Install Computer MCP for VS Code

The whole thing, in three steps

1. Register the server with VS Code.
2. Grant two macOS permissions. This is the step only you can do. Nothing works until it is done.
3. Restart VS Code and verify by asking the agent to call computer_permissions.

Step 1: Add the server to VS Code

VS Code can register it from the command line, which avoids editing JSON by hand:

code --add-mcp '{"name":"computer","command":"npx","args":["-y","@agent360/computer-mcp@latest"]}'

Or write it into mcp.json yourself - Command Palette, then MCP: Open User Configuration:

{
  "servers": {
    "computer": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@agent360/computer-mcp@latest"]
    }
  }
}

Step 1b: pick the mode before the first run

To start read-only:

code --add-mcp '{"name":"computer","command":"npx","args":["-y","@agent360/computer-mcp@latest"],"env":{"CMCP_MODE":"readonly"}}'

Step 2: grant two macOS permissions

Which app do you add? Whichever one the dialog names when it appears. macOS decides for itself which program a permission belongs to, and it is not always the one you would expect: if you started things from a terminal window it is usually the terminal, and if VS Code started it, it may be VS Code itself. No dialog at all? Start with the app you launched from, and check again.

Step 3: restart and verify

In VS Code, run MCP: List Servers from the Command Palette; computer should be listed. Then ask the agent in chat to call computer_permissions. It reports each permission separately, so a partial grant shows up as a partial grant rather than as a mysterious failure later.

Then ask for one screenshot. An image that comes back with both permissions granted is the real end-to-end proof that the install worked.

Now what: things worth actually saying

• "What is on my screen right now?": the plain read, with every password field already black.
• "Wait until the export finishes, then tell me.": computer_wait_for watches for the element instead of taking twenty screenshots. Twenty polls cost one call here and twenty images the other way.
• "Fill in the form in the window behind this one.": computer_set_value and computer_press work on a background window without moving your pointer, so you can keep working while it does.
• "Log in to this and tell me when you are in.": the agent puts the cursor in the field and calls computer_ask_user, which returns only true or false. You type the password on your own keyboard. There is deliberately no route through this server for a password to reach a model.
• "What did you do while I was away?": computer_audit reads back a log that only grows. Typed text is stored as a length and a scrambled fingerprint, never in clear.

What it deliberately will not do

No shell execution, no arbitrary file access, no URL fetching. Each would be a few lines of code. A computer-control server with a shell inside it is remote access under a friendlier name. If you want a shell, install a shell MCP server: then you have chosen it, and the choice is visible in your config.

Other clients

Same server, same three steps: Claude Code · Codex · Cursor · GitHub Copilot · Claude Desktop. Any other MCP client reads the same JSON block shown for Cursor. There is also an AI-assisted install guide written for an agent that is setting this up on your behalf.

FAQ

Related