computer-use-mcp

Why it's ranked here

Desktop control is the hard, platform-specific part of computer use, and this ships it for three operating systems on both Intel and ARM as one npm install with prebuilt native binaries, no Rust toolchain needed. MIT licensed. The security design is unusually explicit for the category: approvals are one-shot and bound to the exact call, the bundled HTTP listener refuses non-loopback binds, file access can be fenced to allowed folders, and logs exclude arguments, screenshots and clipboard data. The documentation is candid about residual risk, which is what anyone handing a model their mouse should want to read first.

What's good

The guardrails are specific and bounded. An approval signed for one call cannot approve another, expires after ten minutes, and the server never holds more than 4,096 outstanding. Waits cap at 300 seconds, file reads at 1 MiB, directory listings at 1,000 entries. Mutating actions take a cross-process lock so two agents cannot fight over the cursor, while read-only calls stay concurrent. A native emergency stop latches off every mutation until the host resets it. Operators can allow or block target apps by name and require approval for chosen operations. Newer and older MCP clients are both supported, and the core protocol libraries are pinned to an exact version.

Tradeoffs

Leave the profile unset and you get every tool, including process kill, registry edits and script execution; an unrecognised profile name also falls back to that full set rather than failing. The project's own security notes say that without a folder allow-list and a client that reports allowed folders, the filesystem tool can reach any path the process can. The documentation has drifted: the architecture guide describes version 7.2 and says it serves no interactive UI, while the package is 7.4 and ships a run console app. Tool counts disagree across files. The Linux native layer builds against X11 libraries, so test Wayland before relying on it.

How to use it well

Fits a developer building an agent that has to drive desktop software with no API: Office documents, design tools, legacy line-of-business apps. Start with the smaller core profile and widen it only as a task demands. Set a folder allow-list and an allowed-apps list before the first run, and turn on approval for destructive operations. Always name the target app or window, since coordinate clicks land on whatever is in front. Keep web browsing and desktop control in separate sessions; the project itself flags that mixing them opens a prompt-injection path. For work reachable through an API or plain files, skip the desktop entirely.

Observed

License

MIT (LICENSE, package.json)

Language

TypeScript server with a Rust native module via N-API

Packaging

npm package with prebuilt native binaries for macOS, Windows and Linux on x64 and arm64

Runtime requirement

Node.js 20 or newer, interactive desktop session

Interfaces

MCP over stdio, loopback-only Streamable HTTP, in-process JavaScript client, run console host

Default tool profile

full, when COMPUTER_USE_PROFILE is unset or unrecognised (src/tool-catalog.ts)

Filesystem limits

1 MiB per file read, 1,000 entries per directory listing (SECURITY.md)

Approval model

One-shot, HMAC-signed request state bound to method, client, tool and arguments, ten-minute expiry

Linux input backend

X11 with XTest (native/Cargo.toml)

Documentation drift

Architecture guide describes version 7.2 while package.json declares 7.4.0