Show HN: Cross-platform computer use MCP server built in Rust

Zavora AI released version 7.1 of its cross-platform computer use MCP server, built in Rust, which exposes 64 stable v7 tools for desktop automation on macOS, Windows, and Linux. The update maintains the v7 API while supporting both MCP 2026-07-28 and legacy 2025 clients, and requires Node.js 20 or newer.

Cross-platform desktop automation for MCP clients on macOS, Windows, and Linux. The server exposes 64 stable v7 tools for screenshots, input, applications, windows, accessibility, scripting, files, processes, registry operations, and virtual desktops. Version 7.1 keeps the v7 tool API intact while serving both MCP 2026-07-28 and legacy 2025 clients with the exact @modelcontextprotocol/ 2.0.0 SDK packages. Node.js 20 or newer is required. Clients that do not support the modern stateless protocol continue to receive the existing v7 behavior. - MCP client roots constrain filesystem tools and filesystem resources. - Resources support subscriptions and notifications/resources/updated . - Successful filesystem operations return readable MCP resource links. - Sanitized MCP logging reports lifecycle and tool outcomes without arguments, results, secrets, clipboard contents, or screenshots. - Approval elicitation identifies the exact tool, target, operation, path, destination, process, registry value, or bounded script involved. - Tools have human-readable discovery titles. - Prompt application arguments support MCP completion. - Dynamic v7 profile changes emit notifications/tools/list changed through the SDK. - Stateless MCP 2026-07-28 requests use server/discover , per-request identity/capability envelopes, cache hints, in-band multi-round-trip input, and subscriptions/listen . - The official io.modelcontextprotocol/tasks extension is implemented for selected long-running read-only tools, including polling, cancellation, TTLs, routing headers, and caller isolation. - A fetch-shaped stateless HTTP handler and a loopback-only HTTP runner are included alongside stdio. - The former v8 preview surface, packages, contracts, migration commands, and remote supervisor have been removed. Requires Node.js 20 or newer. npx -y @zavora-ai/computer-use-mcp@7.1.0 Example MCP configuration: { "mcpServers": { "computer-use": { "command": "npx", "args": "-y", "@zavora-ai/computer-use-mcp@7.1.0" } } } For local Streamable HTTP, run: npx -y --package @zavora-ai/computer-use-mcp@7.1.0 computer-use-mcp-http http://127.0.0.1:3100/mcp The bundled runner refuses non-loopback binds and validates Host and Origin . Remote deployments should embed the fetch-shaped handler behind verified OAuth middleware. The v7.1 npm tarball contains the matching native binary for: - macOS arm64 and x64 - Windows arm64 and x64 - Linux arm64 and x64 On macOS, grant the terminal or MCP host Screen Recording and Accessibility permission. Automation permission may also be requested when run script controls another application. On Windows, the server uses UI Automation, SendInput , PowerShell, and native window APIs. Run at the same integrity level as the applications being automated. On Linux, screenshot and input support depend on the active X11/Wayland environment and installed backend. Run doctor to obtain machine-specific remediation. php flowchart LR Client "MCP 2026 or legacy client" <-- |"stdio or Streamable HTTP"| Entry "SDK v2 serving entry" Entry -- Server "McpServer 7.1 per request/connection" Server -- Registry "64-tool registry" Server -- Protocol "MRTR roots/elicitation, Tasks, subscriptions" Server -- Resources "Prompts and resources" Registry -- Session "Policy, targeting, lock, cancellation" Session -- Native "Rust N-API backend" Session -- Scripts "Bounded AppleScript, JXA, or PowerShell" Native -- OS "macOS / Windows / Linux" Filesystem authority is the intersection of operator configuration and client-declared roots: php flowchart TD Request "Filesystem path" -- Normalize "Normalize and resolve existing ancestors" Normalize -- Env{"Inside COMPUTER USE FS ROOTS?"} Env -- |"No"| Deny "fs root denied" Env -- |"Yes or unset"| Roots{"Inside negotiated MCP client roots?"} Roots -- |"No"| Deny Roots -- |"Yes or unsupported"| Execute "Execute filesystem operation" Execute -- Link "Return resource link" See docs/ARCHITECTURE.md /zavora-ai/computer-use-mcp/blob/main/docs/ARCHITECTURE.md for protocol lifecycles and extension points. See docs/releases/v7.1.0.md /zavora-ai/computer-use-mcp/blob/main/docs/releases/v7.1.0.md for the complete release notes, compatibility boundary, verification evidence, and upgrade guidance. | Capability | Behavior | Compatibility | |---|---|---| | Stateless 2026 transport | server/discover , no initialization/session requirement, identity and capabilities on every request; stdio and fetch-shaped Streamable HTTP | 2025 initialization remains supported | | Roots | 2026 uses in-band input required / roots/list ; legacy requests roots after initialization and on roots/list changed | Ignored when the client does not advertise roots | | Resource subscriptions | 2026 uses subscriptions/listen ; legacy uses resource subscribe/unsubscribe | Reads still work without subscribing | | Resource updates | Emits updates after known state changes, including screenshots, desktop mutations, filesystem writes, and profile changes | Advisory; failures never fail tool calls | | Logging | Emits sanitized initialization, roots, approval, and tool-completion events | Deprecated in 2026 but retained for legacy compatibility | | Elicitation | 2026 returns an exact-scope in-band form request with signed request state; legacy uses elicitation/create | Falls back to approval required when unsupported | | Tasks extension | Server-directed tasks for wait ≥2s, scrape , get ui tree , get app dictionary , and vision-enabled snapshot ; supports tasks/get , tasks/update , and tasks/cancel | Only returned when the request opts into io.modelcontextprotocol/tasks ; polling is the default | | Resource links | Filesystem success results reference computer://filesystem/{encodedPath} | Existing text content is preserved | | List changed | Runtime profile enable/disable operations notify the client | Initial profiles remain unchanged | | Completion | Completes application IDs in relevant prompts and paths in the filesystem template | Empty suggestions on unsupported/unreadable state | | Annotations | All 64 tools expose all four standard behavior hints; resources expose assistant audience and priority | Hints are descriptive, never authorization | | Cache hints | Discovery/list operations are private-cacheable for 30 seconds; live resource reads are not cached | 2026 only | Task status notifications are optional in the extension and are not advertised; clients poll at pollIntervalMs . Sampling, MCP Apps, and authentication extensions are not advertised: this server does not need model delegation or an embedded UI, and remote authentication must be supplied by the embedding host rather than simulated. Legacy roots, logging, and elicitation remain available during the protocol deprecation window. Tasks require an extension-aware host. The core @modelcontextprotocol/client 2.0.0 client negotiates MCP 2026-07-28 but intentionally rejects the extension-only resultType: "task" ; do not advertise io.modelcontextprotocol/tasks from that client unless the host adds a Tasks extension codec. Clients that omit the extension capability always receive the ordinary synchronous CallToolResult shape. | URI | Description | |---|---| | computer://display/main | Main display dimensions and scale | | computer://windows | Visible windows | | computer://frontmost | Frontmost application | | computer://policy | Redacted policy and audit status | | computer://profile/tools | Tools available in the configured maximum profile | | computer://screenshot/latest | Most recent cached screenshot; never captures on read | | computer://filesystem/{path} | Root-confined file or directory content, limited to 1 MiB for files | - diagnose-desktop — inspect permissions and configuration. - fill-form — accessibility-first form filling. - script-first — prefer scripting over physical input. - safe-desktop-task — policy-aware desktop automation. The full profile exposes 64 tools: - Observation: screenshot , zoom , cursor position , get display size , list displays , get frontmost app , list windows , list running apps , get window , get cursor window , snapshot . - Pointer and keyboard: left click , right click , middle click , double click , triple click , mouse move , left click drag , left mouse down , left mouse up , scroll , type , key , hold key , multi select , multi edit . - Accessibility: get ui tree , get focused element , find element , click element , set value , press button , select menu item , fill form , list menu bar . - Applications and windows: open application , activate app , activate window , resize window , hide app , unhide app . - Scripting and advice: run script , get app dictionary , get tool guide , get app capabilities , get tool metadata . - Clipboard and virtual pointer: read clipboard , write clipboard , agent pointer , openai computer . - System operations: filesystem , process kill , registry , notification , scrape . - Virtual desktops: list spaces , get active space , create agent space , move window to space , remove window from space , destroy space . - Administration: doctor , policy status , wait . Use MCP tools/list for the authoritative schemas and annotations. Prefer the least disruptive mechanism: 1. Direct filesystem or system tools. 2. AppleScript, JXA, or PowerShell through run script . 3. Accessibility/UI Automation tools. 4. Coordinate mouse and keyboard input. Use get tool guide and get app capabilities before unfamiliar workflows. Supply target app or target window id for physical input whenever possible. COMPUTER USE PROFILE defines the maximum authority available to the process: | Profile | Intended surface | |---|---| | core | Common observation, input, application, and window tools | | ax | Core plus accessibility tools | | scripting | Core plus scripting and filesystem tools | | windows-admin | Scripting plus process, registry, notification, and desktop administration | | full | All 64 tools; default for compatibility | Embedded hosts may set a narrower active v7 profile through onRegistry . The active profile can never expand beyond the maximum profile, and changes generate MCP tool-list notifications. | Variable | Purpose | |---|---| | COMPUTER USE PROFILE | Maximum tool profile; defaults to full | | COMPUTER USE ACTIVE PROFILE | Initial visible v7 profile within the maximum | | COMPUTER USE FS ROOTS | Comma-separated filesystem allow-list; combined with MCP client roots | | COMPUTER USE ALLOWED APPS | Optional application allow-list | | COMPUTER USE BLOCKED APPS | Application deny-list | | COMPUTER USE REQUIRE APPROVAL | Require approval for mutations | | COMPUTER USE REQUIRE APPROVAL FOR | Comma-separated tools requiring approval | | COMPUTER USE APPROVAL TOKEN | Headless per-call approval token | | COMPUTER USE ELICITATION | Enable host form elicitation when supported | | COMPUTER USE AUDIT LOG | JSONL audit destination | | COMPUTER USE STRUCTURED CONTENT | Set false for legacy text-only results | | COMPUTER USE LEGACY FOCUS TAG | Restore legacy focus suffixes in descriptions | | COMPUTER USE VISION | Set false for text-only operation | | COMPUTER USE PROVIDER | Default screenshot sizing profile | | COMPUTER USE NATIVE PATH | Explicit native module override | | COMPUTER USE SCRIPT ENV ALLOWLIST | Environment names explicitly allowed into script subprocesses | | COMPUTER USE REQUEST STATE SECRET | Stable secret for HMAC-signed 2026 multi-round-trip state; random per process when unset | | COMPUTER USE MAX TASKS | Maximum concurrent Tasks extension jobs per authenticated/client identity; default 16 | | COMPUTER USE TASK TTL MS | Task retention window; default 3600000 | | COMPUTER USE TASK POLL INTERVAL MS | Suggested client polling interval; default 1000 | | COMPUTER USE HTTP HOST | Loopback address for the bundled HTTP runner; default 127.0.0.1 | | COMPUTER USE HTTP PORT | Port for the bundled HTTP runner; default 3100 | js import { createComputerUseServer } from '@zavora-ai/computer-use-mcp/server' const server = createComputerUseServer { profile: 'full', activeProfile: 'core', onRegistry registry { // Host-controlled and automatically emits tools/list changed after connect. registry.setActiveProfile 'ax' }, } The typed client is available from @zavora-ai/computer-use-mcp/client . Stateless HTTP embedding: js import { createComputerUseHttpHandler } from '@zavora-ai/computer-use-mcp/server' const handler = createComputerUseHttpHandler { profile: 'full' } // Pass only authInfo produced by a real verifier. The handler never trusts // an Authorization header on its own. const response = await handler.fetch request, { authInfo } This server can control the desktop and execute scripts with the permissions of its process. Treat the full profile as high privilege. - Set COMPUTER USE FS ROOTS , even when the client supplies roots. - Require approval for destructive filesystem, process, registry, scripting, and external actions. - Prefer stdio. The separate HTTP command opens only a loopback listener; remote serving requires an embedding host with authentication and authorization. - Treat unauthenticated task IDs as bearer capabilities. Authenticated HTTP tasks are additionally bound to authInfo.clientId . - Do not rely on MCP annotations as an authorization boundary. - computer://screenshot/latest is cache-only. - MCP logs intentionally exclude arguments, results, secrets, clipboard contents, scripts, and image bytes. See SECURITY.md /zavora-ai/computer-use-mcp/blob/main/SECURITY.md for the threat model and disclosure process. npm ci npm run build:ts npm test The v7.1.0 release gate additionally installs the packed universal tarball, imports every public entry point, tests both MCP protocol eras, and verifies all six native targets. The exact attested tarball is submitted with npm staged publishing for maintainer review and 2FA approval. See the v7.1.0 release record /zavora-ai/computer-use-mcp/blob/main/docs/releases/v7.1.0.md . Native development requires the Rust toolchain and platform SDK: npm run build:native The release gate runs TypeScript compilation, Node tests, native builds on the supported target matrix, package-content verification, packed-install checks, SBOM generation, and build provenance attestation. MIT © James Karanja Maina / Zavora Technologies Ltd. The opt-in efficiency helpers /zavora-ai/computer-use-mcp/blob/main/docs/EFFICIENCY.md provide lazy tool discovery, bounded accessibility observations, multimodal result projection, explicit retained-image reuse, and cancellable local waits. The OpenAI Responses example /zavora-ai/computer-use-mcp/blob/main/agents/openai-agent/agent.mjs demonstrates these helpers with real image feedback and API usage reporting. Run npm run measure:efficiency for reproducible payload measurements. Existing MCP tool schemas and default results remain unchanged.