{"slug": "show-hn-cross-platform-computer-use-mcp-server-built-in-rust", "title": "Show HN: Cross-platform computer use MCP server built in Rust", "summary": "Zavora AI released version 7.1 of its cross-platform computer use MCP server, built in Rust, which exposes 64 stable v7 tools for desktop automation on macOS, Windows, and Linux. The update maintains the v7 API while supporting both MCP 2026-07-28 and legacy 2025 clients, and requires Node.js 20 or newer.", "body_md": "Cross-platform desktop automation for MCP clients on macOS, Windows, and Linux. The server exposes 64 stable v7 tools for screenshots, input, applications, windows, accessibility, scripting, files, processes, registry operations, and virtual desktops.\n\nVersion 7.1 keeps the v7 tool API intact while serving both MCP 2026-07-28 and legacy 2025 clients with the exact `@modelcontextprotocol/*` 2.0.0 SDK packages. Node.js 20 or newer is required. Clients that do not support the modern stateless protocol continue to receive the existing v7 behavior.\n\n- MCP client roots constrain filesystem tools and filesystem resources.\n- Resources support subscriptions and `notifications/resources/updated` .\n- Successful filesystem operations return readable MCP resource links.\n- Sanitized MCP logging reports lifecycle and tool outcomes without arguments, results, secrets, clipboard contents, or screenshots.\n- Approval elicitation identifies the exact tool, target, operation, path, destination, process, registry value, or bounded script involved.\n- Tools have human-readable discovery titles.\n- Prompt application arguments support MCP completion.\n- Dynamic v7 profile changes emit `notifications/tools/list_changed` through the SDK.\n- Stateless MCP 2026-07-28 requests use `server/discover` , per-request identity/capability envelopes, cache hints, in-band multi-round-trip input, and`subscriptions/listen` .\n- The official `io.modelcontextprotocol/tasks` extension is implemented for selected long-running read-only tools, including polling, cancellation, TTLs, routing headers, and caller isolation.\n- A fetch-shaped stateless HTTP handler and a loopback-only HTTP runner are included alongside stdio.\n- The former v8 preview surface, packages, contracts, migration commands, and remote supervisor have been removed.\n\nRequires Node.js 20 or newer.\n\n```\nnpx -y @zavora-ai/computer-use-mcp@7.1.0\n```\n\nExample MCP configuration:\n\n```\n{\n  \"mcpServers\": {\n    \"computer-use\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@zavora-ai/computer-use-mcp@7.1.0\"]\n    }\n  }\n}\n```\n\nFor local Streamable HTTP, run:\n\n```\nnpx -y --package @zavora-ai/computer-use-mcp@7.1.0 computer-use-mcp-http\n# http://127.0.0.1:3100/mcp\n```\n\nThe bundled runner refuses non-loopback binds and validates `Host` and `Origin`. Remote deployments should embed the fetch-shaped handler behind verified OAuth middleware.\n\nThe v7.1 npm tarball contains the matching native binary for:\n\n- macOS arm64 and x64\n- Windows arm64 and x64\n- Linux arm64 and x64\n\nOn macOS, grant the terminal or MCP host Screen Recording and Accessibility permission. Automation permission may also be requested when `run_script` controls another application.\n\nOn Windows, the server uses UI Automation, `SendInput`, PowerShell, and native window APIs. Run at the same integrity level as the applications being automated.\n\nOn Linux, screenshot and input support depend on the active X11/Wayland environment and installed backend. Run `doctor` to obtain machine-specific remediation.\n\n``` php\nflowchart LR\n  Client[\"MCP 2026 or legacy client\"] <-->|\"stdio or Streamable HTTP\"| Entry[\"SDK v2 serving entry\"]\n  Entry --> Server[\"McpServer 7.1 per request/connection\"]\n  Server --> Registry[\"64-tool registry\"]\n  Server --> Protocol[\"MRTR roots/elicitation, Tasks, subscriptions\"]\n  Server --> Resources[\"Prompts and resources\"]\n  Registry --> Session[\"Policy, targeting, lock, cancellation\"]\n  Session --> Native[\"Rust N-API backend\"]\n  Session --> Scripts[\"Bounded AppleScript, JXA, or PowerShell\"]\n  Native --> OS[\"macOS / Windows / Linux\"]\n```\n\nFilesystem authority is the intersection of operator configuration and client-declared roots:\n\n``` php\nflowchart TD\n  Request[\"Filesystem path\"] --> Normalize[\"Normalize and resolve existing ancestors\"]\n  Normalize --> Env{\"Inside COMPUTER_USE_FS_ROOTS?\"}\n  Env -->|\"No\"| Deny[\"fs_root_denied\"]\n  Env -->|\"Yes or unset\"| Roots{\"Inside negotiated MCP client roots?\"}\n  Roots -->|\"No\"| Deny\n  Roots -->|\"Yes or unsupported\"| Execute[\"Execute filesystem operation\"]\n  Execute --> Link[\"Return resource_link\"]\n```\n\nSee [docs/ARCHITECTURE.md](/zavora-ai/computer-use-mcp/blob/main/docs/ARCHITECTURE.md) for protocol lifecycles and extension points.\nSee [docs/releases/v7.1.0.md](/zavora-ai/computer-use-mcp/blob/main/docs/releases/v7.1.0.md) for the complete release notes, compatibility boundary, verification evidence, and upgrade guidance.\n\n| Capability | Behavior | Compatibility | \n|---|---|---|\n| Stateless 2026 transport | `server/discover` , no initialization/session requirement, identity and capabilities on every request; stdio and fetch-shaped Streamable HTTP | 2025 initialization remains supported | \n| Roots | 2026 uses in-band `input_required` /`roots/list` ; legacy requests roots after initialization and on`roots/list_changed` | Ignored when the client does not advertise roots | \n| Resource subscriptions | 2026 uses `subscriptions/listen` ; legacy uses resource subscribe/unsubscribe | Reads still work without subscribing | \n| Resource updates | Emits updates after known state changes, including screenshots, desktop mutations, filesystem writes, and profile changes | Advisory; failures never fail tool calls | \n| Logging | Emits sanitized initialization, roots, approval, and tool-completion events | Deprecated in 2026 but retained for legacy compatibility | \n| Elicitation | 2026 returns an exact-scope in-band form request with signed request state; legacy uses `elicitation/create` | Falls back to `approval_required` when unsupported | \n| Tasks extension | Server-directed tasks for `wait` ≥2s,`scrape` ,`get_ui_tree` ,`get_app_dictionary` , and vision-enabled`snapshot` ; supports`tasks/get` ,`tasks/update` , and`tasks/cancel` | Only returned when the request opts into `io.modelcontextprotocol/tasks` ; polling is the default | \n| Resource links | Filesystem success results reference `computer://filesystem/{encodedPath}` | Existing text content is preserved | \n| List changed | Runtime profile enable/disable operations notify the client | Initial profiles remain unchanged | \n| Completion | Completes application IDs in relevant prompts and paths in the filesystem template | Empty suggestions on unsupported/unreadable state | \n| Annotations | All 64 tools expose all four standard behavior hints; resources expose assistant audience and priority | Hints are descriptive, never authorization | \n| Cache hints | Discovery/list operations are private-cacheable for 30 seconds; live resource reads are not cached | 2026 only | \n\nTask status notifications are optional in the extension and are not advertised; clients poll at `pollIntervalMs`. Sampling, MCP Apps, and authentication extensions are not advertised: this server does not need model delegation or an embedded UI, and remote authentication must be supplied by the embedding host rather than simulated. Legacy roots, logging, and elicitation remain available during the protocol deprecation window.\n\nTasks require an extension-aware host. The core `@modelcontextprotocol/client` 2.0.0 client negotiates MCP 2026-07-28 but intentionally rejects the extension-only `resultType: \"task\"`; do not advertise `io.modelcontextprotocol/tasks` from that client unless the host adds a Tasks extension codec. Clients that omit the extension capability always receive the ordinary synchronous `CallToolResult` shape.\n\n| URI | Description | \n|---|---|\n| `computer://display/main` | Main display dimensions and scale | \n| `computer://windows` | Visible windows | \n| `computer://frontmost` | Frontmost application | \n| `computer://policy` | Redacted policy and audit status | \n| `computer://profile/tools` | Tools available in the configured maximum profile | \n| `computer://screenshot/latest` | Most recent cached screenshot; never captures on read | \n| `computer://filesystem/{path}` | Root-confined file or directory content, limited to 1 MiB for files | \n\n- `diagnose-desktop` — inspect permissions and configuration.\n- `fill-form` — accessibility-first form filling.\n- `script-first` — prefer scripting over physical input.\n- `safe-desktop-task` — policy-aware desktop automation.\n\nThe full profile exposes 64 tools:\n\n- Observation: `screenshot` ,`zoom` ,`cursor_position` ,`get_display_size` ,`list_displays` ,`get_frontmost_app` ,`list_windows` ,`list_running_apps` ,`get_window` ,`get_cursor_window` ,`snapshot` .\n- Pointer and keyboard: `left_click` ,`right_click` ,`middle_click` ,`double_click` ,`triple_click` ,`mouse_move` ,`left_click_drag` ,`left_mouse_down` ,`left_mouse_up` ,`scroll` ,`type` ,`key` ,`hold_key` ,`multi_select` ,`multi_edit` .\n- Accessibility: `get_ui_tree` ,`get_focused_element` ,`find_element` ,`click_element` ,`set_value` ,`press_button` ,`select_menu_item` ,`fill_form` ,`list_menu_bar` .\n- Applications and windows: `open_application` ,`activate_app` ,`activate_window` ,`resize_window` ,`hide_app` ,`unhide_app` .\n- Scripting and advice: `run_script` ,`get_app_dictionary` ,`get_tool_guide` ,`get_app_capabilities` ,`get_tool_metadata` .\n- Clipboard and virtual pointer: `read_clipboard` ,`write_clipboard` ,`agent_pointer` ,`openai_computer` .\n- System operations: `filesystem` ,`process_kill` ,`registry` ,`notification` ,`scrape` .\n- Virtual desktops: `list_spaces` ,`get_active_space` ,`create_agent_space` ,`move_window_to_space` ,`remove_window_from_space` ,`destroy_space` .\n- Administration: `doctor` ,`policy_status` ,`wait` .\n\nUse MCP `tools/list` for the authoritative schemas and annotations.\n\nPrefer the least disruptive mechanism:\n\n1. Direct filesystem or system tools.\n2. AppleScript, JXA, or PowerShell through `run_script` .\n3. Accessibility/UI Automation tools.\n4. Coordinate mouse and keyboard input.\n\nUse `get_tool_guide` and `get_app_capabilities` before unfamiliar workflows. Supply `target_app` or `target_window_id` for physical input whenever possible.\n\n`COMPUTER_USE_PROFILE` defines the maximum authority available to the process:\n\n| Profile | Intended surface | \n|---|---|\n| `core` | Common observation, input, application, and window tools | \n| `ax` | Core plus accessibility tools | \n| `scripting` | Core plus scripting and filesystem tools | \n| `windows-admin` | Scripting plus process, registry, notification, and desktop administration | \n| `full` | All 64 tools; default for compatibility | \n\nEmbedded hosts may set a narrower active v7 profile through `onRegistry`. The active profile can never expand beyond the maximum profile, and changes generate MCP tool-list notifications.\n\n| Variable | Purpose | \n|---|---|\n| `COMPUTER_USE_PROFILE` | Maximum tool profile; defaults to `full` | \n| `COMPUTER_USE_ACTIVE_PROFILE` | Initial visible v7 profile within the maximum | \n| `COMPUTER_USE_FS_ROOTS` | Comma-separated filesystem allow-list; combined with MCP client roots | \n| `COMPUTER_USE_ALLOWED_APPS` | Optional application allow-list | \n| `COMPUTER_USE_BLOCKED_APPS` | Application deny-list | \n| `COMPUTER_USE_REQUIRE_APPROVAL` | Require approval for mutations | \n| `COMPUTER_USE_REQUIRE_APPROVAL_FOR` | Comma-separated tools requiring approval | \n| `COMPUTER_USE_APPROVAL_TOKEN` | Headless per-call approval token | \n| `COMPUTER_USE_ELICITATION` | Enable host form elicitation when supported | \n| `COMPUTER_USE_AUDIT_LOG` | JSONL audit destination | \n| `COMPUTER_USE_STRUCTURED_CONTENT` | Set `false` for legacy text-only results | \n| `COMPUTER_USE_LEGACY_FOCUS_TAG` | Restore legacy focus suffixes in descriptions | \n| `COMPUTER_USE_VISION` | Set `false` for text-only operation | \n| `COMPUTER_USE_PROVIDER` | Default screenshot sizing profile | \n| `COMPUTER_USE_NATIVE_PATH` | Explicit native module override | \n| `COMPUTER_USE_SCRIPT_ENV_ALLOWLIST` | Environment names explicitly allowed into script subprocesses | \n| `COMPUTER_USE_REQUEST_STATE_SECRET` | Stable secret for HMAC-signed 2026 multi-round-trip state; random per process when unset | \n| `COMPUTER_USE_MAX_TASKS` | Maximum concurrent Tasks extension jobs per authenticated/client identity; default `16` | \n| `COMPUTER_USE_TASK_TTL_MS` | Task retention window; default `3600000` | \n| `COMPUTER_USE_TASK_POLL_INTERVAL_MS` | Suggested client polling interval; default `1000` | \n| `COMPUTER_USE_HTTP_HOST` | Loopback address for the bundled HTTP runner; default `127.0.0.1` | \n| `COMPUTER_USE_HTTP_PORT` | Port for the bundled HTTP runner; default `3100` | \n\n``` js\nimport { createComputerUseServer } from '@zavora-ai/computer-use-mcp/server'\n\nconst server = createComputerUseServer({\n  profile: 'full',\n  activeProfile: 'core',\n  onRegistry(registry) {\n    // Host-controlled and automatically emits tools/list_changed after connect.\n    registry.setActiveProfile('ax')\n  },\n})\n```\n\nThe typed client is available from `@zavora-ai/computer-use-mcp/client`.\n\nStateless HTTP embedding:\n\n``` js\nimport { createComputerUseHttpHandler } from '@zavora-ai/computer-use-mcp/server'\n\nconst handler = createComputerUseHttpHandler({ profile: 'full' })\n\n// Pass only authInfo produced by a real verifier. The handler never trusts\n// an Authorization header on its own.\nconst response = await handler.fetch(request, { authInfo })\n```\n\nThis server can control the desktop and execute scripts with the permissions of its process. Treat the `full` profile as high privilege.\n\n- Set `COMPUTER_USE_FS_ROOTS` , even when the client supplies roots.\n- Require approval for destructive filesystem, process, registry, scripting, and external actions.\n- Prefer stdio. The separate HTTP command opens only a loopback listener; remote serving requires an embedding host with authentication and authorization.\n- Treat unauthenticated task IDs as bearer capabilities. Authenticated HTTP tasks are additionally bound to `authInfo.clientId` .\n- Do not rely on MCP annotations as an authorization boundary.\n- `computer://screenshot/latest` is cache-only.\n- MCP logs intentionally exclude arguments, results, secrets, clipboard contents, scripts, and image bytes.\n\nSee [SECURITY.md](/zavora-ai/computer-use-mcp/blob/main/SECURITY.md) for the threat model and disclosure process.\n\n```\nnpm ci\nnpm run build:ts\nnpm test\n```\n\nThe v7.1.0 release gate additionally installs the packed universal tarball, imports every public entry point, tests both MCP protocol eras, and verifies all six native targets. The exact attested tarball is submitted with npm staged publishing for maintainer review and 2FA approval. See the [v7.1.0 release record](/zavora-ai/computer-use-mcp/blob/main/docs/releases/v7.1.0.md).\n\nNative development requires the Rust toolchain and platform SDK:\n\n```\nnpm run build:native\n```\n\nThe release gate runs TypeScript compilation, Node tests, native builds on the supported target matrix, package-content verification, packed-install checks, SBOM generation, and build provenance attestation.\n\nMIT © James Karanja Maina / Zavora Technologies Ltd.\n\nThe opt-in [efficiency helpers](/zavora-ai/computer-use-mcp/blob/main/docs/EFFICIENCY.md) provide lazy tool discovery, bounded accessibility observations, multimodal result projection, explicit retained-image reuse, and cancellable local waits. The [OpenAI Responses example](/zavora-ai/computer-use-mcp/blob/main/agents/openai-agent/agent.mjs) demonstrates these helpers with real image feedback and API usage reporting. Run `npm run measure:efficiency` for reproducible payload measurements. Existing MCP tool schemas and default results remain unchanged.", "url": "https://wpnews.pro/news/show-hn-cross-platform-computer-use-mcp-server-built-in-rust", "canonical_source": "https://github.com/zavora-ai/computer-use-mcp", "published_at": "2026-09-09 19:51:51+00:00", "updated_at": "2026-09-09 20:17:09.919900+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents"], "entities": ["Zavora AI", "MCP", "Node.js", "Rust"], "alternates": {"html": "https://wpnews.pro/news/show-hn-cross-platform-computer-use-mcp-server-built-in-rust", "markdown": "https://wpnews.pro/news/show-hn-cross-platform-computer-use-mcp-server-built-in-rust.md", "text": "https://wpnews.pro/news/show-hn-cross-platform-computer-use-mcp-server-built-in-rust.txt", "jsonld": "https://wpnews.pro/news/show-hn-cross-platform-computer-use-mcp-server-built-in-rust.jsonld"}}