Atlas / MCP servers / sandraschi / Windows Computer Use

Windows Computer UseBLOCK

Name: Windows Computer Use
Author: sandraschi

mcp/sandraschi/windows-computer-use

MCP server by sandraschi · agentic · automation · claude desktop · Audited 2026-10-09

Windows Computer Use for AI Agents. Both a tool (22 MCP tools for click, type, screenshot, OCR, UI inspection) and an agent (autonomous mission engine, macro recorder, intent-based discovery, event watchers). Built with opencode (DeepSeek V4). Ships as MCP server, web UI, and Tauri desktop app.

Verdict

BLOCK

Grade

Trust score

43 /100

Exposed tools

76 59r · 14w · 3d

Transport

sse

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A tool for agents, and an agent itself.

Exhibit A: 100 Tauri/NSIS installers, one unattended run, $2 in LLM costs. Install, screenshot, verify, report — zero human intervention. That is what agentic Windows automation looks like at scale.

Built on pywinauto. Read docs/SAFETY.md before production use.

Quick Start
Features
Documentation
Ports
License

Quick Start

Read from source at commit aa9527333c15OBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add windows-computer-use-sota --env WINDOWS_COMPUTER_USE_MCP_BYPASS_HITL=${WINDOWS_COMPUTER_USE_MCP_BYPASS_HITL} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "windows-computer-use-sota": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "WINDOWS_COMPUTER_USE_MCP_BYPASS_HITL": "${WINDOWS_COMPUTER_USE_MCP_BYPASS_HITL}"
      }
    }
  }
}

Exposed tools (76)

59 read · 14 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`General`	read	Balanced help for this repo and Windows automation
`add_face`	write	Add a new face to the recognition system.
`analyze_winapp`	read	Crawl a Windows app and produce UI element map + screenshot portfolio.
`approve_automation`	read	Approve UI automation actions for a specified duration to prevent repetitive prompts.
`automation_safety`	destructive	Inspect or reset server-side safety limits (rate, kill switch, dry-run). Not a substitute for HITL.
`automation_watch`	read	if operation ==
`bring_window_to_foreground`	read	Bring a window to the foreground by its title.
`capture_and_recognize`	read	Capture an image from the webcam and recognize faces in it.
`click_at_position`	read	Click at specific screen coordinates.
`click_element`	read	Click on a UI element.
`close_window`	read	Close a window.
`delete_face`	destructive	Delete a known face from the system.
`double_click`	read	Double-click on an element or at specific coordinates.
`double_click_element`	read	Double-click on a UI element.
`drag_and_drop`	destructive	Drag from source to target element.
`drag_mouse`	read	Drag the mouse from one point to another.
`element_exists`	read	Check if a UI element exists.
`extract_text`	read	Extract text from an image or screen region using OCR.
`find_image`	read	Find a template image within a screenshot or window.
`find_image_on_screen`	read	Find an image on the screen using template matching.
`find_window_by_title`	read	Find window by title text.
`get_active_window`	read	Get the currently active window.
`get_all_elements`	read	Get all UI elements in a window.
`get_all_windows`	read	Get information about all visible windows.
`get_app_monitoring_status`	read	Get the current status of application monitoring.
`get_cursor_position`	read	Get current mouse cursor position.
`get_element_info`	read	Get detailed information about a UI element.
`get_element_rect`	read	Get the rectangle of a UI element.
`get_element_text`	read	Get the text of a UI element.
`get_help`	read	Get comprehensive help and documentation for all available tools.
`get_intruder_detection_status`	read	Get the current status of intruder detection.
`get_mouse_position`	read	Get the current mouse cursor position.
`get_process_list`	read	Get a list of running processes.
`get_security_events`	read	Get security events.
`get_system_clipboard`	read	Get current clipboard content.
`get_text_under_cursor`	read	Get text at the current cursor position using OCR.
`get_ui_tree`	read	Get a hierarchical representation of the UI tree.
`get_window_rect`	read	Get the rectangle of a window.
`get_window_title`	read	Get the title of a window.
`health_check`	read	Check if the PyWinAuto MCP server is running and operational.
`highlight_element`	read	Highlight a UI element with a colored rectangle.
`hover_element`	read	Hover the mouse over a UI element.
`hover_mouse`	write	Move mouse to coordinates and hover for specified duration.
`is_element_enabled`	read	Check if a UI element is enabled.
`is_element_visible`	read	Check if a UI element is visible.
`list_known_faces`	read	List all known faces in the system.
`list_windows`	read	List all visible windows on the desktop.
`maximize_window`	read	Maximize a window.
`minimize_window`	read	Minimize a window.
`mouse_hover`	read	Hover over an element.
`mouse_move_relative`	write	Move mouse relative to current position.
`mouse_move_to_element`	write	Move mouse to a UI element.
`mouse_scroll`	read	Scroll the mouse wheel.
`move_mouse`	write	Move mouse to specific coordinates.
`press_hotkey`	read	Press a combination of keys (hotkey/shortcut).
`press_key`	read	Press a key or combination of keys.
`recognize_face`	read	Recognize faces in an image.
`restore_window`	read	Restore a window to its normal state.
`right_click`	read	Right-click on an element or at specific coordinates.
`right_click_element`	read	Right-click on a UI element.
`scroll_mouse`	read	Scroll mouse wheel at current or specified position.
`send_keys`	write	Send special key combinations.
`set_element_text`	write	Set the text of a UI element.
`set_system_clipboard`	write	Set clipboard content.
`set_window_foreground`	write	Bring a window to the foreground and activate it.
`set_window_position`	write	Set the position and size of a window.
`start_app_monitoring`	write	Start monitoring sensitive applications.
`start_intruder_detection`	write	Start intruder detection.
`stop_app_monitoring`	write	Stop application monitoring.
`stop_intruder_detection`	write	Stop intruder detection.
`take_screenshot`	read	Take a screenshot of the entire screen or a specific window.
`type_text`	read	Type text at current cursor position.
`verify_text`	read	Verify that an element contains the expected text.
`wait`	read	Pause execution for specified seconds.
`wait_for_element`	read	Wait for a UI element to appear.
`wait_for_window`	read	Wait for a window with the specified title to become active.

Trust audit

BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (8 observation(s))
Shell: declared (13 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/windows_computer_use_mcp/face_recognition.py:74

face_data = pickle.load(f)

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/windows_computer_use_mcp/tools/archived/face_recognition.py:129

face_data = pickle.loads(decrypted_data)

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/windows_computer_use_mcp/tools/portmanteau_face.py:118

face_data = pickle.loads(data)

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

scripts/cua-smoke.py:336

os.environ.copy() ... urllib.request

Why it matters. reads secrets in the same file that sends data out

MEDIUMInventory / provenance · inv.binary · CWE-1104

paint_elements.json

paint_elements.json

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.symlink · CWE-1104

scripts/backup-repo.ps1

scripts/backup-repo.ps1

Why it matters. link not followed

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

hooks/runtime-opentelemetry.py:43

mod = __import__(module_name, fromlist=[attr_name])

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

mcpb/verify_pack.py:48

mod = importlib.import_module(entry_module_or_file)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

scripts/demo-autonomous.py:20

mod = importlib.import_module(f"windows_computer_use_mcp.tools.portmanteau_{tool}")

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/windows_computer_use_mcp/tools/__init__.py:110

__import__(f"{__name__}.{module_name}", fromlist=["*"])

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/windows_computer_use_mcp/tools/portmanteau_macro.py:41

mod = importlib.import_module(target)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:17

# CUA_MCP_URL=http://127.0.0.1:10789

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:38

# MCP_BRIDGE_URLS=http://127.0.0.1:10750/mcp,http://127.0.0.1:10752/mcp

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

fleet-start.config.ps1:1

# Per-repo fleet start config for pywinauto-mcp

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

scripts/FleetStartMode.ps1:1

# FleetStartMode.ps1 - vendored per-repo copy (no mcp-central-docs required at runtime)

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/windows_computer_use_mcp/.markdownlint.json:1

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

web_sota/start.ps1:1

# Fleet unified launcher - do not edit logic here.

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

automation_safety, delete_face, drag_and_drop

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius