windows-terminal
Enables agents to control a QEMU virtual machine through computer-use tools: capture the guest screen, send mouse and keyboard input, scroll, and manage VM lifecycle with start, stop, and status.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@windows-terminalOpen Notepad and type 'Hello from my agent.'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
windows-terminal
A separate PC for your agent. Right inside your terminal.

Unedited terminal capture, rendered from a recorded session (demo/). Boot waits are time-lapsed and labelled.
The guest shown is ReactOS, an open-source Windows-compatible OS, because it can be freely
redistributed. With your own Windows ISO the flow is the same. Full-quality MP4.
windows-terminal runs a real QEMU virtual machine and draws its screen in your terminal. Your keyboard and
mouse go to the guest. Any MCP-capable agent can drive the same machine through nine computer-use tools,
without moving your host mouse, reading your clipboard, or touching your files. It is not a browser recreation
of Windows, and it is not Microsoft's Windows Terminal app.
windows-terminal init --iso ~/Downloads/Win11_ARM64.iso --tpm
windows-terminal up --view # Ctrl+] detaches; the VM keeps running
windows-terminal mcp # hand the same VM to your agentWhat works
Persistent named VMs, each with its own sparse disk, UEFI variables, and optional TPM 2.0.
Legacy BIOS mode (
--boot bios) for older x86 guests: Windows 7 and earlier, ReactOS.Apple silicon acceleration (HVF), Linux KVM, and a TCG fallback for cross-architecture guests.
Kitty graphics in Kitty, Ghostty, and WezTerm; iTerm2 inline images; true-color half-blocks everywhere else (also used under tmux).
Live keyboard, mouse clicks, dragging, scrolling, and resize-aware display.
CLI screenshot, typing, shortcuts, clicks, pointer movement, and lifecycle commands.
Nine MCP computer-use tools. Several viewers and agents can share one VM; monitor access is serialized.
Offline checkpoints (disk, UEFI, and TPM together, verified with SHA256) that restore into a new VM.
None of these: host pointer movement, clipboard access, shared folders, public control ports, automatic downloads, account sign-in, or Windows licensing bypasses.
Related MCP server: mcp-computer-use
Try it in two minutes, no Windows ISO needed
ReactOS boots from a ~300 MB live CD. On Apple silicon it runs emulated (TCG), so allow 1–2 minutes to boot.
curl -LO https://github.com/reactos/reactos/releases/download/0.4.15-release/ReactOS-0.4.15-release-1-gdbb43bbaeb2-x86-live.zip
unzip ReactOS-*-live.zip
windows-terminal init reactos --iso ReactOS-*-live.iso --arch x86_64 --boot bios --memory 1024 --cpus 1
windows-terminal up --vm reactos --viewRequirements
Python 3.11+, QEMU, and a Windows installation ISO that matches the guest CPU. This runs on macOS, Linux, or Linux inside WSL2. Native Win32 hosting is not implemented; the controller uses Unix sockets and POSIX terminal APIs.
For Windows 11, install swtpm and use --tpm. QEMU's firmware, CPU model, and
your ISO must meet that Windows release's requirements. This is an early-stage
project: an actual Windows installation has not been validated here. The
live integration tests boot real QEMU firmware, not Windows.
# macOS
brew install qemu swtpm
# Debian / Ubuntu (ARM hosts also need qemu-system-arm and qemu-efi-aarch64)
sudo apt install qemu-system-x86 qemu-utils ovmf swtpm
# In this checkout
python3 -m venv .venv
.venv/bin/python -m pip install -e .
source .venv/bin/activate
windows-terminal doctorCreate and run
Use your own ISO obtained from Microsoft. Windows is not bundled, downloaded, or activated by this tool. On Apple silicon, use a Windows ARM64 ISO; on Intel/ AMD, use x64. The architecture defaults to your host architecture.
windows-terminal init --iso ~/Downloads/Windows11_ARM64.iso --tpm
windows-terminal up --viewThe viewer starts at the real firmware/installer. Complete Windows setup once inside the guest. If firmware opens its boot manager, select the installation media. Disk boot is preferred on subsequent starts; the installer is the fallback while the disk is empty. You can eject it during installation:
windows-terminal ejectCtrl+] detaches without stopping the VM. Ctrl+C goes to the guest. To use a Windows shortcut that your terminal intercepts, send it from another terminal:
windows-terminal key win+r
windows-terminal type 'notepad.exe'
windows-terminal key enter
windows-terminal type 'Hello from my agent.'
windows-terminal screenshot desktop.png
windows-terminal click 500 300
windows-terminal scroll down --steps 4
windows-terminal downThe viewer recognizes modified navigation keys (for example Ctrl+arrows and Shift+Ctrl+arrows) when the terminal sends standard modified-key sequences. Bracketed pastes are validated before sending anything to the guest: only ASCII text, tabs, and line breaks are accepted, up to 20,000 characters. Unsupported characters or embedded control sequences reject the entire paste, so pasted escape sequences cannot become shortcuts or detach the viewer. Line breaks still press Enter inside the guest; review commands before pasting them.
Typing emulates a US keyboard layout and ASCII text. Unicode text is rejected before any part of the string is sent. Host clipboard integration and text extraction/OCR are intentionally not provided. Screenshot coordinates always refer to the original guest image, not the terminal's downscaled preview.
Isolation and networking
The default --network isolated blocks guest external connectivity, including
internet access. For a guest that needs the internet (including online Windows
setup), explicitly opt in at creation:
windows-terminal init work --iso ~/Downloads/windows.iso --tpm --network nat
windows-terminal up --vm work --view
windows-terminal mcp --vm workNAT is not a host/LAN security boundary. It permits outbound connections and can reach host services and the local network. It publishes no inbound ports. The default isolated mode is safer for untrusted computer-use agents. QEMU is a hypervisor, not a guarantee against malicious-guest escape vulnerabilities.
Every machine gets its own sparse qcow2 disk, NVRAM, and (when enabled) TPM state. The default disk has a 64 GiB logical capacity, not an immediate 64 GiB allocation. Keep disk, NVRAM, and TPM files together; replacing TPM state can make BitLocker-protected data inaccessible. Back up shut-down VMs as a unit.
Offline checkpoints
Save a stopped guest before an agent changes it. Checkpoints include an independent sparse qcow2 disk, private UEFI CODE/VARS, TPM state, and SHA256 integrity checks. They do not include RAM, running processes, installation media, or logs.
windows-terminal down --vm work
windows-terminal status --vm work
windows-terminal checkpoint save clean --vm work
windows-terminal checkpoint list --vm work
windows-terminal checkpoint restore clean --vm work --as recovered
windows-terminal up --vm recovered --viewWait until status says stopped; graceful shutdown may take time. Active or
unknown QMP sessions and busy TPM state are rejected. Prefer a clean guest
shutdown: a checkpoint after down --force is only crash-consistent.
Restore requires a new VM name and never overwrites an existing VM. Failed
copies are cleaned up; the original guest and checkpoint remain untouched.
Checkpoints are immutable: choose a new checkpoint name rather than replacing one.
The restored guest retains its original hardware UUID and TPM identity; do not
run original and restored copies together on the same network or domain.
The installer is detached, so restore is intended for an already installed OS.
Keep Windows/BitLocker recovery keys separately; Windows and BitLocker recovery
have not yet been tested. Checkpoints live at <root>/<vm>/checkpoints/<name>
and consume additional space proportional to used disk data, not logical capacity.
Connect an agent over MCP
Add this stdio server to your MCP client (use the actual absolute executable path):
{
"mcpServers": {
"windows-terminal": {
"command": "/absolute/path/to/checkout/.venv/bin/windows-terminal",
"args": ["mcp", "--vm", "windows"]
}
}
}Tools: screenshot, click, move, type, key, scroll, status, start,
stop. Screenshots are native MCP image content. Tool failures return structured
errors. The server never writes banners or logs to protocol stdout, does not
execute arbitrary host shell commands, and cannot create new VMs or force power
off. Any connected agent can operate the selected guest, so only connect trusted
clients. Guest/web content must not be treated as agent instructions.
The bundled skills/windows-terminal/SKILL.md describes the computer-use loop.
Commands
init [NAME] --iso PATH Create disk/config, never overwrite existing VMs
--arch aarch64|x86_64 Guest architecture (host architecture by default)
--memory 4096 Guest memory in MiB
--cpus 4 Guest virtual CPUs
--disk 64 Sparse disk logical capacity in GiB
--firmware PATH Explicit EDK2 CODE file, with matching VARS beside it
--tpm TPM 2.0 via swtpm
--network isolated|nat Network policy, isolated by default
--boot uefi|bios bios = SeaBIOS + IDE for legacy x86 guests
up [--view] Start; optionally attach viewer (accepts --protocol/--fps)
view Attach to an already-running guest
--protocol auto|kitty|iterm|blocks
--fps 5 Snapshot rate (1–15)
down [--force] ACPI shutdown; --force loses unsaved work
list / status JSON machine state
command Print generated QEMU argv as JSON
eject Eject installer media for the current boot
screenshot PATH Write guest display as PNG
click X Y / move X Y Guest-pixel input
key CHORD / type TEXT Guest keyboard input; type reads stdin if text omitted
scroll up|down Mouse wheel
mcp Serve MCP over stdin/stdout
doctor Read-only prerequisites report
checkpoint save NAME Save complete offline disk/UEFI/TPM state
checkpoint list List immutable checkpoints
checkpoint restore NAME --as NEW_VM
Restore into a new VM; never overwriteMost machine commands accept --vm NAME (default: $WINDOWS_TERMINAL_VM, else
windows). Global --root PATH (before the subcommand, or $WINDOWS_TERMINAL_ROOT)
overrides storage. Otherwise it is
${XDG_DATA_HOME:-~/.local/share}/windows-terminal. VM logs are in
<root>/<name>/qemu.log. Long paths use a private short runtime socket directory.
Limits and troubleshooting
No Windows ISO:
initfails with a concrete error. No fake desktop is substituted.doctor, MCP discovery, and unit tests work without an ISO.No TPM: Windows 11 installations may refuse setup. Install
swtpm, create with--tpm. Existing configurations are intentionally not silently changed.ARM graphics:
ramfbis an unaccelerated firmware/basic framebuffer. There is no GPU acceleration. ARM uses NVMe storage, e1000 networking, and USB input; actual driver compatibility depends on the Windows ISO. Additional signed guest drivers or firmware may be required.Secure Boot: Per-VM UEFI is provisioned, but Microsoft Secure Boot keys are not automatically enrolled. Select suitable firmware and provision keys when your guest requires them. This tool does not bypass Windows setup checks.
Slow VM: Cross-architecture emulation uses TCG and can be very slow. Use a guest matching your host to get HVF/KVM. WSL2 KVM requires nested virtualization.
Shutdown still says stopping: ACPI shutdown is a request; Windows may be waiting on setup or unsaved work. Inspect the viewer.
down --forceis an explicit hard power-off, never an automatic fallback.Viewer/agent overlap: Per-VM advisory locks serialize monitor connections; screen capture releases the lock each frame so agents can act concurrently.
Terminal graphics: Use
view --protocol blocksfor an always-available lower-resolution fallback. Native Win32 terminals and sixel are not supported.Keyboard: ANSI arrows/navigation/function keys, ASCII, Ctrl shortcuts, mouse presses and drags work. OS-reserved shortcuts and arbitrary modified escape sequences may be intercepted by your terminal; use
keyvia CLI/MCP.
Recording the demo
demo/record.py runs zsh in a pseudo-terminal, types the commands, clicks with real
mouse escape sequences, and drives the VM from an MCP client. It saves every byte as
an asciicast (session.cast) plus timing markers. demo/render.py replays the bytes
through a terminal emulator (pyte), draws the viewer's inline images where the
terminal would, and encodes an MP4 with ffmpeg.
pip install -e '.[demo]' # adds pyte; ffmpeg must be on PATH
python demo/record.py --iso ReactOS-0.4.15-release-1-gdbb43bbaeb2-x86-live.iso --out demo/out
python demo/render.py demo/out --output docs/demo.mp4 --poster docs/poster.pngDevelopment
python3 -m unittest discover -s tests -v
WINDOWS_TERMINAL_LIVE_TESTS=1 python3 -m unittest discover -s tests -p 'test_live.py' -v
PYTHON=.venv/bin/python sh scripts/verify-release.shThe release check builds a wheel, installs it and its dependencies in a temporary
virtual environment, then tests version reporting, host diagnostics, and MCP
initialization/tool discovery from outside the checkout. It needs package-index
access but never creates a VM. Successful artifacts and SHA256 checksums land in
dist/; the temporary environment is removed automatically. Install the wheel
with python3 -m pip install dist/windows_terminal_vm-0.2.0-py3-none-any.whl.
The live suite boots disposable ARM and x86 QEMU firmware guests, tests framebuffer capture, keyboard/mouse input, MCP screenshots, terminal detach/restoration, and TPM startup/persistence across restarts and offline checkpoint restoration, then stops them. It does not download/install Windows or touch your existing virtual machines. Windows installer completion, Windows-specific input behavior, TPM-backed Windows boot, and visual fidelity in each physical terminal still need manual validation.
On ARM macOS with HVF, TPM physical-presence-interface memory is disabled to avoid an unaligned memory-map failure. TPM 2.0 emulation remains enabled; Windows physical-presence operations have not been validated. Firmware copies preserve zero-filled regions as sparse extents to avoid wasting host disk space.
Available Tools
9 toolsclickCDestructive
Click a guest pixel, without moving the host pointer.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes | ||
| count | No | ||
| button | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, and openWorldHint=true, so the agent knows this mutates guest state. The description adds the useful detail that the host pointer is untouched, which is behavior beyond the annotations, but it says nothing about what the click affects in the guest, coordinate origin, or default button.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence, front-loaded with the action and immediately followed by the key constraint. There is no filler, though the brevity comes at the cost of the missing parameter detail noted above.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, four-parameter tool with zero schema description coverage and no output schema, the description is far too thin. An agent cannot determine click count, button, coordinate frame, or any prerequisite session state without guessing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across four parameters, so the description must carry the semantics and largely does not. 'Guest pixel' weakly implies that x/y are pixel coordinates in guest space, but count (1 vs 2 clicks), button (left/middle/right), and default values are never mentioned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and target: 'Click a guest pixel', and adds a differentiating clause ('without moving the host pointer') that separates it from the sibling 'move' tool. It is clear what action occurs, though 'guest pixel' assumes knowledge of the guest/host coordinate split.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance, no preconditions (e.g. whether a session must be started first via 'start'), and does not name alternatives such as 'move', 'type', or 'key'. The only implicit routing signal is the contrast with host-pointer movement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keyBDestructive
Press a key or chord, e.g. win+r, ctrl+a, ctrl+alt+delete, enter.
| Name | Required | Description | Default |
|---|---|---|---|
| chord | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, so the description's burden is lower, yet it adds nothing about effects — that a chord like ctrl+alt+delete can alter or lock system state, or what happens if the target window lacks focus. The examples are format guidance, not behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with compact, high-value examples and no filler. Every token earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema this is close to sufficient, but it omits where the keypress lands (focused window), platform-specific key names, and how it differs from typing text. Those gaps matter for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and "chord" has no type-level description, so the description carries the load by demonstrating the expected syntax ("win+r", "ctrl+a", "ctrl+alt+delete", "enter"). That is a meaningful addition beyond the bare string schema, though modifier ordering and valid key names are never stated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a concrete verb+resource ("Press a key or chord") and illustrates with real chord forms. It does not, however, distinguish this from the sibling "type" tool, so an agent must infer that "type" writes text while "key" emits a single keystroke or combination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the examples; there is no explicit statement of when to call this versus "type" or when a chord is inappropriate. An agent can reasonably infer the intent, but nothing routes it away from the wrong sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
moveCDestructive
Move the guest pointer to a pixel.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=true, and openWorldHint=true, so the safety profile is covered structurally. The description adds nothing beyond them: it does not say whether coordinates are absolute screen pixels or guest-relative, what happens if x/y fall outside the guest resolution, or whether out-of-bounds values error or clamp.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is efficient rather than padded, though the terseness leaves little structure for the agent to anchor on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-required-parameter input tool with no output schema and a destructive annotation, the description should at minimum pin down the coordinate frame and bounds behavior. As written, the agent knows what the tool does conceptually but not enough to call it correctly in a specific guest environment.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for both required parameters, so the description carries the full burden. "To a pixel" hints that x and y are pixel coordinates, but gives no origin, no unit conventions relative to guest resolution, no valid range, and no note that both are mandatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ("Move") with a specific target ("the guest pointer") and an outcome ("to a pixel"), so an agent can tell it apart from click/scroll/type siblings without opening a schema. It stops short of explicitly stating the move does not click, which is the main disambiguation an agent needs against the nearest sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of prerequisites (e.g., that the session must be started first), and no statement about whether a move must precede click or whether hovering has side effects. The agent must infer the tool's role from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screenshotARead-only
See the real guest desktop. Coordinates for input are pixels in this image.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, so the safety profile is covered. The description adds non-obvious behavioral context beyond that: the image reflects the real guest desktop and defines the shared pixel coordinate space used by the input tools, which is the critical fact for interpreting results. It omits freshness/timing (e.g., whether a delay is needed after an action before re-capturing).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler, and the core capability is front-loaded ahead of the coordinate detail. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, non-destructive capture tool with no output schema, the description covers what is returned (an image of the guest desktop) and how its pixel space maps to other tools' inputs. The remaining gap is refresh/freshness behavior after prior actions, which is minor given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline of 4 applies. The description correctly adds no parameter detail and instead spends its words on coordinate semantics, which is the relevant information for a parameterless capture tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"See the real guest desktop" states the resource and action precisely enough for an agent to understand this captures a live view of the guest machine, and "this image" confirms an image is returned. It does not explicitly name a sibling, so differentiation from status is left implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The coordinate sentence implies the intended workflow: capture this first, then feed pixel coordinates to click/move/scroll. However, it never states that guidance directly ("call before click"), nor when not to use it or how often to refresh, leaving the agent to infer the sequencing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scrollCDestructive
Scroll inside the guest.
| Name | Required | Description | Default |
|---|---|---|---|
| steps | No | ||
| direction | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, openWorldHint=true, and destructiveHint=true, but the description explains none of this — notably why a scroll is flagged destructive, whether it can trigger hover actions or change application state, or where the scroll is anchored. Beyond the annotations, the one sentence adds no behavioral context at all.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is front-loaded and free of filler, but its brevity stems from under-specification rather than economy. There is no wasted wording, yet almost nothing is said.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-changing automation tool with no output schema and zero parameter documentation, one four-word sentence is wholly inadequate. Nothing tells the agent what the call returns, what gets affected, or how to size a scroll.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden and provides nothing: "steps" is undocumented in meaning, unit, and bounds (1–100), and "direction" values are only implicitly conveyed by the word "scroll". No default behavior when steps is omitted is described.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Scroll inside the guest" names a specific verb, but the object of the scroll and the meaning of "the guest" are never defined. An agent can infer it is a UI-automation scroll from siblings like click, move, and screenshot, yet nothing in the description distinguishes this tool's scope from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of prerequisites (e.g., a running session or focused window), and no reference to alternatives among the eight siblings. The agent must guess the context in which scrolling is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
startADestructive
Start this previously configured Windows VM. Does not create or install Windows.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=true, so the agent knows this is a state-changing, externally visible operation. The description usefully adds that it will not provision or install an OS, which prevents a common misconception, but it never addresses the destructive flag, idempotency, or whether the call blocks until the VM is ready.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and immediately followed by the key exclusion. No filler and nothing that could be trimmed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter action the description covers the essentials, and annotations carry the safety profile. It falls short on operational details an agent would want for an open-world, destructive operation: whether the call waits for readiness, what happens on an already-running VM, and what the return looks like (there is no output schema to fall back on).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate and no risk of a parameter mismatch. The baseline for a no-parameter tool applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (start) and resource (Windows VM) and scopes it with 'previously configured'. The opposite sibling (stop) is implicitly contrasted, though it is never named, so differentiation relies on the reader inferring it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'previously configured' implies a prerequisite, and 'Does not create or install Windows' states one boundary. However, there is no explicit guidance on when to use this versus stop/status, no statement about behavior if the VM is already running, and no stated preconditions such as authentication or setup.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statusBRead-only
Read this VM's status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=true, so the safety profile is fully covered by structured data. The description adds nothing beyond that: it does not say whether the call is cheap or slow, whether it polls a remote host (relevant given openWorldHint), or what the response contains. With no output schema, the description was the only place to disclose return shape and it does not.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler, and the key noun phrase is front-loaded after the verb. It is efficiently written; the brevity is a symptom of missing content rather than of wordiness, which is penalized under contextual completeness instead.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool, the surface area is small, so the description is almost adequate. The critical gap is that there is no output schema and the description does not describe what 'status' returns, leaving the agent unable to plan how to use the result – this is the one thing a status tool's description must supply.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain and the baseline of 4 applies. Nothing in the description misleads about inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ("Read") with a specific resource ("this VM's status"), which cleanly separates it from the action siblings (click, move, type, scroll, start, stop) that manipulate the VM rather than report on it. It stops short of 5 because "status" itself is undefined – an agent cannot tell whether this returns power state, health, connection info, or a full metadata blob.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no mention of prerequisites, and no reference to any alternative or companion tool. The only hint is implied: an agent would infer it should call this before start/stop to check the VM's current state, but that inference is left entirely to the reader.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stopADestructive
Request a graceful guest shutdown. Never forces power off.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true; the description adds genuinely new behavioral information that this is a cooperative ACPI-style request and never a forced power-off, which qualitatively changes how an agent should reason about the risk. It still omits whether the call blocks until shutdown completes, timeouts, and what happens to running workloads, so it is not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and immediately qualified by the most important constraint ('Never forces power off'). Nothing is wasted or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description covers the essential semantics of a graceful versus forced shutdown. It is only slightly short of complete because it does not say whether control returns immediately or after the guest actually stops, which matters for sequencing follow-up calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline of 4 applies. The description correctly implies no arguments are needed to trigger a guest shutdown.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Request a graceful guest shutdown') and a clear resource (the guest), which is immediately distinguishable from the sibling 'start' and the observation tools like 'status'/'screenshot'. It stops short of naming a sibling explicitly, so it lands at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the tool for shutting the guest down, but there is no statement of when to prefer it over other approaches, no prerequisite conditions, and no guidance on what to do if the graceful request is ignored. No exclusion or alternative is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
typeADestructive
Type US-layout ASCII into the guest's focused application. Does not use the host clipboard.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, so safety is partially covered; the description adds genuine behavioral context by flagging the ASCII/US-layout restriction (non-ASCII input is a risk) and that the host clipboard is untouched. It does not say what happens on non-ASCII input, whether Enter is pressed, or how focus is established, so behavior under failure stays opaque.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and immediately followed by the distinguishing constraint. Nothing is redundant or padded relative to a one-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A simple tool with no output schema, so return values need no explanation. However, given destructiveHint=true, the description should clarify the irreversible side effects (typing into a focused app can submit commands) and the focus precondition; both are left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With a single parameter at 0% schema description coverage, the description supplies the key semantic: the text must be US-layout ASCII, which is essential for correct invocation. The schema's maxLength of 20000 is not echoed or explained in the description, leaving chunking behavior for long text unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and target: 'Type US-layout ASCII into the guest's focused application,' and adds a negative scope claim ('Does not use the host clipboard') that distinguishes it from a paste-style operation. It stops short of distinguishing it from the sibling 'key' tool, which is the nearest ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the clipboard note hints this is for text entry where clipboard usage is undesirable, and 'focused application' implies a focus precondition. There is no explicit when-to-use vs 'key' (single keystrokes, shortcuts, non-ASCII keys) and no statement of when to prefer the clipboard approach instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.2.0- First observed
click - First observed
key - First observed
move - First observed
screenshot - First observed
scroll - First observed
start - First observed
status - First observed
stop - First observed
type
TDQS
Scored across 9 tools
Each tool targets a clearly distinct action: viewing (screenshot), pointer input (click, move, scroll), keyboard input (type, key), lifecycle (start, stop), and observation (status). There is no meaningful overlap; click vs. move vs. scroll are cleanly separated by intent and description.
The set follows a consistent single-word imperative style (click, move, type, key, scroll, start, stop) with only two noun-like names (screenshot, status). This is a minor deviation and remains highly predictable.
Nine tools is well-scoped for controlling a Windows VM, and each tool earns its place across input, observation, and lifecycle control. There are no redundant or trivial tools.
The surface covers the core lifecycle (start/stop/status), screen observation, and essential input methods. Minor gaps exist, such as drag/double-click support and clipboard-based paste, but agents can work around them with available primitives.
Maintenance
Related MCP Connectors
214 tools for AI agents over one MCP endpoint: image, video, audio, 3D, data, storage, mail, GPUs.
Hosted MCP with 91 agent tools: X, domains, SEO, Maps, Trends, Search, YouTube, TikTok, and more.
Eyes and hands on real Windows PCs — observe, click, type via Glasswarp API.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA framework-agnostic computer-use MCP server that exposes core desktop operations (screen capture, mouse, keyboard, and file access) as standard MCP tools, enabling any MCP-compatible agent to drive a computer.1,698 npmMIT
- AlicenseAqualityCmaintenanceEnables MCP-speaking clients to control a real desktop via the computer_use tool, including clicking, typing, scrolling, dragging, key combos, app focus, and screen/accessibility capture. It also provides a verdict system that verifies whether input actions had their intended effect, with configurable approval modes.1MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to capture multi-monitor screenshots with coordinate grids and perform mouse, keyboard, scrolling, dragging, and window-management actions on Windows via MCP tools or CLI. It provides pixel-accurate desktop automation for computer-use agents.MIT
- AlicenseNot gradedqualityAmaintenanceGives AI agents full control of a Windows computer over MCP through 63 native tools — screenshots and UI trees for vision, mouse/keyboard input, Chrome control via CDP, plus files, terminal, processes, and SSH/SFTP. The agent can look at the screen, click, type, launch apps, run commands, and verify each step with a fresh screenshot.47MIT