Repeated macOS permission prompts during Claude Cowork scheduled jobs

[drworm]

Sorry, this is a bit of an edge case. And you probably have your hands tied on the solutions available on fixing this properly. It's also more of a macOS issue than the extension itself.

Description:
Running the Bear Notes MCP server via a Claude Cowork scheduled job constantly triggers macOS file access prompts for the Bear SQLite database. This issue is specific to background Cowork jobs; standard foreground chat interactions in Claude Desktop persist permissions correctly.

Cause:
macOS TCC fails to anchor the "Allow" choice to the background process (likely due to the dynamic execution of npx or the .mcpb bundle), treating each scheduled run as a new execution context.

Steps to Reproduce:

1. Create a Claude Cowork scheduled job that queries Bear Notes.
2. When the background job triggers, macOS prompts for data access.
3. Click "Allow" (the query succeeds).
4. Let the next scheduled job run -> macOS prompts for permission again.

Workaround 1 - Give full disk access to node
This is super dangerous and not something I'm personally comfortable with

1. System Settings > Privacy & Security > Full Disk Access
2. Add the path to node

Workaround 2 - Give full disk access to a "burner node"

1. cp /path/to/node /Users/YOUR_USER/bin/claude-node
2. System Settings > Privacy & Security > Full Disk Access, Add the path to claude-node
3. Use the following MCP server config.

"bear-notes": {
  "command": "/Users/YOUR_USER/bin/claude-node",
  "args": [
    "/path/to/npx",
    "-y",
    "bear-notes-mcp@latest"
  ]
}

[vasylenko]

Hey @drworm thank you for reporting that! Indeed, this is both annoying and good that it exists (Claude's security gates).

I think the root cause is that the MCP server reads directly from the database file -- outside the sandbox in which it runs under Claude's child process.
I am not sure if it's possible to "fix" that anyhow: direct reads are the way to implement the tools of the MCP server, as native Bear's API is quite limited.