Computer MCP

Your agent uses your Mac like you do.

Free and local. Ten agents can work in the windows behind yours while you keep typing.

claude mcp add computer -- npx -y @agent360/computer-mcp
View on GitHub

MIT-licensed. macOS 14 or later, tested on 15. No account, no server of ours.

Drawn by us as stand-ins. The tests check window titles and on-screen text, not pictures.

All 19 jobs and what passed

Proven: the test passed with the app behind your windows. Partly: it found the window or hit a limit. Not tested yet: it needs your WhatsApp account or a named person.

  • ◐Open Chrome: partly (read on our own Mac; the test machine could not open Chrome)
  • ✓Open Settings: proven
  • ◐Download an app: partly (tried: the App Store only responds when it is in front)
  • ✓Play chess: proven
  • ✓Open Netflix: proven
  • ◐Change the wallpaper: partly (choosing a picture needs a real click)
  • ◐Open WhatsApp: partly (read on our own Mac)
  • ○Write in WhatsApp: not tested yet (needs your WhatsApp account (a draft was measured once))
  • ◐Create a contact: partly (New Card is greyed out behind another window)
  • ○Write to people: not tested yet (needs a named person)
  • ○Create a group: not tested yet (needs a named person)
  • ◐Open the code editor: partly (read on our own Mac)
  • ◐Open Activity Monitor: partly (the window opens, but its list can’t be read while the app is hidden)
  • ✓Use the Calculator: proven
  • ◐Find a file in Finder: partly (found the file, but the app came forward twice and was handed back)
  • ✓Maps with an address: proven
  • ✓Open Notes: proven
  • ◐Open Spotify: partly (opens on our own Mac, may have come forward by itself)
  • ✓Open the camera: proven
Works with the client you already use

Every change is built and tested on a Mac on GitHub before it can land. See the runs.

Ten agents at once, recorded

Not a drawing: a real run on GitHub’s Mac, where a test kept typing in front while ten agents worked in the apps behind it.

A text editor in front with ten agents working in the apps behind it
Real recording, sped up 2×. Ten agents at once on GitHub’s Mac (2 Oct), behind a window where a test kept typing: 165 of 165 typed words landed. Twice, Finder came forward for a moment, and the screen went straight back. The test does the typing, not a person.

Where no API reaches

Your agent already gets into most tools through an API. These four only have a window.

Your chats

WhatsApp has no API for your own messages. It can leave a reply as a draft in the message box (measured once on our Mac). Sending stays yours.

set_value: draft verified once

The app you are building

It clicks through your app the way a tester would, in a window behind yours, and reports what it can see.

pressable: 73 of 73 buttons in one app

What only lives in a menu

Much of macOS has no button at all. It reads every menu item and its shortcut, then picks the one it needs.

menu File › Export as…

The tool at work

The internal or old desktop app nobody wrote an API for. If VoiceOver can read it, so can your agent.

Electron: 0 buttons before, 728 after the tree is switched on

Why it is safe to leave running

Keep working while it works

It acts in windows behind yours and leaves your pointer where you put it.

took_screen: false

No silent failures

When a step fails or is ambiguous, it says so and why.

error: found 3 matches - narrow the search

Your passwords stay yours

Password boxes are blacked out before a screenshot exists. Keychain, 1Password and five other password managers are refused: the menu bar cannot approve them.

1Password: denied

A log you can read back

Every call is written down, typed text only as a fingerprint. Run several agents; the log says which did what.

session 3e6f9a44, client cursor

Stop every agent at once

Stop all agents now in the menu bar icon, or ⌃⌥⌘. from any app when the menu shows it. Nothing waiting is carried out, and for two minutes nothing that writes goes through.

every agent: Stopped

Lend it the screen, take it back

When a step needs the real pointer, the agent asks to borrow your screen for up to fifteen minutes. You confirm with Touch ID, each step waits while you use the mouse or keyboard, and you take it back from the box or the menu bar.

lend the screen: 10 min, Touch ID

32 tools: 14 that look, 18 that touch. No shell, no file access, no web fetching, on purpose. See every tool.

Install in two minutes

What you get today, honestly. npx @agent360/computer-mcp currently serves 0.1.0, which has 12 tools. The 32 tools described here are the source: they are built and tested, but not published yet. Building from source takes about thirty-five seconds if you want them now.

  1. Add it to your client

    claude mcp add computer -- npx -y @agent360/computer-mcp

    Cursor and VS Code: one line in mcp.json. Codex: one command.

  2. Allow two permissions

    System Settings › Privacy & Security › Accessibility and Screen Recording.

  3. Ask what it can see

    Have your agent run computer_permissions. It tells you what is missing.

Want to look before it can touch? Start it with CMCP_MODE=readonly. No tool takes your screen by default; CMCP_BACKGROUND=0 adds the seven that do. An app that pulls itself forward is handed back, and the reply says so. Guides: Claude Code, Codex, Cursor, Copilot, Claude Desktop, VS Code.

The three gates

In the order they run. The security model explains each one, including what it does not protect you from.

Gate 1: a secure field painted black in memory before the screenshot is written. Gate 2: the menu bar icon turns orange and asks before a file goes to the Trash; password managers are refused. Gate 3: a log line where typed text is a length and a salted fingerprint.

Honest limits

Questions

What is an MCP server?

A small program that hands your AI assistant a set of tools. You install it once, and your assistant can do things it could not before. This one hands it your Mac. It runs on your own machine, and your assistant keeps talking to whichever AI you already pay for.

Does anything leave my machine?

No. There is no account, no telemetry and no server of ours involved. Screenshots go to the MCP client you configured, the same place the rest of your conversation goes, and nowhere else. The same rule holds for this website: no analytics, no cookies, no third-party requests. The only <script> tag on the site is application/ld+json structured data, which your browser does not execute. View source and check.

Does it ask me before it does things?

Not for ordinary work: it acts, and every call lands in the log. A few things never happen without a person saying yes: your password manager, anything that deletes or clears, sending a message in the chat and mail apps it recognises, and starting a screen recording. In the default mode they wait in the menu bar icon, which turns orange; a password manager cannot be approved there, so it is refused. If nobody answers, the answer is no.

How is this different from the other macOS MCP servers?

Capability-wise, not enormously: screenshots, clicks, keystrokes, the accessibility tree. The difference is what happens in the hours you are not watching. It works in windows behind the one you are in and leaves your pointer where you put it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. And it will not go near your password manager.

Does it work in Claude Code’s auto mode?

Partly. Auto mode judges every call on its own, so expect some refusals. The tools that take the screen are refused: measured on 1 October, auto mode turned them down even after the person had lent the screen with Touch ID. That is the client’s own guard, not this server’s, and it is right to be careful. To use them, run the session without auto mode and approve each call when Claude Code asks; the gates in this server still apply on top.

Go deeper

Guides, the full tool reference and what we measured. Every page below is written against the code it describes.

Use casesLeaving an AI agent running on your Mac overnightWhat makes a long unattended run survivable: password fields blacked out before the screenshot is written, password… Use casesLet an agent work while you keep using your MacSeven of the thirty-two tools act on a background window without moving your pointer: press an element by its own… LearnWhat is a computer-use MCP server?How computer-use MCP servers actually work on macOS - the accessibility tree versus pixels versus a shell, five… LearnMCP security: what a server can reach, and how to bound itWritten while shipping a computer-use MCP server. Every control below is one we had to implement, and each has a… LearnThe OWASP MCP Top 10, answered with running codeAll ten OWASP MCP risk categories, and what one macOS computer-use server actually does about each - including the… ReferenceTool referenceEvery tool Computer MCP exposes: what it does, what it takes, and when to reach for it instead of the obvious one. ReferenceWhat it can and cannot do"Can an agent do everything a human can on a Mac?" is not a yes or a no. ReferenceSecurity modelWhat this defends against, how each gate actually works, and - the part most pages skip - what it does not protect… ReferenceWhen NOT to use Computer MCPIt is not a sandbox, it needs a Mac with a logged-in screen session, it is macOS only, and for anything in a browser… ReferenceTroubleshootingEvery failure on this page is one we hit ourselves building the thing. ReferenceUninstalling Computer MCP, and exactly what data it touchesThree steps to remove it, its state folder and the other local data it writes, what each macOS permission is for,… ReferencePrivacyThis page is short because there is very little to say. Computer MCP has no account, no API key, no telemetry and no… WritingYour agent's screenshot tool is reading your passwordsIf you have given an AI agent a screenshot tool on the Mac you actually work on, it has almost certainly seen… WritingDriving macOS from an AI agent: what actually worksFive findings from building a macOS computer-use server. Each one cost real time to learn, and each one looks like a…

Give it a look before you give it your hands.

Start it read-only and ask your agent what it can see. Two minutes.

claude mcp add computer -e CMCP_MODE=readonly -- npx -y @agent360/computer-mcp
Get it on GitHub Read the security model