desktop-touch-mcpBLOCK
Windows computer-use MCP server: drive any desktop app via semantic discover-then-act targeting (entities + leases, not pixel coordinates), with per-action perception guards, a native Rust UIA engine, Chrome CDP, and Key Locker credential autofill for ssh/sudo password prompts. Works with Claude, Cu
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://glama.ai/mcp/servers/Harusame64/desktop-touch-mcp)
日本語
Computer-use MCP server for Windows. Lets Claude, Cursor, or any MCP client see and operate your Windows 10/11 desktop — screenshots, UI Automation, Chrome CDP, keyboard / mouse, terminal — with semantic discover-then-act targeting that avoids pixel-coordinate guessing, and per-action perception guards that catch wrong-window typing before it happens.
npx -y @harusame64/desktop-touch-mcp
32 tools, native Rust engine (UIA in 2 ms), zero-config PowerShell fallback, full CJK support, MIT licensed. Add the snippet above to your Claude / Cursor / VS Code Copilot config and Claude can drive Notepad, Excel, Chrome, Windows Terminal, and any other app on your machine.
Why this over pixel-clicking? Two ideas run through every tool: discover-then-act —desktop_discoverreturns interactive entities with short-lived leases instead of raw coordinates, sodesktop_actoperates on what you mean, not where it was — and per-action perception guards that verify the target window's identity and bounds before input lands, catching wrong-window typing and stale-coordinate clicks before they happen. 2.1 reads UI Automation by element count instead of depth: Chrome, Edge and VS Code pages, Explorer and Settings values, and Word's body are read and can be acted on, and what UIA still cannot see falls back to OCR and Set-of-Marks as before.desktop_actalso types into Word's body, and into Windows Terminal after asking the user. 2.0 refuses an action that cannot be done, with a reason, instead of reporting it done, and an action aimed byhwndreaches that window only. See the CHANGELOG.
Features
- 🔁 Every act reports what it did —
desktop_actanswers with what changed: elements that appe
879270610022OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add desktop-touch-mcp -- npx -y @harusame64/[email protected]
Exposed tools (32)
31 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
browser_click | read | |
browser_eval | read | |
browser_fill | read | |
browser_form | read | Inspect all form fields (input, select, textarea, button) within a CSS-selector-specified container and return their name, type, id, current value (withheld for a field the page masks, such as a password: value is null, valueWithheld is |
browser_locate | read | |
browser_navigate | read | |
browser_open | read | Connect to Chrome/Edge running with --remote-debugging-port and return open tab IDs — required before all other browser_* tools. |
browser_overview | read | List all interactive elements (links, buttons, inputs, ARIA controls) on the current page with CSS selectors, visible text (an input |
browser_search | read | Grep-like element search across the current page. by: |
click_element | read | |
clipboard | read | |
desktop_act | read | |
desktop_discover | read | |
desktop_state | read | |
excel | read | |
focus_window | read | |
key_locker | read | |
keyboard | read | |
mouse_click | read | |
mouse_drag | read | Click and drag from (startX, startY) to (endX, endY) holding the left mouse button — for sliders, drag-and-drop, canvas drawing, and window resizing. Pass windowTitle so the server auto-guards the start coordinate and returns post.perception. Examples: mouse_drag({windowTitle: |
notification_show | read | |
run_macro | write | |
screenshot | read | |
screenshot_gc | read | Reclaim disk space from cached screenshots by retention policy. By DEFAULT this is a |
screenshot_query | read | List screenshots already saved in the disk-cache WITHOUT re-reading any pixels. |
scroll | read | |
server_status | read | Return MCP server status. engine: native engine availability — uia: |
terminal | read | |
wait_until | read | |
window_dock | read | |
workspace_launch | read | |
workspace_snapshot | read |
Trust audit
BLOCKgrade F · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
payload.rs
return eval(__mcpExpression);
WinRT.Runtime.dll
key-askpass.dll
key-askpass.exe
key-askpass.pdb
console.log(`\nNote: ~1 token = 4 chars (English technical prose estimate).`);
const transport = new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${port}/mcp`));ocr-golden.test.ts
.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
to-tool-failure-payload.test.ts
execute: (e, a, t) => exec(e, a, t),
execute: (e, action, text) => exec(e, action, text),
execute: (e, a, t) => exec(e, a, t),
await exec(entity(), "click");
return createHash("sha1")return createHash("sha1").update(`ax|${pid}|${kindOf(e)}${where}`).digest("hex").slice(0, 16);"ssh-keygen -y -f ~/.ssh/id_ed25519",
it("alias resolves through ~/.ssh/config to the real endpoint + fp-set", async () => {`bridge-host.exe not found at ${HELPER_EXE}. Build: cd tools/bridge-host && dotnet publish -c Release -o ../../bin/`,`key-locker.exe not found at ${HELPER_EXE}. Build: cd tools/key-locker && dotnet publish -c Release -o ../../bin/`,const addon = await import("../../index.js");`Run: cd tools/win-ocr && dotnet publish -c Release -o ../../bin/`
import { logResolve } from "../../tools/_resolve-log.js";デフォルトポートは `23847`。`http://127.0.0.1:23847/mcp` をクライアントの MCP サーバー URL に登録してください(ローカルのみ、外部公開なし)。
Gates applied: no_behavioural_pass.
879270610022full audit observations/trust-audit/mcp-server/harusame64__desktop-touch-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 879270610022 | BLOCK | F | 60 | first audit |
Questions
What is the desktop-touch-mcp MCP server?
Windows computer-use MCP server: drive any desktop app via semantic discover-then-act targeting (entities + leases, not pixel coordinates), with per-action perception guards, a native Rust UIA engine, Chrome CDP, and Key Locker credential autofill for ssh/sudo password prompts. Works with Claude, Cu
What tools does desktop-touch-mcp expose?
32 in total: 31 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is desktop-touch-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (60/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does desktop-touch-mcp need?
It reads DESKTOP_TOUCH_DISABLE_KEY_LOCKER, DESKTOP_TOUCH_KEYBOARD_RUNG_UNCHECKED, DESKTOP_TOUCH_KEY_LOCKER_DOGFOOD, DESKTOP_TOUCH_STAGE4_SSIM_KEYBOARD, DESKTOP_TOUCH_TOKEN, GH_TOKEN, GITHUB_TOKEN and TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does desktop-touch-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @harusame64/desktop-touch-mcp at 2.2.0.
How current is this page?
The grade is for one exact copy of the source (879270610022), read on 2026-10-10. The repository is watched and re-audited when it changes.