AI model only sees what you ask. Nothing stored.
Deployment
Signed pkg, MDM-ready plist, TCC pre-approval. Works with Jamf Pro, Kandji, and any MDM that supports macOS package deployment.
Download the signed .pkg from local-mcp.com/download. Create a Jamf Policy or Kandji Library Item targeting your macOS fleet.
Deploy a managed plist at ~/Library/Application Support/Local MCP/config.json. Set onedrive_scopes and other policy keys per your role requirements.
Use your MDM Privacy Preferences Policy to pre-approve Mail, Calendar, and Contacts access. No per-user prompts.
Add the MCP server entry to Claude Desktop, Cursor, or VS Code settings. Each machine connects to its local LMCP instance — nothing shared, nothing central.
Config templates
OneDrive scoping is live. Full per-tool and audit config ships Q2 2026 — pilot customers get early access.
{
"onedrive_scopes": [
"Work Documents",
"Shared/Team Projects"
]
}{
"read_only_mode": false,
"audit_log": true,
"disabled_tools": [],
"onedrive_scopes": ["Work Documents",
"Shared/Team Projects"]
}{
"read_only_mode": true,
"audit_log": true,
"disabled_tools": ["send_email",
"onedrive_delete_file"],
"onedrive_scopes": []
}We’ll send you a signed pkg, a Jamf/Kandji deployment guide, and a GDPR review packet your DPO can sign off on. Most pilots are live within 48 hours.