Computer MCP

macOS · MIT · no account, no API key

Computer use you canactually leave running.

It works in the windows behind the one you are using, and leaves your pointer where you put it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. Hand it a task, go back to your own work, and read the log when you feel like it.

npx @agent360/computer-mcp

It works without asking, and it stays out of your way while it does. Works with the model you already pay for.
No Swift needed: the package ships a universal binary for Apple silicon and Intel. It carries the ad-hoc signature macOS needs to run it at all - not a Developer ID signature, and not notarized.

New to this? You install it once, and your assistant gets abilities it did not have before. That is all an "MCP server" is: a small program that hands your assistant a set of tools. This one hands it your Mac.

It runs on your own machine. There is no account to make, no key to paste, and nothing is sent to us - your assistant keeps talking to whichever AI you already pay for.

Twenty-seven seconds, no sound, and you can pause it. Every line in the log is a line the server actually writes.

---

It does not have to take over your screen

Coordinate clicking moves your real pointer and lands wherever the keyboard focus is. That is fine while you are watching it. It is not fine while you are working in another window.

Press, don’t click

computer_press fires the element’s own accessibility action instead of simulating a click. It works while the window sits behind another one, and it moves nothing on your screen. Two or more matches is a refusal, not a guess.

One log, several agents

Each MCP client runs its own server, so a second chat is a second process. Every audit line carries a per-server session mark, and CMCP_CLIENT puts a name on it - so the log says which conversation did it.

Two things still come forward

In the default mode nothing asks, so nothing comes forward. The two things that still do - your password manager and anything that deletes or clears - raise a real macOS dialog that takes focus, and that is the point of those two. A prompt nobody answers refuses the action rather than allowing it, so walking away is safe.

The long versions, with the failure modes: working while you keep using your Mac and leaving it running overnight.

Install

What you get today, honestly. npx @agent360/computer-mcp currently serves 0.1.0, which has 12 tools. The 28 tools described here are the source: they are built and tested, but not published yet. Building from source takes about thirty-five seconds if you want them now.

Add it to your MCP client, grant two macOS permissions, done. It starts ready to work: twenty of the twenty-eight, no asking, except your password manager and anything that deletes or clears. It runs in the background by default, so nothing takes your screen; CMCP_BACKGROUND=0 adds the nine that do.

Claude Code	claude mcp add computer -- npx -y @agent360/computer-mcp
Cursor / VS Code / Codex	In mcp.json: {"command":"npx","args":["-y","@agent360/computer-mcp"]}
From source	Only if you want to change it: git clone, then swift build -c release in helper/. About thirty-five seconds from scratch, no dependencies to fetch.
Permissions	System Settings → Privacy & Security → Accessibility and Screen Recording, for the app running the server. Ask the agent to call computer_permissions and it will tell you what is missing.

Step by step, with the permissions part spelled out and the questions people actually ask: Claude Code · Codex · Cursor · GitHub Copilot · Claude Desktop · VS Code. If an agent is setting this up for you, point it at llms-install.md.

Two pages we would rather you read before you install than after: when this is the wrong tool, and how to remove it and exactly what it touches.

Three modes, set with CMCP_MODE:

readonly	The write tools are not even listed. The agent can see your Mac and cannot touch it. Good for research and for the first hour.
ask	One consent dialog per session in front of the first write; after that it works. Password managers and anything that deletes still ask every time.
allow	Default. Writes go through without asking, all of them logged. Password managers and anything that deletes or clears still ask - those two are not configurable, on purpose.

What you can actually ask it to do

Not a feature list. These are things people ask for, and what happens.

You say	What it does
"What's on my screen right now?"	Takes a picture and reads it. Any password box in it is painted black before the picture exists as a file.
"Fill in this form for me."	Finds the fields by name rather than guessing at pixels, and types into them. It can do that in a window sitting behind the one you are using, without taking your cursor.
"Export this, then tell me when it's done."	Picks File → Export from the menu - a lot of what a Mac can do has no button at all, only a menu - then waits for the result instead of taking a hundred screenshots while it waits.
"Log in to this and carry on."	It puts the cursor in the password box and asks you to type. It never sees what you typed. There is deliberately no way to hand it a password.
"What did you do while I was out?"	Reads back the log it kept: every action, in order, with the app it happened in. What you typed is never stored as readable text.

If none of that is your problem, that is a fine answer too. When not to use it names the cases where something else is better, including our own browser tool for anything inside a web page.

---

Three barriers, on by default

Each one is a behaviour you can check yourself, not a promise in a README. The test that proves each is in the repo, and each test has been mutation-tested: break the code and the test goes red.

Passwords never reach the model

Secure text fields and password-manager windows are painted out while the image is still in memory - before it is ever written to disk. There is no moment where an unredacted screenshot of your desktop exists as a file for something else to read.

Nothing clicks until you say yes

The first write action opens a real macOS dialog naming what is about to happen. Password managers and terminals ask every single time, even after you have approved the session. If nobody answers, the answer is no.

Everything is written down

A log that only grows records every call, what it targeted, and whether it was allowed or refused. Typed text is stored as a length and a salted fingerprint, never in clear text - an audit trail full of passwords is its own breach, and without that random ingredient, a short password can be guessed offline.

No API key, no second bill

There is no model inside this server. The one driving your agent does the seeing and the thinking; Computer MCP only supplies hands. Nothing is sent to us, because there is no us to send it to.

twenty-eight tools

twelve that look, sixteen that touch. Grouped by what you would actually want, with the names underneath in case you are wiring this up yourself.

So it can...	What that means
See what is there screenshot · inspect · find · focused	Take a picture, or read the screen as a list of things with names - a button called "Export", a field called "Email". Reading the list beats reading pixels: it knows what a thing is, not just what it looks like.
Use your apps click · type · press · menu · set_value · paste	Click, type, choose from menus. Several of these reach a window sitting behind the one you are using and never move your cursor, so you can keep working.
Manage windows and apps window · launch · quit · activate · apps · windows · displays	Open an app, bring it forward, move a window to another screen, close it. On a Mac with more than one screen it will tell you which one it is looking at - a window you cannot find is usually just on another.
Wait, instead of guessing wait_for	Wait until something appears, then carry on. The alternative is taking a hundred screenshots of a progress bar, and you pay for every one of them.
Ask you ask_user	When it hits a password or a code from your phone, it puts the cursor in the box and asks you to type. It gets back "done" or "cancelled" - never the text.
Show its work audit · permissions	Read back everything it did, in order. What you typed is stored as a fingerprint, never as readable text.

And note what is missing. There is no "run a command", no "open any file", no "fetch a web page". Each would have been a few lines of code. A tool that can run commands on your Mac is remote access with a friendlier name, and if you want that you should choose it on purpose rather than find it in a list later.

Every tool in detail, including which one to reach for when the obvious one is the wrong one.

What it does not do

Being straight about the edges is cheaper than being found out at them.

macOS only	It is built on the macOS Accessibility and ScreenCaptureKit APIs. There is no Windows or Linux build and none is planned.
Redaction covers marked fields	We black out what macOS marks as secure, plus password-manager windows you can extend. A password sitting in a plain text editor is not marked secure, and we will not pretend to find it. Use readonly when the screen holds something we cannot know about.
Consent is not a sandbox	Once you approve a session, the agent can drive your real Mac. That is the point. If you need containment rather than consent, run it in a VM - and we would say so before you asked.
Prompt injection is still real	A web page can try to talk your agent into doing something. The dialogs and the audit log are what turn that from silent into visible. They do not make it impossible.

Questions

Does anything leave my machine?

No. There is no account, no telemetry and no server of ours involved. Screenshots go to the MCP client you configured - the same place the rest of your conversation goes - and nowhere else.

The same rule holds for this website: no analytics, no cookies, no third-party requests. The only <script> tag anywhere on the site is application/ld+json structured data, which your browser does not execute - never a program. View source and check.

How is this different from the other macOS MCP servers?

Capability-wise, not enormously - screenshots, clicks, keystrokes, the accessibility tree. The difference is what happens in the hours you are not watching. It works in windows behind the one you are in and leaves your pointer where you put it, so it does not take over the machine while you use it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. And it will not go near your password manager. If you only ever watch it work, most of that is wasted on you.

Why is the audit log fingerprinted instead of plain?

Because a complete record of every keystroke is exactly the file an attacker would want. The fingerprint proves two actions typed the same thing without ever storing what it was. It is scrambled with a random ingredient that only exists while it runs - a fingerprint without that random ingredient, of an eight-character password, is guessable offline, which would have made the log the very thing this promise is against. The cost is honest: comparison works within a run, not across runs.

Can I turn the redaction off?

Yes - redact: false on a single screenshot. It is per call and never sticky, and the result says plainly that the image was not redacted.

Does it ask me before it does things?

Not for ordinary work - it acts, and every call lands in the log. Two things still ask, every time and in every mode: your password manager, and anything that deletes or clears. If you would rather be asked once up front, CMCP_MODE=ask puts one session-granting dialog in front of the first write, and ignoring it refuses the action rather than allowing it.

Help build it

It is three days old and MIT. Bug reports, an app that behaves oddly, a tool that should exist: open an issue. How to contribute.

Give it a look before you give it your hands.

Install it in read-only mode and ask your agent what it can see. That takes two minutes and tells you more than this page can.

Get it on GitHub Read the security model