Skip to content
Computer Use

Developer preview · v0.7.0

Let your AI agent use your apps. You stay in control

Computer Use is an open-source macOS and Windows app that gives the agent you already use screenshots and control of the windows you authorize. Copy one prompt and your agent installs the Skill and connects itself, or use MCP or the CLI. It works in the background by default. You approve once, and can pause, stop or revoke at any time

DownloadView on GitHub (opens in a new tab)
  • macOS 14+ · Apple Silicon
  • Windows 11 · ARM64 and x64
  • MIT license · no telemetry
Connects through
  • Skill
  • stdio MCP
  • Local HTTP MCP
  • CLI
Tested with
  • Codex
Built on
  • Cua Driver
  • Playwright
  • Model Context Protocol

What it does

Hands for your agent, rules set by you

  • See and operate real windows

    Window screenshots plus accessibility elements, then clicks, typing, hotkeys, scrolling and straight drags. What works depends on the platform, the app and the action

  • Background first

    Sessions use background delivery by default and never fall back to the foreground on their own; foreground has to be requested explicitly. The service starts on demand, and how well background delivery works depends on the app and the control

  • Bring your own agent

    Copy a setup prompt and your agent installs the Skill and connects itself, or wire it up over stdio MCP, optional loopback HTTP MCP or the standalone CLI. Your agent plans the task; Computer Use observes and acts within the scope you approve

  • Approve once, revoke any time

    One approval covers all desktop apps, or only the apps you list, including future windows, and survives restarts. Pause, emergency stop and revoke are always at hand

  • Outcomes you can trust

    Every action uses a fresh snapshot and a request ID. Results are recorded, uncertain ones are never replayed automatically, and “executed” is never mistaken for “verified”

  • A separate browser

    Playwright drives its own headless Chromium, with none of your everyday logins. You authorize it separately from desktop apps

How it works

From download to first action in four steps

  1. Install

    Open the DMG on macOS or run the installer on Windows. Computer Use lives in your menu bar or notification area

  2. Grant system access

    macOS asks for Accessibility and Screen Recording: allow both, then quit and reopen the app. Windows runs in your signed-in desktop session

  3. Connect your agent

    On the Connect page, copy the installation prompt and paste it into your agent. It fetches the Skill, installs it its own way and checks the connection. You approve the pairing in the app; Deny is the default button

  4. Let it work

    Your agent starts with a real observation of a window you authorized. Begin with a read-only task, then widen it as you build trust

Interface illustration with the app’s own wording. The app is currently available in Simplified Chinese and English
A safe first prompt
Use computer-use to check the connection, list authorized windows, open a session for the test window, capture and describe its screenshot, then close the session. Do not click or type during this task
Read the full setup guidePrefer to set it up by hand? See manual setup with the CLI and MCP

Control

You decide what it can touch, and for how long

Nothing can act until you approve it in the local app. After that, you can narrow, pause or withdraw access in a click

  • Explicit pairing

    An agent must be approved in the app before it can do anything. The dialog shows who is asking, which apps, whether the isolated browser is included and whether foreground control is allowed

  • Scoped and revocable

    Approve all desktop apps, including ones opened later, or only the apps you list. Revoke a client under Settings → Clients and its credential stops working immediately

  • Pause and emergency stop

    Pause blocks new actions. Emergency stop cancels work and shuts the execution layer down. Both survive quitting, reopening, login and updates, and neither an agent nor an automatic start can clear them

  • Local by design

    A private socket or pipe for your user, HTTP off by default and bound to 127.0.0.1, and no telemetry

  • Metadata-only records

    The action journal keeps IDs, types and outcomes, never screenshots, typed text, URLs or window titles. Password field values are never returned

  • Read the full security and privacy details
Interface illustration with the app’s own wording. The app is currently available in Simplified Chinese and English

Reliability

A missed click is never silently repeated

Agents work with stale screens and flaky connections. Computer Use is built to be honest about what actually happened

  • Fresh snapshots

    Each action consumes a snapshot taken moments earlier. If the window changed since, the action is rejected instead of guessed

  • Request IDs and de-duplication

    Sending the same request again returns the known result instead of acting twice

  • Executed is not verified

    Verified means an explicit, observable condition passed, such as a field now holding the expected text. It does not mean the whole task worked

  • Unknown stays unknown

    If delivery itself is uncertain, the action is marked unknown, desktop execution stops until you restart it, and nothing is replayed afterwards

Action lifecycle

  1. queued

    Waiting its turn

  2. running

    Being delivered

  3. executed

    Input was delivered

  4. verified

    Your condition passed

unknown

Delivery uncertain, never replayed

Platforms

Honest about what has been tested

Computer Use is a development preview. This is what has been exercised on real systems, and what has not

  • macOS · Apple Silicon

    macOS 14 or later, menu-bar app

    Tested

    The installed build passed all-app pairing, background input across apps and new windows, pause, emergency stop, restart and revocation

  • Windows 11 · ARM64

    Installer or portable, tray app

    Tested

    Passed 7 background input rounds across two fixtures and three windows in one virtual machine, plus authorization controls

  • Windows 11 · x64

    Installer or portable, tray app

    Not yet validated

    A separate build that passed component checks under x64 emulation on ARM64. Native x64 desktops have not been validated yet

  • Windows 10 (1809 or later)

    Compatibility target

    Targeted, untested

    The installer allows it, but nothing has been tested on a real Windows 10 system

  • macOS Intel · Linux

    No host package

    Not available

    Not provided by this project today

Windows installers and portable packages are not code-signed yet, so SmartScreen or Smart App Control may warn or block them. macOS builds are signed with a Developer ID and notarized by the release workflow

The one-prompt setup has had only limited checks: the Connect page, macOS cold start, and pause and emergency stop across exit. A clean machine going from download to first observation, and Skill installation by agents other than Codex, are not tested yet

Elevated Windows apps, the UAC secure desktop, and long text in canvases or terminals are outside the validated range

Try it on a disposable document before pointing an agent at anything that matters

Validation record (Chinese) (opens in a new tab)

For agents

Speaks the protocol your agent already knows

Start with the setup prompt: your agent installs a Skill that drives the CLI. If you prefer MCP, the same ten tools are available over stdio MCP and optional loopback HTTP MCP. Tested with Codex; installation by other agents is still untested

Your computer

Your agent

Plans the task

stdio MCP · HTTP (loopback) · CLI

Computer Use

Approval, sessions, snapshots, action journal

Cua Driver · Playwright

Authorized windows

Or the isolated browser

config.toml
[mcp_servers.computer-use]
command = "/Applications/Computer Use.app/Contents/Resources/bin/node"
args = ["/Applications/Computer Use.app/Contents/Resources/runtime/cli.js", "mcp", "stdio", "--profile", "default"]

Printed by computer-use config codex. Paste it into ~/.codex/config.toml

The ten tools

capabilities
List capabilities and limits
doctor
Check runtime, permissions and browser
targets
List authorized windows and pages
session_open
Bind a session to a target
session_close
Release a session and its screenshots
observe
Screenshot plus accessibility elements
act
Click, type, hotkey, scroll or drag
wait
Wait for an observable condition
action_status
Look up a previous request
cancel
Cancel a queued or active request

Open source

Open source, built on solid parts

Computer Use is MIT licensed. Cua Driver supplies desktop capture, accessibility and input, Playwright drives the isolated browser, and the official MCP TypeScript SDK handles transport. This project adds the hosts, authorization, sessions and snapshots, de-duplication and outcome records, CLI and MCP integration, backend adapters and packaging

Source on GitHub (opens in a new tab)MIT license (opens in a new tab)Third-party notices (opens in a new tab)Report an issue (opens in a new tab)

FAQ

Questions, answered plainly

What is Computer Use?

A local host app for macOS and Windows. It lets an AI agent you already use see and operate the windows you authorize, through a Skill, MCP or a CLI. It is not an agent itself: it does not plan or decide tasks

Which agents does it work with?

Any agent that can read a Skill, speak stdio MCP or call the CLI. It has been tested with Codex; Skill installation by other agents is still untested

Do I need Node.js or the source code?

No. The app brings its own runtime and CLI, and the setup prompt needs no repository clone or global Node. Node.js 22+ is only needed if you choose the optional npm launcher

Do I have to start it myself?

No. In a complete install, your agent’s first real CLI or stdio MCP call starts the background service. Starting never clears a pause or emergency stop, and it cannot get past system permission prompts or Windows SmartScreen

Will it take over my mouse and keyboard?

Not by default. Sessions run in background mode, and foreground control is used only when the agent explicitly asks for it, which pairing already allows. Background support depends on the control, so zero focus changes is not guaranteed

What can it see?

Only windows of the apps you authorize, captured as per-window snapshots together with their accessibility elements. macOS also requires you to grant Accessibility and Screen Recording. If you use a cloud agent, the screenshots it requests are processed by that model provider

How do I stop it?

Use Pause, Emergency Stop or Revoke from the menu bar or tray and the Settings window. Quitting the app stops everything

Does it send my data anywhere?

There is no telemetry. It runs locally, logs only metadata, and its daily update check reads public release information from GitHub without sending usage data. The exception is whatever your own agent sends to its model provider

Is the isolated browser my normal browser?

No. It is a separate headless Chromium driven by Playwright, with none of your everyday logins. Browser windows on your desktop are ordinary app windows and fall under your app scope

Why does Windows warn me about the installer?

Windows installers and portable packages are not code-signed yet, so SmartScreen or Smart App Control may warn or block them. Check the SHA-256 on the download page and follow your own or your organization’s policy

Is it free?

Yes. Computer Use is open source under the MIT license

Can I use it on an Intel Mac or Linux?

Not today. There is no host package for Intel Macs or Linux

Start with a disposable document

Give your agent a read-only task first, then let it type and click in a test document. Widen its scope only once you trust the results

DownloadRead the setup guide