glassCAUTION
MCP server: build → see → interact → debug loop over native GUI apps
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/fixed-width/glass/actions/workflows/ci.yml) [](https://glama.ai/mcp/servers/fixed-width/glass)
Give your coding agent hands for the app it's building — launch it, drive it, and verify the result, without burning a screenshot on every step.
A Rust MCP server that gives an AI coding agent a closed build → see → interact → debug loop over external native GUI applications.
glass lets an agent launch a GUI app, capture what is on screen, inject mouse and keyboard input, read the app's logs, and detect visual changes — so a coding agent can build and debug UI applications independently instead of asking the user "does this look right?".
glass drives apps as an external black box, so it works with any native GUI app regardless of toolkit or language. It has two Linux backends (X11 and Wayland), a Windows backend, an Android backend (an AVD emulator, driven over adb from any host), an iOS backend (native apps in the Simulator over xcrun simctl, with input and the accessibility tree via idb_companion, including a two-finger pinch), and a macOS backend, behind a platform-agnostic core.
The same input tools work across backends. Default Linux displays and mobile emulators keep input separate from your desktop; native Windows and macOS currently share it. glass_capabilities with scope: "session" reports click, scroll and text support and whether each can affect your desktop.
See it
An agent building a GUI app runs it under glass, reproduces a bug from the accessibility tree (no screenshots), fixes the code, and re-verifies — the loop it otherwise can't close on its own. Try it yourself.
Try it
f47d249042b1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add glass-interaction-fixture -- npx -y [email protected]
{
"mcpServers": {
"glass-interaction-fixture": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Trust audit
CAUTIONgrade C · trust 77/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (20)
AppIcon.icns
Endpoint::from_static("http://127.0.0.1:0").connect_lazy()let src = ReleaseSource::with_base("http://127.0.0.1:1");let src = ReleaseSource::with_base("http://127.0.0.1:1");let base = "http://127.0.0.1:8080";
"name=é👩💻 e\u{301}\r\n".repeat(80),streamable-http
"file://{}/../../examples/web-role-fixture/index.html","file://{}/../../examples/interaction-fixture/index.html?case={geometry}","file://{}/../../examples/interaction-fixture/index.html?case=large-form","/../../docs/reference/a11y-roles.md"
for evil in ["../../etc/evil", "/etc/evil", "sub/exec", "Demo/"] {that granting Screen Recording relaunches the app), and the `http://127.0.0.1:7300/` endpoint —
metrics["image_decoded_bytes"] += len(base64.b64decode(data, validate=True))
current = "first\r\n新👩💻 e\u0301\nduplicate\nfinal"
{"start": 1, "delete": 1, "insert": ["新👩💻 e\u0301\n"]},original = [randomizer.choice(["same\n", "e\u0301\n", "雪\r\n", "👩💻\n"]) for _ in range(20)]
`--yes` skips the confirmation prompt. It never asks for elevated privileges — if the install
1. Open **Keychain Access**.
Gates applied: no_behavioural_pass.
f47d249042b1full audit observations/trust-audit/mcp-server/fixed-width__glass.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f47d249042b1 | CAUTION | C | 77 | first audit |
Questions
What is the glass MCP server?
MCP server: build → see → interact → debug loop over native GUI apps
Is glass safe to connect to an agent?
With care. The audit graded it C (77/100) and found 20 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does glass need?
No credential environment variables were found in its source, so it appears to need none.
How does glass run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as glass-interaction-fixture at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (f47d249042b1), read on 2026-10-11. The repository is watched and re-audited when it changes.