lcuBLOCK
Codex computer use, decoupled from the app, for usage inside any harness.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
LCU
Codex computer use, decoupled from the Codex app.
https://github.com/user-attachments/assets/bd9d0809-8a6c-4931-a51c-b98daf05cb5f
LCU exposes Codex's original computer-use runtime to your harness without requiring Codex authentication. The official ChatGPT desktop app must still be installed locally: it supplies the runtime and instructions, while LCU handles setup and harness integration.
Quick start
Copy this into your agent:
Install and configure LCU for this harness using the latest release. Follow https://raw.githubusercontent.com/amontlabs/lcu/main/docs/INSTALLATION.md Check my OS, architecture, and prerequisites, then guide me through any required permissions.
In Claude Code on an Apple Silicon Mac, two commands do the same through its plugin manager; see Claude Code plugin:
claude plugin marketplace add amontlabs/lcu claude plugin install lcu@lcu
Features
- Desktop apps: read windows, click, type, and take screenshots.
- Chrome, when enabled: read and control tabs through the official extension, with site approval.
- In your harness: adapters are available for Pi, Codex CLI, and Claude Code, with experimental Oh My Pi and Hermes integrations. See setup and verification limits.
Approve apps from Claude, natively
The first time an agent controls an app (Zed, Notes, Safari), the computer-use runtime asks you to allow it. The Claude app's Code tab used to fail that request with "Computer Use was not approved". lcu setup --agent claude-code now installs a small Claude Code mod, lcu-approve, that shows the question as a native Computer use approval pane in the Claude app, and in the terminal.
c2e0c1228aadOBSERVED · 2026-10-12Install
Commands as the repository documents them. They are shown, not run.
claude plugin install lcu@lcu
npm install -g @openai/codex@latest
git clone https://github.com/amontlabs/lcu.git
claude plugin install lcu@lcu
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| claude-desktop | mentioned | |
| codex | mentioned | |
| copilot | mentioned | |
| cursor | mentioned | |
| windsurf | mentioned |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
process.setgid(account.gid);
process.setuid(account.uid);
deps.report('lcu update: running as root without SUDO_USER; run it as the desktop account through sudo or as that account.\n');` sudo ${[...command, '--user', userInfo().username].map(quote).join(' ')}\nThen delete ${temporary}.\n`);parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(data).replace(/^/, ''));.vercelignore
full-payload-development-2026-09-22.json
assert.throws(() => analyze(NODE, { op: 'host', source: 'function (' }), /does not parse/);display = function('XOpenDisplay', [c.c_char_p], pointer)(None)screen = function('XDefaultScreen', [pointer], integer)(display)root = function('XRootWindow', [pointer, integer], ulong)(display, screen)window = function('XCreateSimpleWindow', [pointer, ulong, integer, integer, c.c_uint, c.c_uint, c.c_uint, ulong, ulong], ulong)(display, root, 600, 400, 240, 160, 1, 0, 0xeeeeee)'absolute link': [[`${top}/link`, { symlink: '/etc/passwd' }]],shutil.copy('/usr/local/bin/pi', home / '.local/bin/pi')import { cacheDirectory, checkOnce, readRecord, writeRecord } from '../../lcu/check_record.mjs';import { tryAcquire } from '../../lcu/lock.mjs';const runtime = fileURLToPath(new URL('../../bin/lcu', import.meta.url));const session = fileURLToPath(new URL('../../bin/lcu-session', import.meta.url));import * as wrapper from '../../lcu/linux_sky_service.mjs';
[[], 'cancel'], [['http://127.0.0.1:8080'], 'accept'],
assert.equal(seen[0]._meta.origin, 'http://127.0.0.1:8080');
assert.throws(() => createCuaClient({ command, allowedOrigins: ['http://127.0.0.1:8080/'] }), /exact HTTP/);tool_name: 'access_browser_origin', origin: 'http://127.0.0.1:8080', persist: 'always' } : native ? {? 'http://127.0.0.1.attacker.invalid:8080' : 'http://127.0.0.1:8080';
Gates applied: no_behavioural_pass.
c2e0c1228aadfull audit observations/trust-audit/skill/amontlabs__lcu.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c2e0c1228aad | BLOCK | F | 50 | first audit |
Questions
What does the lcu skill do?
Codex computer use, decoupled from the app, for usage inside any harness.
Is lcu safe to install?
No — not without reading the findings first. The audit graded it F (50/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can lcu access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does lcu work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot, cursor and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (c2e0c1228aad), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.