Computer MCP / Install / Claude Desktop

Install Computer MCP for Claude Desktop

Three steps, about two minutes. Claude Desktop drives your real Mac with password fields blacked out before any screenshot is written, and a consent gate on every write.

The whole thing, in three steps

1. Register the server with Claude Desktop.
2. Grant two macOS permissions. This is the step only you can do. Nothing works until it is done.
3. Restart Claude Desktop and verify by asking the agent to call computer_permissions.

Step 1: Add the server to Claude Desktop

Claude Desktop keeps its MCP servers in one file. On macOS it is here:

~/Library/Application Support/Claude/claude_desktop_config.json

Open it from the app instead of hunting for it: Settings → Developer → Edit Config. Add the server inside mcpServers, creating that key if the file does not have one yet:

{
  "mcpServers": {
    "computer": {
      "command": "npx",
      "args": ["-y", "@agent360/computer-mcp@latest"]
    }
  }
}

Claude Desktop only reads this file at launch. Quit it properly with Cmd+Q and open it again: closing the window is not enough, and a server that will not appear is almost always this.

Step 1b: pick the mode before the first run

To start read-only:

{
  "mcpServers": {
    "computer": {
      "command": "npx",
      "args": ["-y", "@agent360/computer-mcp@latest"],
      "env": { "CMCP_MODE": "readonly" }
    }
  }
}

Step 2: grant two macOS permissions

Which app do you add? Whichever one the dialog names when it appears. macOS decides for itself which program a permission belongs to, and it is not always the one you would expect: if you started things from a terminal window it is usually the terminal, and if Claude Desktop started it, it may be Claude Desktop itself. No dialog at all? Start with the app you launched from, and check again.

Step 3: restart and verify

Run codex mcp list. The server should appear. Then start Claude Desktop and ask it to call computer_permissions. It reports each permission separately, so a partial grant shows up as a partial grant rather than as a mysterious failure later.

Then ask for one screenshot. An image that comes back with both permissions granted is the real end-to-end proof that the install worked.

Now what: things worth actually saying

• "What is on my screen right now?": the plain read, with every password field already black.
• "Wait until the export finishes, then tell me.": computer_wait_for watches for the element instead of taking twenty screenshots. Twenty polls cost one call here and twenty images the other way.
• "Fill in the form in the window behind this one.": computer_set_value and computer_press work on a background window without moving your pointer, so you can keep working while it does.
• "Log in to this and tell me when you are in.": the agent puts the cursor in the field and calls computer_ask_user, which returns only true or false. You type the password on your own keyboard. There is deliberately no route through this server for a password to reach a model.
• "What did you do while I was away?": computer_audit reads back a log that only grows. Typed text is stored as a length and a scrambled fingerprint, never in clear.

What it deliberately will not do

No shell execution, no arbitrary file access, no URL fetching. Each would be a few lines of code. A computer-control server with a shell inside it is remote access under a friendlier name. If you want a shell, install a shell MCP server: then you have chosen it, and the choice is visible in your config.

Other clients

Same server, same three steps: Claude Code · Codex · Cursor · GitHub Copilot · VS Code. Any other MCP client reads the same JSON block shown for Cursor. There is also an AI-assisted install guide written for an agent that is setting this up on your behalf.

Other clients

Same server, same three steps: GitHub Copilot · VS Code · Claude Code · Codex · Cursor. There is also an AI-assisted install guide written for an agent setting this up on your behalf.

FAQ

Related