YourHand

Your AI. Your Hand.

Open-source Windows device control through a permission-aware MCP server.

Overview · Get started · Documentation · Roadmap · Contributing · Security

Release status: source preview, not a production-ready installer. This repository publishes a separately reviewed community source snapshot. The official hosted YourHand service and its Windows installer are separate deployments. Do not deploy this checkout over an existing installation or connect it to a production customer database. See what works and what remains.

Overview

YourHand connects an authorized Windows computer to an account-scoped control plane that exposes MCP tools to compatible clients. The goal is to let people work with their own machines through natural-language assistants without handing control of one user's devices to another.

The community source includes a web dashboard, account/device ownership and sharing logic, an MCP/HTTP Core, a Windows Agent, a C# native UI helper, operation journaling, scoped usage telemetry, and isolated regression tests. The architecture explains each component and its trust boundary. Source availability does not imply that every listed tool, device feature, installer, or marketplace listing has passed an end-to-end production test.

Who this is for

Developers exploring agentic computer interaction, Windows automation maintainers, MCP integrators, and organizations testing authorized device-control workflows on disposable, non-production machines.

Design principles

• Your device, your authorization: pairing and sharing are per account; actions must be limited to explicitly authorized devices.

• Human oversight: operations that may change external state need appropriate control. Protected Windows desktops and credentials must not be bypassed.

• Reliable outcomes: a timed-out state-changing action is outcome unknown, not permission to repeat it blindly.

• Privacy by default: do not collect or publish customer files, credentials, screenshots, raw tool inputs or private session details.

• Open source, honest status: source code, tests and documented limitations are public; missing binaries and unverified flows are identified rather than hidden.

Related MCP server: Personal Device Agent

What is included?

Get started

Prerequisites: Windows for native helper integration; Node.js 24+ and npm; a local development-only directory; .NET Framework C# build tools for the optional native helper. Any OAuth-enabled web demo requires your own Google OAuth configuration.

git clone https://github.com/archahmedzaki/YourHand-Community.git
cd YourHand-Community
npm ci
npm test
npm run test:privacy

For a local lab only, copy .env.example to an untracked .env, review each option, then run npm start. The server binds its development ports to loopback; this is not a secure internet deployment by itself. A working sign-in, public HTTPS origin, remote device enrollment and packaged Windows installation are not automatically provisioned by these commands. Read the development setup, configuration and known limitations before proceeding.

Documentation

Open source and commercial use

The community source is distributed under GNU AGPL-3.0-only; see LICENSE. Its copyright license permits commercial use under its terms. The official hosted service is a separate offering. Any distinct proprietary edition may use only source for which the maintainer holds appropriate independent licensing rights.

Contributors retain ownership. The maintainer has adopted an individual non-exclusive CLA v1.1 expressly covering AGPL and separately licensed commercial/proprietary use of original contributions, and published its versioned signing text. Repository-scoped CLA consent automation is active and required on main: an unsigned PR failed as expected. The hosted app's account-wide OAuth was declined; the narrow-permission PR-comment signing procedure does not access the original private repo. A real signed-contributor PR test and rights-holder review remain required before outside code is merged. A company-owned contribution also requires authorized rights-holder permission. The CLA was not independently certified by a lawyer. See signing activation and licensing policy.

Community and safety

Please use GitHub Issues for sanitized bug reports and discussions, following our Code of Conduct. Never post pairing tokens, device identifiers, API keys, customer screenshots, databases or service logs. Security problems should follow private reporting instructions, not public issues.

If you would like to support ongoing development, see SUPPORT.md. Donations are optional; there is no active PayPal link in this repository yet, and donating does not purchase access or support privileges.

Developed by Ahmed Zaki and the YourHand contributors. YourHand is not affiliated with or endorsed by OpenAI, Microsoft or Google. Compatible client availability and official marketplace approval are separate matters.