{"slug": "computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents", "title": "Computer use on GNOME Wayland, on a second desktop you never see (for Agents)", "summary": "Deskwright, an open-source MCP server and GNOME shell extension, enables AI coding agents to control a GNOME Wayland desktop via accessibility APIs, including a headless virtual monitor mode so agents work on a separate desktop without stealing the user's mouse. The tool, created by Tristan Muzzu, supports Claude Code, Codex, Cursor, and other MCP clients, and requires GNOME Shell on Wayland, a one-time logout/login, and installation via pipx with --system-site-packages.", "body_md": "**Computer use for AI agents on GNOME Wayland.**\n\nLet your coding agent use your Linux desktop. Or give it one of its own, so it stops stealing your mouse.\n\n[Install](#install) •\n[What it can do](#what-it-can-do) •\n[A desktop of its own](#a-second-desktop-it-uses-while-you-work) •\n[When something's off](#when-somethings-off) •\n[Security](/tristanmuzzu/deskwright/blob/main/SECURITY.md)\n\nClaude Code can edit your files and run your commands. It can't open GIMP, click a button in a settings dialog, or read what a native app is showing you. On macOS and Windows it can, through computer use. On Linux that's still on Anthropic's list.\n\nThis fills the gap on GNOME. It's an MCP server plus a small shell extension, and it hands an agent the actual desktop: launching apps, reading widgets, clicking, typing, dragging, window management, OCR and screen recording. Any MCP client can drive it. Claude Code, Codex, Cursor, your own script.\n\nThe part people tend to like most: `DESKWRIGHT_SESSION=headless`\n\nruns all of\nit on a virtual monitor that isn't on any of your screens. Your agent gets a real GNOME\ndesktop to work on, and it never takes your focus.\n\nWayland deliberately stops an application from seeing or touching any other\nwindow. That's a good rule, and it's why `xdotool`\n\n, `wmctrl`\n\nand `grim`\n\neither\ndo nothing on GNOME or fail in ways that look like your own mistake. Every\nLinux computer-use project I found either shipped a Docker container running\nX11, or quietly assumed X11 and broke.\n\nSo I went looking for what GNOME actually permits, and it turns out to be quite a lot, just not where anyone looks. Mutter answers D-Bus. AT-SPI, the accessibility layer built for screen readers, exposes every real widget in every running app with its name, its role and the action it performs. And a shell extension runs inside gnome-shell itself, where the rest lives.\n\nThat middle one matters more than it sounds. Pressing a widget's own accessibility action isn't a nicer way to click. It's a different thing: it can't miss, it survives the window moving, and it needs no pointer at all. An agent working this way stops guessing at coordinates, and stops taking a screenshot after every action to find out what happened.\n\nYou need GNOME Shell on Wayland. Check with `echo $XDG_CURRENT_DESKTOP $XDG_SESSION_TYPE`\n\n, which should mention GNOME and wayland.\n\nOpen Claude Code, or Codex, or whatever you use, and say:\n\nSet up\n\n[https://github.com/tristanmuzzu/deskwright]on this machine, follow the AGENTS.md.\n\n[ AGENTS.md](/tristanmuzzu/deskwright/blob/main/AGENTS.md) is a runbook written for agents. Every command, how to\ncheck each one worked, the right package names for Debian, Fedora and Arch, and\nthe handful of things that go wrong with their fixes. Your agent will ask you\nfor a sudo password once and tell you to log out once. That's your whole\ninvolvement.\n\n```\npipx install --system-site-packages deskwright\ndeskwright-setup\n```\n\n`deskwright-setup`\n\nnarrates every step. It turns on the accessibility flag, installs\nthe bundled shell extension, and tells you about any missing system package\nwith the right install line for your distro, so you're never guessing at\npackage names. It never runs sudo itself.\n\n**Then log out and log back in.** Once. There's no way around this one: on\nWayland, gnome-shell only picks up an extension at session start.\n\nLast step, point your client at it:\n\n```\nclaude mcp add deskwright --scope user -- deskwright\n```\n\nThat's it. Ask your agent to open an app and it will.\n\n**Why **`--system-site-packages`\n\n, and what breaks without it\n\n`--system-site-packages`\n\n, and what breaks without itPyGObject publishes no wheels to PyPI. It's a distro package everywhere\n(`python3-gi`\n\n, `python3-gobject`\n\n, `python-gobject`\n\n), so an isolated venv can't\nimport it. Leave the flag off and you get a server that starts cleanly and then\ndies on the first click with `input_backend_failed`\n\n.\n\n`uvx`\n\nhas no equivalent flag, which is the only reason this says pipx. If you'd\nrather skip pipx, a plain `python3 -m venv --system-site-packages`\n\nfollowed by\n`pip install deskwright`\n\nworks identically.\n\n**As a Claude Code plugin instead**\n\nThe repo is also a plugin marketplace. It registers the server plus a skill that teaches an agent which tool to reach for first.\n\n```\nclaude plugin marketplace add tristanmuzzu/deskwright\nclaude plugin install deskwright@deskwright\n```\n\nThe plugin runs the server from its own checkout, so there's no pip install. You still need the system packages and the extension, so run the setup out of the checkout Claude Code cloned for you, once:\n\n```\n~/.claude/plugins/marketplaces/deskwright/bin/deskwright-setup\n```\n\nThen log out and back in, same as above.\n\n**From a clone, if you want to hack on it**\n\n```\ngit clone https://github.com/tristanmuzzu/deskwright\ncd deskwright\nbin/deskwright-setup\n./mcp_server.py --self-test\n```\n\n`./mcp_server.py`\n\nis the same entry point as the `deskwright`\n\ncommand, by the path older registrations already point at.\n[ CONTRIBUTING.md](/tristanmuzzu/deskwright/blob/main/CONTRIBUTING.md) has the layout and which test suites need\na real session.\n\n```\nDESKWRIGHT_SESSION=headless deskwright --self-test\n```\n\nYou want `18/18 passed`\n\n. It runs on a virtual monitor rather than your screen,\nso it's safe to run while you're working. The first run takes about 20 seconds\nbecause it has to start a second gnome-shell.\n\nDrop `DESKWRIGHT_SESSION=headless`\n\nand it tests your real desktop instead. Do that one\nwhile you're looking at the screen: the self-test injects real input, because\nit's checking the guards that refuse dangerous key combinations.\n\nWhen something's wrong, ask your agent to call `desktop_health`\n\n. It answers in\none line whether this desktop is usable, then says which mechanisms work right\nnow and what each of them will actually do.\n\n33 tools, roughly 11k tokens of schema in a session. That's the honest price, and it's why each one returns enough that you don't need a second call to work out what happened. The order below is the order an agent should reach for them. Accessibility tree first, pixels last.\n\n| Tool | What it's for |\n|---|---|\n`ui_apps` , `ui_tree` , `ui_find` |\nFind things. `ui_find` searches 30 levels deep by default, because GTK4 nests far deeper than you'd expect. |\n`ui_press` |\nThe good one. Invokes the widget's own action, so it can't miss. Wants `expect_name` or `expect_role` , which is the identity check, not ceremony. |\n`ui_set_text` |\nThe good one for typing. Writes straight into the widget with no focus and no keyboard, then reads it back to prove the write landed. |\n`ui_read_text` |\nRead a widget's contents. This is how you verify something worked. |\n`launch_app` |\nStart an app by desktop id and wait for its window, inside one call. |\n`screen_map` |\nWhere everything is, in pixels: windows top of stack first, plus every pressable widget of the focused app with the point to click it at. Each carries a `ref: N` you pass straight to `ui_press` or `pointer_click` . No coordinates to copy, identity re-checked on use. |\n`pointer_click` , `pointer_move` , `pointer_drag` , `pointer_scroll` |\nReal pointer input in absolute screen coordinates. Pass `expect_window` and a click that would land somewhere else is refused, with the blocker named so you can redirect in the same call. |\n`window_at` , `pointer_position` |\nWhat a click at a point would hit, before you click it. And where the pointer is now, or an honest note that only the last position it set is known. |\n`find_text` |\nWhere a visible string is, in screen coordinates. OCR, about 0.3s for a window, and no image in your transcript. This is the answer for Chrome, Electron and Qt, which expose almost nothing to `ui_find` . |\n`wait_for` |\nWait for a window, a widget, some text, a focus change or the clipboard, instead of sleeping a guessed number of seconds. |\n`region_changed` |\nWait for pixels to change. For what `wait_for` can't express, like a reply arriving or a spinner stopping. |\n`assert_state` |\nPass or fail with evidence, so a long run can decide for itself that it's finished. |\n`do_steps` |\nA known sequence in one call, validated before anything runs, with per-step retry and one picture at the end, or at the step that broke. |\n`list_windows` , `activate_window` , `window_manage` |\nWindow list, focus, and move, resize, close, minimize, maximize, workspace. |\n`screenshot` , `zoom` |\nA picture, or a full-resolution crop of one window, region or widget. `zoom` never scales, so small text stays readable. |\n`screencast` , `frames` |\nFor anything that moves, because a still can't show motion. `frames` also reports a per-frame delta series, which is how you tell a smooth scroll from a juddering one. |\n`type_text` , `press_keys` , `hold_key` |\nKeyboard input through compositor keysyms, with focus proven before anything gets typed. |\n`clipboard_read` , `clipboard_write` |\nPasting beats two thousand keystrokes, and reading back is how you check it arrived. |\n`journal` |\nThe trail of everything the agent did: arguments, outcome, whether it landed, screenshot hashes. For reviewing an unattended run, or working out where you are after a context reset. |\n`desktop_health` |\nOne line on whether this desktop is usable, then the detail. |\n\nAn agent that needs your screen is only half useful. `deskwright-headless`\n\nstarts a\nseparate GNOME session on a virtual monitor, with its own session bus, its own\n`gnome-shell --headless`\n\nand its own runtime directory. A server pinned to it\ndrives that desktop with the same 33 tools while you keep the physical one.\n\n```\ndeskwright-headless start                    # about 200 MB of gnome-shell, idempotent\ndeskwright-headless status                   # liveness, memory, bus address\ndeskwright-headless stop                     # don't leave it idling on an 8 GB machine\n```\n\nRegister it as a second MCP server and you can hand it long jobs:\n\n```\nclaude mcp add deskwright-headless --scope user --env DESKWRIGHT_SESSION=headless -- deskwright\n```\n\nSessions are named, so two agents can each have a desktop of their own and never watch each other's windows move:\n\n```\ndeskwright-headless start --name work\ndeskwright-headless list                     # every session, memory used, memory free\nDESKWRIGHT_SESSION=headless:work deskwright\n```\n\nGive a session its own home and it boots a GNOME that has never been used: no desktop icons, no session restore, no recent files. That is what you want for a recorded demo or a clean-room test, where the default behaviour of sharing your home means an editor opens your last document.\n\n```\ndeskwright-headless start --name demo --home /tmp/demo-home\n```\n\nThere are guards on this, because each session is a real compositor at around\n205 MB: a per-name start lock so two agents can't both spawn one, a session cap\n(`DESKWRIGHT_HEADLESS_MAX`\n\n, default 4), and a free-memory floor that refuses a start\nwhich would push the machine into swap. The agent that would cause that can't\nsee it coming, so the server does.\n\n**The extension says INACTIVE, or window tools don't work.** You haven't logged\nout yet. gnome-shell can't load an extension without a session restart and\nthere's no workaround. Until then you still get AT-SPI, pointer, keyboard and\nclipboard. You don't get window management, extension screenshots, pointer\nposition or the halt switch.\n\n**An app shows no widgets in ui_tree.** It was already running when\n\n`toolkit-accessibility`\n\ngot turned on. Apps read that setting at startup, so\nrestart the app.**Chrome, Electron or Qt apps look empty.** As far as AT-SPI is concerned, they\nare. Use `find_text`\n\ninstead, which OCRs the screen and hands back coordinates.\nFor Chrome specifically, launching it with `--force-renderer-accessibility`\n\ngets you a real tree at a small performance cost.\n\n**Everything fails with input_backend_failed.** pipx without\n\n`--system-site-packages`\n\n. Reinstall with the flag:\n\n```\npipx install --force --system-site-packages deskwright\n```\n\n**Every ui_* call says \"Namespace Atspi not available\".** You have\n\n`python3-gi`\n\nbut not the AT-SPI typelib, which is a separate package:\n`gir1.2-atspi-2.0`\n\non Debian and Ubuntu, `at-spi2-core`\n\non Fedora and Arch.\n`deskwright-setup --check`\n\ncatches this and names it.**A tool returns halted.** Somebody pressed\n\n`Super+Ctrl+Escape`\n\n, which is the\nhalt switch. Press it again to clear it.**Your screen locked and half the tools stopped.** Expected. GNOME unloads\nextensions that don't declare `unlock-dialog`\n\n, so screenshots and window\ngeometry go away until you unlock. AT-SPI keeps working, so `ui_find`\n\n,\n`ui_press`\n\nand `ui_read_text`\n\nall still do.\n\nDeliberately out of scope as a project, not just off by default:\n\n**No CAPTCHA solving.** CAPTCHAs exist to tell humans from software. This is software.**No credential typing features.** Nothing here is built to harvest, store or autofill secrets. The journal doesn't record what gets typed, only how much.**No detection evasion.** No timing jitter to look human, no fingerprint spoofing, no anti-anti-bot work.**No cloud, no telemetry, no account.** It's a local process on your session bus, and nothing leaves the machine.\n\nOn the other side of that line the design is deliberately permissive. The agent\nis trusted, and the tooling's job is to make it capable rather than to fence it\nin. The whole safety budget goes to three things: a halt switch a human can\nalways reach, guards against actions that can't be undone, and an honest record\nof what happened. [SECURITY.md](/tristanmuzzu/deskwright/blob/main/SECURITY.md) is blunt about what enabling this\nactually switches on, and it's worth reading before you point it at your real\nscreen.\n\nWayland denies all of this to Wayland clients. It says nothing about D-Bus, and that's where the doors are. Four mechanisms, roughly in order of how much work they carry:\n\n**AT-SPI** for anything semantic. Real widgets, real actions, no pointer.**A gnome-shell extension** over D-Bus for what gnome-shell keeps to itself: window enumeration and control, screenshots, pointer position, and a keybinding grab for the halt switch.for pointer and keyboard. Absolute coordinates, and keysyms rather than key positions, so your keyboard layout can't transpose what gets typed.`org.gnome.Mutter.RemoteDesktop`\n\nfor the same thing, standardised. This is the route to compositors that aren't GNOME.`xdg-desktop-portal`\n\nWorth knowing: number 2 is the only one of those that isn't already open.\nMutter's ScreenCast and RemoteDesktop interfaces answer any client on your\nsession bus with no consent dialog, which is why recording here needs no\npermission popup, and why the portal is a caller of them rather than a gate in\nfront of them. [SECURITY.md](/tristanmuzzu/deskwright/blob/main/SECURITY.md) has the exact commands if you'd\nrather check that yourself than take my word for it.\n\n[ docs/field-notes.md](/tristanmuzzu/deskwright/blob/main/docs/field-notes.md) is the long version: every wall\nhit on the way here, what the compositor refused, and the measurements that\nshaped the tool surface. It's the file to read when something behaves oddly, or\nbefore you change the code.\n\n`deskwright-setup --check`\n\nis the real answer. It detects everything, names the\npackage for your distro and exits nonzero if a hard requirement is missing.\nThe short version:\n\n| Platform | Status |\n|---|---|\n| GNOME Shell 50 on Wayland | Verified. Developed on 50.1 (Ubuntu 26.04), live suites run against it on every change. |\n| GNOME Shell 48 to 49 | Should work. Same D-Bus and AT-SPI surfaces, not tested. Reports welcome, attach `desktop_health` output. |\n| KDE Plasma, Sway, Hyprland | Input only. The portal backend drives pointer and keyboard, but window management and screenshots need per-compositor work that isn't done. `desktop_health` will say it's not usable, and it means it. |\n| X11 | Not a target. `xdotool` already does this well there. |\n\n**Claude Code, not Cowork.** On Linux the desktop app runs Cowork tasks inside a\nQEMU/KVM virtual machine, so an MCP server it starts lives in that VM and cannot\nsee your session bus, your gnome-shell or your screen. Everything here would fail\nthere. Use it from the Claude Code CLI, the Code tab, or any other MCP client\nrunning on the host itself.\n\n**Claude Code, not Cowork.** On Linux the desktop app runs Cowork tasks inside\na QEMU/KVM virtual machine, so an MCP server it starts lives in that VM and\ncannot see your session bus, your gnome-shell or your screen. Everything here\nwould fail there. Use it from the Claude Code CLI, the Code tab, or any other\nMCP client running on the host itself.\n\nPackages, using Debian names (`deskwright-setup`\n\nprints yours): `python3-gi`\n\n,\n`gir1.2-atspi-2.0`\n\n, `python3-pil`\n\n, `libglib2.0-bin`\n\n, `wl-clipboard`\n\n,\n`tesseract-ocr`\n\n. `ydotool`\n\nis optional and only used as an input fallback. The\nheadless session additionally wants `gnome-shell`\n\nand `dbus-daemon`\n\nas\nbinaries, which any normal desktop already has.\n\n[ CONTRIBUTING.md](/tristanmuzzu/deskwright/blob/main/CONTRIBUTING.md) has the layout, the test suites and what\neach one needs.\n\n[is the threat model, stated plainly.](/tristanmuzzu/deskwright/blob/main/SECURITY.md)\n\n`SECURITY.md`\n\n[is what's next and why, in order.](/tristanmuzzu/deskwright/blob/main/ROADMAP.md)\n\n`ROADMAP.md`\n\nApache-2.0. If you get it running on a compositor that isn't GNOME, or on a GNOME older than 50, please open an issue and say so. That's the most useful thing anyone can send.\n\n`mcp-name: io.github.tristanmuzzu/deskwright`", "url": "https://wpnews.pro/news/computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents", "canonical_source": "https://github.com/tristanmuzzu/deskwright", "published_at": "2026-09-01 10:07:15+00:00", "updated_at": "2026-09-01 10:23:15.604366+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools"], "entities": ["Deskwright", "Tristan Muzzu", "GNOME", "Wayland", "Claude Code", "Codex", "Cursor", "MCP"], "alternates": {"html": "https://wpnews.pro/news/computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents", "markdown": "https://wpnews.pro/news/computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents.md", "text": "https://wpnews.pro/news/computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents.txt", "jsonld": "https://wpnews.pro/news/computer-use-on-gnome-wayland-on-a-second-desktop-you-never-see-for-agents.jsonld"}}