I'm currently working on automated instalation of Mavericks 10.9. I have NetBoot set up. Everything works OK untill I want to execute Applescript. Since the release of new version I need to manually enable those scripts. Is there a command that I can use in shell script to add app to Assistive Devices list? Or maybe there is some plist that has to be edited for it to work?

  • I'm not totally sure this is what you're seeing, but this article might help: support.apple.com/kb/HT5914 Commented Nov 26, 2013 at 16:47
  • Thank you for the reply. I also stumbled on this article while I was searching for solution. It is not what I am looking for as this solution still uses GUI interaction. Commented Nov 26, 2013 at 18:25
  • @KarolBerlinski What was the workaround you used? I am still trying to figure out how to add an app to the Assistive Devices via command line or a non GUI method. Thanks Abraham
    – AbsterT
    Commented Feb 20, 2014 at 6:04

2 Answers 2


The settings are stored in /Library/Application Support/com.apple.TCC/TCC.db:

$ sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'





The schema, as given by sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db '.schema access', is:

CREATE TABLE access (service TEXT NOT NULL, client TEXT NOT NULL, client_type INTEGER NOT NULL, allowed INTEGER NOT NULL, prompt_count INTEGER NOT NULL, csreq BLOB, CONSTRAINT key PRIMARY KEY (service, client, client_type));

On my installation the last four columns (client_type, allowed, prompt_count, and csreq) are 0|1|0|\xfa\xde\x0c for applications that were added after the "example.app" would like to control this computer using accessibility features dialog was shown and 0|1|1| for applications that I added by dropping them to the list in System Preferences.

~/Library/Preferences/com.apple.universalaccessAuthWarning.plist contains a list of applications for which the warning dialog has been shown:

$ defaults read com.apple.universalaccessAuthWarning
    "/Applications/Automator.app" = 1;
    "/Applications/Automator.app/Contents/MacOS/Automator" = 1;
    "/Applications/FastScripts.app" = 1;
    "/Applications/FastScripts.app/Contents/MacOS/FastScripts" = 1;
    "/Applications/Slate.app" = 1;
    "/Applications/Slate.app/Contents/MacOS/Slate" = 1;
    "/Applications/Utilities/AppleScript Editor.app" = 1;
    "/Applications/Utilities/AppleScript Editor.app/Contents/MacOS/AppleScript Editor" = 1;
    "/Applications/Xcode.app/Contents/Applications/Accessibility Inspector.app" = 1;
    "/Applications/Xcode.app/Contents/Applications/Accessibility Inspector.app/Contents/MacOS/Accessibility Inspector" = 1;
    "/Applications/iTerm.app" = 1;
    "/Applications/iTerm.app/Contents/MacOS/iTerm" = 1;
    "/Users/lauri/Desktop/aa.app" = 1;
    "/Users/lauri/Desktop/aa.app/Contents/MacOS/applet" = 1;
    "com.apple.AccessibilityInspector" = 1;
    "com.apple.Automator" = 1;
    "com.apple.ScriptEditor.id.aa" = 1;
    "com.apple.ScriptEditor2" = 1;
    "com.red-sweater.FastScripts" = 1;
    "com.slate.Slate" = 1;

I couldn't figure out how to actually allow access for assistive devices for an application though. I tried for example running these commands:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'insert into access values ("kTCCServiceAccessibility","com.apple.ScriptEditor.id.qq",0,1,0,"'$'\xfa\xde\x0c''");'
defaults write com.apple.universalaccessAuthWarning com.apple.ScriptEditor.id.qq -bool true
defaults write com.apple.universalaccessAuthWarning /Users/lauri/Desktop/qq.app -bool true
defaults write com.apple.universalaccessAuthWarning /Users/lauri/Desktop/qq.app/Contents/MacOS/applet -bool true
sudo killall tccd

I also tried restarting to apply the changes and setting the last four columns to 0,1,1,"".

  • 2
    Thank so much for your feedback. I was able to make a workaround thanks to it. The tccd proccess cannot be killed, only restart will be sufficient here. I start the app that needs Accesssibility, then use sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'update access set allowed=1' and then reboot system. It works. Thanks again (If you need access for one app from list you can add WHERE clause to your sql). Commented Nov 29, 2013 at 16:47
  • +1 for great sleuthing. See AbsterT's answer for a working programmatic based on sudo sqlite3 .... ~/Library/Preferences/com.apple.universalaccessAuthWarning.plist is not involved in granting permissions, it only records whether a warning has been shown to avoid annoying users with repeated warnings.
    – mklement0
    Commented May 16, 2014 at 20:51
  • 2
    The ?? (\xfa\xde\x0c) value stems from the csreq column, which contains a fingerprint of sorts of the specified app; OSX manages that automatically behind the scenes - no need to ever specify it. The actual value is much longer; the truncation to 3 bytes comes from trying to output the binary value (data type BLOB) as if it were a string, causing output to stop at the first NUL byte (the ? stem from the \xfa and \xde not being valid characters in UTF8 encoding, \x0c is a vertical tab that effectively creates a line break).
    – mklement0
    Commented May 16, 2014 at 20:55
  • The csreq column contains the compiled designated requirements for the app, see goo.gl/z10vl and Apple’s TN2206 Code Signing in Depth guide. The designated requirements are essentially a script that validates an app’s identity by checking the bundle ID and certificates.
    – zoul
    Commented Mar 25, 2015 at 15:00
  • 1
    This technique seems to be used by Dropbox to add Accessibility entitlements without user involvement: applehelpwriter.com/2016/08/29/…
    – pkamb
    Commented Sep 9, 2016 at 17:55

You can also add the file by following the commands below.

This command will find the Bundle Identifier for the application you are trying to add to Assistive Devices.

/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' /Applications/enterapplicaitonnamehere.app/Contents/Info.plist

Let's say the application you were trying to add was SKYPE. You would then enter this below:

/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' /Applications/Skype.app/Contents/Info.plist

And your bundle identifier would be :


You then use this output in the command below:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "REPLACE INTO access VALUES('kTCCServiceAccessibility','',0,1,1,NULL);" 

For Skype it would look like this:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "REPLACE INTO access VALUES('kTCCServiceAccessibility','com.skype.skype',0,1,1,NULL);" 

To remove the application you would use the sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "delete from access where client='com.skype.skype';"

  • +1, but for robustness it is better to use REPLACE INTO instead of INSERT INTO so as to ensure that the command works even if the database already has an entry for the specified application.
    – mklement0
    Commented May 16, 2014 at 20:57
  • @mklement Would that add the application if the application did not already exist in the database?
    – AbsterT
    Commented May 19, 2014 at 18:58
  • Yes, it would (REPLACE INTO is an alias for the more descriptive INSERT OR REPLACE INTO).
    – mklement0
    Commented May 19, 2014 at 19:03
  • 1
    The REPLACE INTO is working perfectly and better than the INSERT INTO.
    – AbsterT
    Commented Jun 27, 2014 at 14:55
  • Does this method work for executable binaries that are inside a .prefpane Bundle?
    – jasonology
    Commented Dec 13, 2016 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .