Atlas / MCP servers / wide-moat / Open Computer Use

Open Computer UseBLOCK

Name: Open Computer Use
Author: wide-moat

mcp/wide-moat/open-computer-use-1

MCP server by wide-moat · agents · claude code · computer use · Audited 2026-10-07

⚑ Report / re-scan Source ↗

ARCHIVED — superseded by Wide Moat

Verdict

BLOCK

Grade

Trust score

34 /100

Exposed tools

4 3r · 1w · 0d

Transport

streamable-http

License

NOASSERTION

Stars

126

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/Wide-Moat/open-computer-use/actions/workflows/build.yml) [](https://github.com/Wide-Moat/open-computer-use/actions/workflows/codeql.yml) [](https://github.com/Wide-Moat/open-computer-use/releases) [](LICENSE) [](https://github.com/Wide-Moat/open-computer-use/stargazers) [](https://github.com/Wide-Moat/open-computer-use/issues)

MCP server that gives any LLM its own computer — managed Docker workspaces with live browser, terminal, code execution, document skills, and autonomous sub-agents. Self-hosted, open-source, pluggable into any model.

ARCHIVED. This repository is no longer developed or maintained. It receives no fixes, no security updates and no dependency updates, and issues and pull requests are closed. Do not run it in production. Open Computer Use was a proof of concept for giving an LLM a real computer. Its successor is Wide Moat: Open WebUI with Open Terminal, a browser, and a Kubernetes sandbox isolated with gVisor, with ingress sidecars and egress through a MITM proxy. The isolation and credential-handling problems listed under Known limitations are addressed in that architecture, not in this codebase. Try it at ai.lab.widemoat.ai. The code stays available under FSL-1.1-Apache-2.0: use it, fork it, self-host it. Each release converts to Apache-2.0 two years after publication.

![Demo: Qwen 3.6 Plus scrapes GitHub Trending, builds an Excel c

Read from source at commit ffa0c07e9a35OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add open-computer-use --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env API_KEY=${API_KEY} --env AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "open-computer-use": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
        "API_KEY": "${API_KEY}",
        "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (4)

3 read · 1 write · 0 destructive.

Tool	Risk	Description
`bash_tool`	read
`create_file`	write
`str_replace`	read
`view`	read

Trust audit

BLOCKgrade F · trust 34/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (7 observation(s))
Shell: declared (4 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

computer-use-server/static/pdf.min.js:22

atob( ... new Function(

Why it matters. decodes a payload and executes it

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

computer-use-server/static/highlight.min.js:133

}),!0),this.lastIndex=0}exec(e){this.matcherRe.lastIndex=this.lastIndex

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

computer-use-server/static/highlight.min.js:143

this.rules.push([e,n]),"begin"===n.type&&this.count++}exec(e){

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

computer-use-server/static/mammoth.browser.min.js:7

},promiseSetter=function(i){return new Function("promise","holder","                           \n            'use strict';                                                    \n            holder.pInde

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

docs/architecture/02-trust-boundaries.md:121

Prompt content filtering, redaction, and AI-guardrail policy (PII masking, prompt-injection detection, jailbreak detection) are not our scope — that responsibility lives with the customer's AI gateway

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMInventory / provenance · inv.binary · CWE-1104

skills/public/pptx/html2pptx.tgz

html2pptx.tgz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

computer-use-server/static/mammoth.browser.min.js:5

circ:"ˆ",tilde:" ̃",ensp:" ",emsp:" ",thinsp:" ",zwnj:"",zwj:"",lrm:"",rlm:"",ndash:"–",mdash:"—",lsquo:"‘",rsquo:"’",sbquo:"‚",ldquo:"“",rdquo:"”",bdquo:"„",dagger:"†",Dagger:"‡",bull:"•",hellip:"...

LOWInventory / provenance · inv.binary · CWE-1104

skills/examples/artifacts-builder/scripts/shadcn-components.tar.gz

shadcn-components.tar.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

skills/examples/web-artifacts-builder/scripts/shadcn-components.tar.gz

shadcn-components.tar.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.coderabbit.yaml

.coderabbit.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitleaks.toml

.gitleaks.toml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.markdownlint.yaml

.markdownlint.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.semgrepignore

.semgrepignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.vale.ini

.vale.ini

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/orchestrator/test_sub_agent_dispatch.py:106

importlib.import_module(mod_name)

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/test-subagent-cli-surface.py:49

exec(compile(snippet, str(SRC), "exec"), ns)  # noqa: S102

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/test_subagent_docstring.py:46

exec(compile(snippet, str(SRC), "exec"), ns)  # noqa: S102

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table