Claude and Apple Notes: connecting takes a minute, a bad rewrite is permanent

You can connect Claude to Apple Notes in about a minute. Anthropic publishes an extension called Read and Write Apple Notes for Claude's desktop app on a Mac. Install it, approve the macOS permission prompt, and Claude can list, read, create and rewrite your notes.

That is the whole setup, and every guide ranking for it stops there. The more useful question comes one step later. Once Claude can rewrite a note, what happens when it rewrites the wrong one, or rewrites the right one badly? In Apple Notes the honest answer is that the rewrite is now the only copy. That gap is where Baalda comes in, and it is a different gap from the one most people expect.

How do you connect Claude to Apple Notes?

There are two real routes, and they do different jobs.

The official extension. Anthropic's connector directory lists Read and Write Apple Notes, published by Anthropic, added in August 2025, for macOS. It exposes four tools: list_notes, get_note_content, add_note and update_note_content. It works through macOS automation, so the first call triggers a system prompt asking whether Claude may control Notes. You find it in the extensions section of the desktop app's settings.

Community MCP servers. GitHub has several. They split into two kinds: ones that drive Notes through AppleScript, the same way the official extension does, and ones that read the Notes database on disk. sirmews/apple-notes-mcp, for example, is the second kind, and its README is plain about the trade: "No ability to create or edit notes." Its last commit was in December 2024.

Both routes share one constraint. Apple does not offer a public web API for Notes, so everything runs on the Mac that holds your notes. Claude on the web or on an iPhone cannot reach them, and the connection only works while that Mac is awake.

What does Claude actually write into a note?

This is the part none of the setup guides cover, and it is on the record in Anthropic's own issue tracker for its connectors, anthropics/claude-ai-mcp. Three user reports describe how the extension writes:

• Checklists become bullets. Issue #29, opened on 28 January 2026, reports that when notes are created or updated through add_note and update_note_content, Apple Notes checkboxes are converted to plain bullets and their ticked state is lost. Apple's checkboxes are not reachable through AppleScript. It was closed as not planned on 12 May 2026.
• Headings flatten and body text shrinks. Issue #924, opened on 25 August 2026 and still open, reports that the extension rewrites every text run with a fixed inline font size, that a heading comes back as bold text at a pixel size rather than as a Notes heading, and that body text lands at 9px.
• A rewrite can rename the note. The same issue notes that Notes takes a note's name from its first line, so an update_note_content call whose body does not repeat the title renames the note.

Issue #903, opened on 20 August 2026, adds that get_note_content fails on notes with embedded images and that list_notes times out on a large iCloud library. None of these are reasons not to use the extension. They are reasons to know that update_note_content replaces a note's body with whatever HTML Claude sends, and that what comes back is not always what was there.

What happens when Claude rewrites the wrong note?

On your own, you notice and fix it. The question is what you fix it from.

Apple's iCloud guide documents Recently Deleted: a deleted note stays there for 30 days and can be recovered. For shared notes, Apple documents Highlights and an Activity view that show which participant changed what. What Apple's Notes guides do not document is any way back to an earlier version of a note that was edited rather than deleted. A rewritten note is not deleted, so it never goes to Recently Deleted. The previous text is simply gone.

That is a small risk when the note is your grocery list. It is a different risk when the note sits in a shared folder that five people work from. Anyone the folder is shared with who can make changes can have Claude make them too, from their Mac and as them, and the next person to open the note sees the rewrite with nothing to roll back to.

How does Baalda handle an assistant's writes?

Baalda is a team second brain built on plain markdown files on your own disk. Several people edit the same note at once over a CRDT, access is set per file and per folder, it is open source under Apache-2.0 and self-hostable, and it is free to run locally with an optional managed Team plan. Claude connects to it over MCP, at your server's URL plus /api/mcp, either as a custom connector with OAuth or with a token from Vault Settings, MCP. The setup page has both.

The part that matters for this post is what the server keeps when an assistant writes. Every MCP write is applied as a transaction on the note's CRDT document, tagged as coming from MCP and attributed to the person whose token made the call. From there three things happen that do not depend on Claude behaving well:

1. A version at the end of each sitting. When a note has been quiet for ten minutes after an edit, the server stores its markdown as a version, up to 50 per note. An assistant's edits go through the same path as a person's, so they get versioned the same way. Restoring a version is itself an edit, so a restore can be undone too.
2. A copy before any large deletion. If one update leaves 20 percent or less of a note that had at least 200 characters, the server first keeps the note as it stood, shown in Version History as Before large deletion. That covers the exact case above: update_note called with a short body over a long note. The ten most recent of these are kept for 30 days on top of the usual 50.
3. Deletes go to Trash, not away. delete_note is a soft delete. The note sits in the server's Trash for 30 days, per vault, and can be restored.

The versions and recovery guide covers the full set. The server also records who last edited each note on every change, under the name of the person whose token made the call, so a rewrite through your token is not anonymous.

There is also a format difference that removes a whole class of the problems above. A Baalda note is a .md file, and a checklist is - [ ] and - [x] in that file. Claude reads and writes the tick as text, so there is nothing for a write to flatten. Headings are ##, not a font size.

When is Apple Notes still the better place?

Often, and it is worth being straight about where.

• On your phone. Baalda ships desktop apps for macOS, Windows and Linux and nothing for iPhone. If most of your notes start as something typed on a phone in a queue, Apple Notes is the better tool, and the extension is a reasonable way to let Claude tidy them later.
• For notes only you read. If nothing in the vault is anyone else's work, versioning protects only you from yourself, and Apple Notes plus some care with what you ask Claude to rewrite may be all you need.
• Without a migration. Baalda has no Apple Notes importer. Moving a library across is an export and a cleanup you do yourself.

And on Baalda's side, the limits are real too. Versions are per sitting, not per keystroke, so two quick rewrites inside the same ten minutes land in one version. Recovery is after the fact: nothing here stops Claude making the bad edit, it only means the earlier text still exists. And a token or OAuth grant still acts as you, with your permissions, which is the subject of the Notion post rather than this one.

So which should you connect Claude to?

If the notes are yours and live on your iPhone, connect Claude to Apple Notes with Anthropic's extension, keep it away from checklists, and read the note after any rewrite.

If the notes are a team's, and you want Claude writing into them rather than only reading, the question to ask of any tool is not whether it connects. Nearly everything connects now. It is what the tool still has after the assistant writes something wrong. For more on which assistants write where, the second brain for Claude comparison goes through the options side by side.