Computer UseSAFE
💻 Give AI models complete control of your computer (probably a bad idea)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
💻 A Model Context Protocol server for Claude to control your computer. This is very similar to computer use, but easy to set up and use locally.
Here's Claude Haiku 4.5 changing my desktop background (4x speed):
https://github.com/user-attachments/assets/cd0bc190-52c4-49db-b3bc-4b8a74544789
[!WARNING] At time of writing, models make frequent mistakes and are vulnerable to prompt injections. As this MCP server gives the model complete control of your computer, this could do a lot of damage. You should therefore treat this like giving a hyperactive toddler access to your computer - you probably want to supervise it closely, and consider only doing this in a sandboxed user account.
Installation
Follow the instructions on install-mcp, which generates the right config for your MCP client (Claude Code, Claude Desktop, Cursor, Cline, VS Code, and more).
Tips
This should just work out of the box.
However, to get best results:
- Use a model good at computer use - I recommend the latest Claude models.
- Use a small, common resolution - 720p works particularly well. On macOS, you can use displayoverride-mac to do this. If you can't use a different resolution, try zooming in to active windows.
- Install and enable the Rango browser extension. This enables keyboard navigation for websites, which is far more reliable than Claude trying to click coordinates. You can bump up the font size setting in Rango to make the hints more visible.
How it works
We implement a near identical computer use tool to [Anthropic's official computer use
bf41e435d686OBSERVED · 2026-10-02Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add computer-use-mcp -- npx -y computer-use-mcp@{{VERSION}}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
computer | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, @nut-tree-fork/nut-js, express, sharp, zod, @tsconfig/node-lts, @types/express, @types/node
Gates applied: no_behavioural_pass.
bf41e435d686full audit observations/trust-audit/mcp-server/domdomegg__computer-use.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-02 | bf41e435d686 | SAFE | B | 89 | first audit |
Questions
What is the Computer Use MCP server?
💻 Give AI models complete control of your computer (probably a bad idea)
What tools does Computer Use expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Computer Use safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Computer Use need?
No credential environment variables were found in its source, so it appears to need none.
How does Computer Use run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as computer-use-mcp at 1.8.0.
How current is this page?
The grade is for one exact copy of the source (bf41e435d686), read on 2026-10-02. The repository is watched and re-audited when it changes.