computerMCPCAUTION
Your agent uses your Mac like you do. A macOS MCP server that works in the windows behind yours: password fields blacked out before a screenshot exists, deleting and sending wait for your yes, password managers are refused, every call is logged. Free, local, MIT.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Computer use you can actually leave running.
A macOS computer-use MCP server built for the part everyone skips: what happens in the hours you are not watching.
- It does not take over your Mac. It presses buttons and fills fields in
windows that stay behind the one you are in, and it leaves your pointer where you put it. Nothing gets minimised, nothing comes to the front, nothing steals what you are typing.
- It does not pretend. When something is refused or fails, it says so and
says why. The most common complaint about agents driving a computer is that they carry on as if it worked.
- Several can run at once. No session lock, no one-at-a-time limit. Writes
to the shared log take a short file lock, so two servers cannot break the chain between them.
- It will not go near your passwords. Keychain, 1Password and seven others
ask every time, in every mode, and password fields are blacked out while the screenshot is still in memory. A screen recording leaves password managers out, but does not black out password fields.
- You can read back what it did. Every call lands in an append-only log,
fingerprinted rather than stored in clear.
- Electron apps are not a blind spot. Slack, VS Code, Discord and Notion
build their accessibility tree lazily, so most tools find an empty window. This one switches the tree on itself before it looks. Measured on a VS Code fork with two windows open: 0 buttons before, 728 after, same windows, same moment. CMCP_INGEN_ELECTRON=1 turns it off if you would rather the app did not pay for keeping a tree it otherwise would not build.
Honest limits: macOS only. It reads the accessibility tree, so an app that draws its own controls on a canvas and publishes nothing - some games, some plotting tools -
1a3703a64eadOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add computer-mcp -- npx -y @agent360/[email protected]
Trust audit
CAUTIONgrade B · trust 82/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (16)
const SECRET = 'KLARTEKST-MAA-ALDRIG-LOGGES-9f3a';
const SECRET = 'KODEORD-MAA-ALDRIG-I-ARGV-9f3a';
<span class="f01-tok">ghp_4bQ7xR2mNvKp8sLdT1yWzE6aJ0cHfU3iO9</span>
.nojekyll
const sti = slaaOp('../../../System/Applications/Calculator');@modelcontextprotocol/sdk
<tr><td>Several agents at once</td><td><span class="k m">measured</span></td><td>Each MCP client runs its own server. Measured: two servers, 50 interleaved writes, <strong>zero torn lines</strong>, an
<details><summary>Does Computer MCP send anything to Agent360?</summary><p>No. There is no account, no API key, no licence check, no telemetry and no update ping. The server makes no network calls of
<p>Each MCP client starts its own server, so a second chat is simply a second process. They share one audit log, and every line carries a per-server <code>session</code> mark. Set <code>CMCP_CLIENT</c
docs/demo.mp4
of apps whose windows are always hidden: Keychain Access, 1Password, Bitwarden,
<li>Open a sign-in page with a password field and type a few characters into it.</li>
<tr><td>Password managers, in the tree as well as the image</td><td><span class="k m">measured</span></td><td>Screenshots black out Keychain Access, Apple Passwords, 1Password, Bitwarden, LastPass and
<li><em>"What is on my screen right now?"</em>: the plain read, with every password
<li><em>"What is on my screen right now?"</em>: the plain read, with every password
Gates applied: no_behavioural_pass.
1a3703a64eadfull audit observations/trust-audit/mcp-server/agent360dk__computermcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 1a3703a64ead | CAUTION | B | 82 | first audit |
Questions
What is the computerMCP MCP server?
Your agent uses your Mac like you do. A macOS MCP server that works in the windows behind yours: password fields blacked out before a screenshot exists, deleting and sending wait for your yes, password managers are refused, every call is logged. Free, local, MIT.
Is computerMCP safe to connect to an agent?
With care. The audit graded it B (82/100) and found 16 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does computerMCP need?
No credential environment variables were found in its source, so it appears to need none.
How does computerMCP run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as computermcp-promo at 0.2.1.
How current is this page?
The grade is for one exact copy of the source (1a3703a64ead), read on 2026-10-11. The repository is watched and re-audited when it changes.