OpenCU

Why OpenCU

It works beside you. On macOS, input goes to the target app's process and window. Your cursor stays where it is and the app in front keeps the keyboard.

It can have a screen of its own. Start the agent desktop and the agent works on a virtual display (macOS) or in a separate session (Windows), which you watch in an ordinary window.

You stay in charge. There is always a Stop button. On Windows and Linux a physical Escape also stops it, and it will not take the foreground within 10 seconds of your last input. A stopped connection never restarts on its own.

It is measured. On Windows tasks that can only be done through the UI, the same agent passed 7 of 8 trials with OpenCU and 2 of 8 with a shell and screenshots. Details below.

It is yours. MIT licensed, with no account, no proprietary runtime and nothing hosted. The agent you already use brings the model.

Related MCP server: open-computer-use

Install

Windows · PowerShell, as your normal user, no administrator rights

irm https://github.com/Daily-AC/opencu/releases/latest/download/install.ps1 | iex

Linux · x86_64, X11 desktops

curl -fsSL https://github.com/Daily-AC/opencu/releases/latest/download/install.sh | sh

macOS · Apple silicon, macOS 14 or later, Node.js 22+ and Command Line Tools

git clone https://github.com/Daily-AC/opencu.git && cd opencu
npm ci --ignore-scripts && npm run build
./bin/opencu setup    # grant Accessibility and Screen Recording once

Run opencu doctor to check an installation. Platform guides: macOS · Windows · Linux.

Connect your agent

OpenCU is a stdio MCP server. The command to register is:

# Claude Code
claude mcp add --scope user opencu -- /path/to/opencu/bin/opencu

# Codex
codex mcp add opencu -- /path/to/opencu/bin/opencu

Any other MCP client:

{
  "mcpServers": {
    "opencu": { "command": "/path/to/opencu/bin/opencu" }
  }
}

Then ask your agent to do something in an app. It starts by reading the app with get_app_state.

What the agent can do

Input requires a fresh observation of the same app, and every error starts with a stable code such as STOPPED_BY_PERSON. Details are in Tools and the engine contract.

Measured

With and without OpenCU. The same agent and model, with a shell and screenshots alone or with OpenCU added:

On the scriptable tasks the shell-only agent wrote LibreOffice and OBS scripts instead of using the UI; two of OpenCU's three failures there were a modal-dialog defect fixed in 0.3.2. Evidence: Windows, Linux.

Against open-computer-use. The same agents, models and tasks with OpenCU and with iFurySt/open-computer-use 1.1.2 at its default settings:

• Linux: the two Firefox tasks took OpenCU 244 and 96 seconds (median) and open-computer-use 872 and 552. open-computer-use did not list Firefox until the agent turned on the AT-SPI bus itself, and in one trial its set_value and type_text left the Firefox entries empty without an error.

• Windows: in all eight open-computer-use trials the agent also wrote its own Win32 input code, and its four passes completed input that way. It wrote none with OpenCU. open-computer-use ran behind a bridge on the VM (1.5 to 7 seconds per call), so its Windows timings are not comparable.

• macOS: both passed the same four tasks. On those, the agent took 544 seconds in total with OpenCU and 1,498 with open-computer-use; median click time was 292 ms against 2,029 ms. The OpenCU build in that VM was 0.2.0.

The samples are small and each platform used one model. We did not test open-computer-use's locked-screen mode, its background input on covered Chrome windows, or its global pointer setting (evidence).

Platforms

Stopping it

• macOS: the V in the menu bar has Stop. In agent desktop mode, the preview's Stop button does the same.

• Windows and Linux: a physical Escape stops input for the rest of the connection, and your own input during an action stops that action. The Windows agent desktop also has a Stop button.

• A person's stop is final for the connection. Agents must never reconnect around it.

OpenCU is a person-facing brake, not a sandbox: the agent's apps share your account and files, and any local process that can run opencu uses its permissions.

Limitations

• macOS: source builds only, Apple silicon only. macOS asks about once a month whether OpenCU may keep capturing the screen. It cannot operate a locked Mac.

• Windows: the package is unsigned, so SmartScreen or Defender may warn. Outside the agent desktop, input uses the foreground.

• Linux: X11 only; Wayland is refused. Input uses the foreground.

• Custom-drawn apps such as Blender, and windows in the Stage Manager strip, need the foreground.

The full list, with measurements, is in Limitations.

Documentation

• Platform guides: macOS, Windows, Linux

• Tools and the engine contract, with the Windows and Linux contracts

• Host integration, for programs that start OpenCU on an agent's behalf

• Limitations and measured behavior

Development

npm test
python3 scripts/test-native.py
node scripts/verify-gui.mjs

verify-gui.mjs builds two disposable AppKit fixtures, keeps one in the foreground and operates the other in the background through the MCP server. On Windows, node scripts/verify-gui-win.mjs uses disposable WinForms and Chrome fixtures and takes the foreground.

python3 scripts/package-opencu.py builds a self-contained archive with Node and the MCP dependencies for your own Macs, signed with your local identity, and python3 scripts/verify-release.py checks it offline.

License

Original OpenCU code is available under the MIT License. Bundled open source dependencies retain their own licenses. No license for proprietary third party software is included or implied.