Computer MCP / Install / GitHub Copilot

Install Computer MCP for GitHub Copilot

Three steps, about two minutes. Copilot in VS Code drives your real Mac with password fields blacked out before any screenshot is written, and a consent gate on every write.

The whole thing, in three steps

1. Register the server with GitHub Copilot.
2. Grant two macOS permissions. This is the step only you can do. Nothing works until it is done.
3. Restart GitHub Copilot and verify by asking the agent to call computer_permissions.

Step 1: Add the server to Copilot

Copilot reads MCP servers from .vscode/mcp.json in your project, or from your user settings for every project. Note the shape: Copilot uses servers, not mcpServers, and each entry names its transport.

{
  "servers": {
    "computer": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@agent360/computer-mcp@latest"]
    }
  }
}

That one difference is the most common reason a server that works everywhere else stays invisible in Copilot.

Step 1b: pick the mode before the first run

To start read-only:

{
  "servers": {
    "computer": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@agent360/computer-mcp@latest"],
      "env": { "CMCP_MODE": "readonly" }
    }
  }
}

Step 2: grant two macOS permissions

Which app do you add? Whichever one the dialog names when it appears. macOS decides for itself which program a permission belongs to, and it is not always the one you would expect: if you started things from a terminal window it is usually the terminal, and if Copilot started it, it may be Copilot itself. No dialog at all? Start with the app you launched from, and check again.

Step 3: restart and verify

Run codex mcp list. The server should appear. Then start GitHub Copilot and ask it to call computer_permissions. It reports each permission separately, so a partial grant shows up as a partial grant rather than as a mysterious failure later.

Then ask for one screenshot. An image that comes back with both permissions granted is the real end-to-end proof that the install worked.

Now what: things worth actually saying

• "What is on my screen right now?": the plain read, with every password field already black.
• "Wait until the export finishes, then tell me.": computer_wait_for watches for the element instead of taking twenty screenshots. Twenty polls cost one call here and twenty images the other way.
• "Fill in the form in the window behind this one.": computer_set_value and computer_press work on a background window without moving your pointer, so you can keep working while it does.
• "Log in to this and tell me when you are in.": the agent puts the cursor in the field and calls computer_ask_user, which returns only true or false. You type the password on your own keyboard. There is deliberately no route through this server for a password to reach a model.
• "What did you do while I was away?": computer_audit reads back a log that only grows. Typed text is stored as a length and a scrambled fingerprint, never in clear.

What it deliberately will not do

No shell execution, no arbitrary file access, no URL fetching. Each would be a few lines of code. A computer-control server with a shell inside it is remote access under a friendlier name. If you want a shell, install a shell MCP server: then you have chosen it, and the choice is visible in your config.

Other clients

Same server, same three steps: Claude Code · Codex · Cursor · Claude Desktop · VS Code. Any other MCP client reads the same JSON block shown for Cursor. There is also an AI-assisted install guide written for an agent that is setting this up on your behalf.

Other clients

Same server, same three steps: Claude Desktop · VS Code · Claude Code · Codex · Cursor. There is also an AI-assisted install guide written for an agent setting this up on your behalf.

FAQ

Related