Atlas / MCP servers / bigduu / Nova

NovaCAUTION

Name: Nova
Author: bigduu

mcp/bigduu/nova

MCP server by bigduu · accessibility · ai agent · claude · Audited 2026-10-09

Cross-platform Rust computer-use MCP server for macOS and Windows: AX/UIA, screenshots, OCR, pointer and keyboard input, clipboard, stdio, and HTTP.

Verdict

CAUTION

Grade

Trust score

89 /100

Exposed tools

—

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English · 简体中文

Let any MCP agent use your real Mac or Windows apps. Nova is a single Rust binary, with no Python runtime, that gives Claude Desktop, Cursor, Codex, Claude Code and other MCP clients screenshots, native OCR, keyboard and mouse input, clipboard access, window/app control and Accessibility/UIA actions on macOS and Windows.

Releases · Part of Bodhi · Bodhi desktop app · MIT

Your real desktop, not a VM: macOS 14+ (Apple Silicon and Intel) and

Windows x64/ARM64.

Reads before it clicks: Accessibility/UIA controls, Apple Vision or

Windows OCR, and per-window screenshots with zoom. Clicks are given in the screenshot's pixel space and mapped back to the screen.

Types any text: full Unicode keyboard input, including Chinese, Japanese,

Korean and emoji.

Accessibility-first control (v0.3.0): AX-first ax_read / ax_activate

that reject stale snapshots, a 64-step batch_actions limit with structured failure reports, the Nova.app permission owner (development preview) and an optional Chrome DevTools sidecar. Latest release: v0.3.0 — Releases.

Static image · Reproduce and inspect MCP evidence

This recording shows Nova's browser tool path (fixture page and real MCP navigation/click calls). It was captured on Linux, so it does not show native macOS/Windows desktop control or model reasoning. The reproduction notes explain the --npx adapter and isolated browser.

Install

Read from source at commit 1706bb0e4223OBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add nova -- npx -y @bigduu/[email protected]

claude-desktop

{
  "mcpServers": {
    "nova": {
      "command": "npx",
      "args": [
        "-y",
        "@bigduu/[email protected]"
      ]
    }
  }
}

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (13)

MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427

chrome/docs/static-text-acceptance.md:36

The final visibility case uses the same origin with `<button style="visibility:hidden"><span style="visibility:visible">Visible caption</span></button>` and `<h2 style="display:contents">Contents head

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

chrome/extension/test/protocol.test.js:131

["unsafe request ID", { requestId: "../../escape" }, "invalid_request_id"],

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packaging/macos/package-development-app.sh:42

ICON_SOURCE="$SCRIPT_DIRECTORY/../../assets/nova-app-icon.png"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packaging/macos/package-development-app.sh:70

cp "$SCRIPT_DIRECTORY/../../LICENSE" "$APP/Contents/Resources/LICENSE"