MacWorkSAFE
Open-source computer-use agent and MCP server for macOS — operates any app through the Accessibility API and native interfaces instead of screenshots. No app-specific code.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An open-source computer-use agent for macOS, built on the Accessibility API instead of screenshots.
[](https://github.com/gklab/MacWork/actions/workflows/ci.yml) [](LICENSE) [](pyproject.toml) [](#installation) [](#mcp-server)
Website · Design · Benchmarks · Extending · Triggers
MacWork is an AI agent that operates a Mac the way a person does — any app, including ones it has never seen — and exposes that ability as a command-line tool and a Model Context Protocol (MCP) server for Claude Code, Claude Desktop and any other MCP client.
Where most computer-use agents screenshot the display and click pixels, MacWork reads what macOS already knows in structured form — the Accessibility (AX) tree, menus, Services, URL schemes, Shortcuts, LaunchServices, Spotlight — and acts through the same interfaces assistive technology uses. Each step is one typed question to a fast decision model (TypeSafe Jev): which of these actions, and is it done?
03270e63592dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add macwork --env TYPESAFE_API_KEY=${TYPESAFE_API_KEY} -- uvx macwork{
"mcpServers": {
"macwork": {
"command": "uvx",
"args": [
"macwork"
],
"env": {
"TYPESAFE_API_KEY": "${TYPESAFE_API_KEY}"
}
}
}
}Exposed tools (9)
4 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
mac_act | write | Execute one affordance from the latest mac_observe. Irreversible actions need confirm=true. |
mac_cancel | write | Stop a running or pending task. |
mac_do | read | Accomplish a goal on this Mac. `inputs` carries any text the task needs (text, query, url, file...); |
mac_feedback | read | Tell the engine whether a finished task really did what was asked; a wrong |
mac_observe | read | What can be done right now: affordances (menus, buttons, fields, apps, keys...) of `app` (default frontmost), |
mac_resume | read | Continue a task that returned need_input (pass inputs), need_confirm (pass confirm) or ambiguous |
mac_revert | write | Put back what a task changed, most recent change first, using each app |
mac_status | write | Helper permissions, decider, cost so far, queue, dry-run state — or, with a task_id (from mac_submit |
mac_submit | write | Hand in a goal and get its id back at once, without waiting for the Mac to be free. Tasks still run |
Trust audit
SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (14)
base_url: http://127.0.0.1:1234/v1
.pre-commit-config.yaml
module = importlib.import_module(f"macwork.{path.stem}") if path.stem != "__init__" else Nonereturn hashlib.sha1(raw.encode()).hexdigest()[:12]
return {"id": hashlib.sha1(ident.encode("utf-8")).hexdigest()[:12], "identity": ident,key = f"{name}|{hashlib.sha1(text.encode()).hexdigest()[:10]}"key = f"{w.get('owner', '')}|{hashlib.sha1(text.encode()).hexdigest()[:10]}"sid = hashlib.sha1(json.dumps([start_app, body], ensure_ascii=False).encode()).hexdigest()[:12]
`http://127.0.0.1:8977/mcp`, and `macwork daemon install` keeps it resident as a LaunchAgent.
local = OpenAICompatPlanner(cfg(tmp_path), "local", {"base_url": "http://127.0.0.1:9/v1", "local": True, "stream": False})"reply": urllib.error.HTTPError("http://127.0.0.1:9/v1", 500, "Internal Server Error", {}, None),"refused": urllib.error.HTTPError("http://127.0.0.1:9/v1", 401, "Unauthorized", {}, None),path.write_bytes(base64.b64decode(f["base64"]))
a, b = base64.b64decode(before["cells"]), base64.b64decode(after["cells"])
Gates applied: no_behavioural_pass.
03270e63592dfull audit observations/trust-audit/mcp-server/gklab__macwork.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 03270e63592d | SAFE | B | 85 | first audit |
Questions
What is the MacWork MCP server?
Open-source computer-use agent and MCP server for macOS — operates any app through the Accessibility API and native interfaces instead of screenshots. No app-specific code.
What tools does MacWork expose?
9 in total: 4 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is MacWork safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (85/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does MacWork need?
It reads TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MacWork run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as macwork.
How current is this page?
The grade is for one exact copy of the source (03270e63592d), read on 2026-10-11. The repository is watched and re-audited when it changes.