NexusWindows for Antigravity
NexusWindows for Antigravity lets an AI agent observe and operate Windows desktop applications in the background through five MCP tools.
List windows: enumerate open windows with hwnd, title, process, position, and foreground state; optionally group by application.
Inspect a named window: read its UI Automation tree as text lines with roles, names, values, states, and coordinates; optionally filter, zoom, annotate, or capture a WebP screenshot without bringing the window forward.
Act in batches: click, double-click, right-click, type, set, clear, check/uncheck, select, expand/collapse, use menus, send keys, scroll, drag, hover, wait, and focus—with verified read-back and stop-on-failure behavior.
Launch applications/documents/folders: open apps, files, folders, scripts, shortcuts, or settings pages and read back the opening.
Close windows: close a named window cleanly and report any save prompt without answering it.
Operate safely in the background: use UI Automation and Win32 messages first, keep the user’s foreground window and input untouched, fall back to real mouse/keyboard only with
foreground=True, and enforce guardrails such as named-window targeting, ambiguity refusal, password-manager exclusion, UAC/sign-in refusal, confirmation for sensitive actions, user-interruption detection, and emergency stop.
Packages Windows desktop computer-use as a plugin for Google Antigravity (Gemini), giving the agent five tools (windows, look, act, launch, window) to inspect and drive native Windows applications in the background — enumerating and closing windows, reading screen elements as labeled text, batching clicks/typing/menu/key actions with verified results, and launching apps, documents, folders or scripts — while the user keeps their mouse, keyboard and foreground window.
NexusWindows for Antigravity
This repository is archived. NexusWindows for Antigravity now lives in the single NexusWindows repository, folder
agy/, with the common engine and the other profiles: https://github.com/pironjulien/NexusWindows. Install it through NexusSystem. This copy is kept read-only for earlier installs.


Windows computer use for Antigravity, in the background. An MCP server (nexus-windows-antigravity) that lets Google
Antigravity (Gemini) see and operate Windows desktop applications while the user keeps their mouse, keyboard and
foreground window. Built for a fast model: one look, then one batch of steps with label targets, and every reply
says what to do next.
Version 3.6.0 · Windows 10/11 · Python 3.11+ · MIT licence
Part of the Nexus family: NexusWindows (Claude · Codex · Antigravity), NexusBrowser (repo), NexusAndroid (repo). Project page: julienpiron.fr/nexuswindows.
Why
Screenshot-and-click computer use moves the real cursor and brings windows to the front, so the person at the PC has
to stop working while the agent acts. Most Windows applications can be driven without that: native controls accept
window messages and modern frameworks expose UI Automation. This server acts in the background first, reads the
effect back, and only falls back to the real mouse or keyboard when the step allows it (foreground=True).
Related MCP server: Jev Computer Use
NexusWindows family
Three MCP servers, one per agent, built separately because each model needs its tools shaped for it, with the same promise: the user keeps their mouse, keyboard and foreground window, and every action is read back.
Claude | Codex | Antigravity | |
Install |
|
|
|
Package | |||
Tools |
|
|
|
Repository |
Every step reports ✓ verified, = already done, ~ unknown (never replayed) or ✗ failed or refused. The three share the guardrail policy, the foreground token, the emergency stop (Ctrl+Alt+Shift+Esc), a common journal format and a common bench.
Installation
Requirements: Windows 10 or 11 and Google Antigravity. Nothing else to
install by hand: the command below installs uv with winget (Windows' own package
manager, package astral-sh.uv), which brings Python 3.14 and the server from
PyPI. No script is downloaded and run.
Open PowerShell (Start menu, type
PowerShell, Enter).Paste this line and press Enter:
winget install --id astral-sh.uv -e --accept-source-agreements --accept-package-agreements; $env:Path = [Environment]::GetEnvironmentVariable('Path','User') + ';' + [Environment]::GetEnvironmentVariable('Path','Machine'); uvx --python 3.14 nexus-windows-antigravity@latest install(uv already installed:
uvx --python 3.14 nexus-windows-antigravity@latest installis enough.)Restart Antigravity. The
nexus-windowsplugin appears under Customizations > Installed, with its five tools and the agent guide. Ask for example: "In Notepad, behind my window, type a shopping list and save it on the desktop."
What the install command does: it writes the nexus-windows plugin into
%USERPROFILE%\.gemini\config\plugins\nexus-windows, the folder Antigravity loads plugins from: the agent guide
(SKILL.md),
the plugin manifest, and mcp_config.json, which declares the server once at its latest version
(uvx --python 3.14 nexus-windows-antigravity@latest): each Antigravity start runs the newest published version. It
removes an older manual declaration of the same server
from the global mcp_config.json; other servers, plugins and Antigravity settings are never touched. A plugin is
enabled by default; if you turned it off, it says so and leaves your choice.
Update: automatic, at the next Antigravity start. Installed with 3.1.4 to 3.1.7 (pinned version): run the line once more.
Check:
uvx --python 3.14 nexus-windows-antigravity install --check(writes nothing).Remove:
uvx --python 3.14 nexus-windows-antigravity uninstall.
Edit %USERPROFILE%\.gemini\config\mcp_config.json (in the Antigravity IDE: agent panel … > MCP Servers >
Manage MCP Servers > View raw config):
{
"mcpServers": {
"nexus-windows-antigravity": {
"command": "uvx",
"args": ["--python", "3.14", "nexus-windows-antigravity"],
"env": { "PYTHONUTF8": "1" }
}
}
}The agent then has the tools but not the guide; the plugin is the recommended way.
With Git and PowerShell 7:
git clone https://github.com/pironjulien/NexusWindows-Antigravity.git
cd NexusWindows-Antigravity
pwsh -NoProfile -File install.ps1The Python environment, logs and screenshots then live in %USERPROFILE%\.nexusagy (outside the clone), and the
plugin's mcp_config.json starts the server from the clone (scripts/start-computer-mcp.ps1). verify.ps1 (or
install.ps1 -CheckOnly) checks the environment and the plugin without changing anything.
Tools
Five listed MCP tools, named like the other NexusWindows tools (Claude, Codex); the older names (computer_look,
computer_act, computer_click...) stay callable as unlisted aliases.
Tool | Purpose |
| Application windows ( |
| One line per element |
| Several steps in one call (click, type, check, uncheck, select, menu, keys...), each read back: ✓ = ~ ✗ |
| Open an application, document, folder, script or shortcut; the opening is read back |
|
|
Tool descriptions, server instructions, tool and parameter names are in English; tool replies are in French.
What it does
Designed for Gemini: golden rule look, then act in one batch with label targets; every action reply carries a one-line
next(✓ done · = already done, do not redo · ~ effect not seen, look at the attached image · ✗ failure, cause and what to try) and, when the effect was not read back, a WebP image of the window (common Nexus image rule: ≤ 2000 px and 2.56 MP, lossless up to 500 KB, never over 500 KB; not attached again when the screen is unchanged;look(zoom=box_2d)enlarges an area for small text). A batch identical to one sent in the last 10 s on the same window without alookin between is refused (repeat=trueforces it).Background first, even with
foreground=True: abox_2dor (x, y) target is mapped to the element under the point in the window's own UI Automation tree (covered windows included) and handled like a label target; a click on a text field retains it, sotypewithout target,ctrl+a,ctrl+vand erase keys become background writes read back; plain keys are posted (WM_KEYDOWN/WM_KEYUP) in Win32, WinForms and WPF. Real mouse and keyboard only as a fallback withforeground=True; otherwise an explicit refusal (needs_foreground) and nothing is sent.Per UI family: Win32 → direct messages (
BN_CLICKED,BM_SETCHECK,EM_REPLACESEL,CB_SETCURSEL/LB_SETCURSELwith their notifications, menuWM_COMMAND); WinForms → UI Automation then messages; WPF, UWP, Chromium → UI Automation only. Never UI Automation Invoke on a Win32 button (its proxy activates the window) nor Select on a Win32 list (silent).One cross-process read: the window-scoped UI Automation tree is read in one round trip (
IUIAutomationCacheRequest+BuildCache,AutoSetFocus = False). A truncated or failed read is reported (uia.status,warning), never a silent empty list.Read-back after every action:
verifiedtrue/false/None from a real read (field value, check state, selection, focused element, window title, image);successis never true on "command sent" alone. Steps accept a postconditionexpect(already true: step skipped withalready: true; false after: step failed). A batch stops at the first failed or unverified step, before sending the next action, with no automatic replay. A verified postcondition establishes the effect and allows the batch to continue; an unknown effect requires observation before preparing the remaining steps.The user's physical input via Raw Input (injected input ignored): wait for a pause before any real mouse or keyboard action, and stop at the next checkpoint if the user touches keyboard or mouse (
interrupted_by_user).Guards in the code, not only in the instructions: the window is always named (never the foreground one by default, ambiguous titles refused with the candidates); an ambiguous label is refused with the candidates; the target window is read back in the foreground right before every
SendInput; password managers (KeePass, KeePassXC, Bitwarden, 1Password, Dashlane, NordPass, RoboForm, LastPass) are never looked at, captured or driven; the sign-in screen, lock screen and UAC prompt are refused. An action labelled pay, buy, order, transfer money, send, publish, delete permanently, uninstall, format, reset, cancel a subscription, erase data or make a repository public needsconfirm: trueon the step, and so does any key,submitor coordinate click that would trigger one.NEXUS_AGY_CONFIRM=offin the MCP server environment turns confirmation off entirely (default: on).Clipboard: saved in all its formats and restored; the text put there is excluded from Win+V history and cloud clipboard. Used only as a last resort for typing (multi-line or more than 300 characters).
Agent at work: while an action runs (
act, opening, closing, focusing and the action aliases; never the reads), a small logo spins on itself in the bottom-right corner of the driven window's screen, like a game loading screen (the logo and its shadow only, no halo), and goes away 1.6 s after the last action. Always on top, borderless, click-through, never activated, absent from the taskbar and excluded from screen captures (busy_indicator.py).NEXUS_WINDOWS_INDICATOR=0turns it off.Shared with the other desktop agents of the PC: foreground token (
%USERPROFILE%\.nexus\foreground.lock) and emergency stop (Ctrl+Alt+Shift+Esc,%USERPROFILE%\.nexus\stop), the same file protocols as NexusWindows for Claude.
Common bench of the NexusWindows family (October 25, 2026)
The three editions are measured together by the family's common bench: 55 tasks on lab windows (Win32, WinForms, WPF, Tk, Electron and Edge, plus launching an application behind a maximized window), three rounds each, every lab window covered by another window, run only while nobody uses the PC (a run stops and is not counted when the user comes back). The effect is judged by the application itself, never by the tool's report. "Without intrusion" counts an effect only when the user's foreground window and cursor stayed untouched.
165 trials (55 tasks × 3) | Claude 3.2.2 | Antigravity 3.1.7 | Codex 3.1.4 |
Exact effect | 120 | 119 | 120 |
Exact effect without intrusion | 114 | 113 | 113 |
False success (reported done, the app got nothing) | 0 | 3 | 0 |
Median / p95 time per task | 695 / 5179 ms | 702 / 3063 ms | 402 / 2909 ms |
The three false successes of this edition (Ctrl+K in Electron) and its missed WinForms context menu are fixed in 3.2.2. In this run the Electron lab published no page once covered, so every Electron task failed for all three tools; the lab is fixed and Electron will count at the next run. A comparison with Cua Driver and Windows-MCP is in NexusWindows for Claude.
Architecture
Path | Role |
| MCP server |
| Windows engine: windows, UI Automation, Win32 messages, capture, actions and read-back |
| One-round-trip UI Automation reads, native control messages |
| The user's presence (Raw Input), batch guard, shared emergency stop |
| Shared foreground token and guard-rail policy, common to the author's desktop agents (also used by NexusWindows for Claude). Vendored in the public copy; in the author's setup they live in a sibling |
| Antigravity plugin and the agent guide ( |
| Unit tests (pytest) and the real desktop validation |
Privacy
NexusWindows for Antigravity runs entirely on your PC. It has no account, no telemetry and no analytics. Its only network
request of its own is a version check: at most once a day, a GET of https://pypi.org/pypi/nexus-windows-antigravity/json
(nothing about you or your PC is sent); NEXUS_UPDATE_CHECK=off in the server environment turns it off.
What it reads: window titles, the accessibility tree and window images of the applications the agent works in, only when a tool is called. Password managers are neither read nor driven.
Where it goes: tool results are returned to Antigravity, which may send them to Google under its own privacy policy; this server sends nothing anywhere else.
What it stores, under
~/.nexusagy/: the Python environment (clone install only;uvxkeeps its own in the uv cache), an action logcomputer.log(action, method, window, duration, outcome and short details such as a target label, coordinates, key names, a menu path or the number of characters typed, never the typed or expected text; rotated at 5 MB, three backups) and screenshots (at most 50 after each capture; those older than 24 hours are purged at the next capture and at server start, so a stopped server can leave its last screenshots until it starts again). Under~/.nexus/: the shared foreground token and emergency-stop state, andstatus/windows-antigravity.json(installed version, latest version, time of the last check), read by the Nexus app. Under%LOCALAPPDATA%\NexusJournal\windows\antigravity\(orNEXUS_JOURNAL_HOME): a short monthly JSONL journal, in the same format as the other NexusWindows tools (app executable name, action, technique, outcome, duration, whether the foreground was used, and the first words of an error, cut before any quote, colon or bracket); never typed text, screen text, labels, titles or paths. The server never deletes it.Removing it:
uvx --python 3.14 nexus-windows-antigravity uninstall(or remove the server from Antigravity's MCP settings), then delete~/.nexusagy/,~/.nexus/status/windows-antigravity.json(and%LOCALAPPDATA%\NexusJournal).
Questions or concerns: open an issue on this repository.
Limits
Windows only. Tool descriptions are in English; tool replies and code comments are in French.
In the background, keyboard input is refused in UWP/WinUI and Firefox, and Ctrl/Alt shortcuts in WPF; Tk gets keys and shortcuts through a simulated focus (
WM_SETFOCUSto that window only), clicks sent with the mouse button marked pressed for its thread, and lists scrolled through their native scroll bar; Chromium/Electron receives keys, shortcuts and typing through a simulated activation, checked by read-back (~if nothing changes). For web pages, NexusBrowser is more reliable.An effect with nothing readable stays
~(not verified).Still refused in the background, with the cause read in each toolkit's source: WPF clicks at a point, wheel and shortcuts (WPF drops a click while the real cursor is not over its window); a wheel on a covered Chromium canvas (Chromium routes it to the window on top), or on a PARTLY visible Tk window (an entirely covered one is moved off screen for the wheel, then put back, since 3.4.0); a click at a point of a covered Electron page that has gone
hidden.
Development
pwsh -NoProfile -File test.ps1 # offline: ruff, Pyright, pytest
pwsh -NoProfile -File test.ps1 -Full # plus the real desktop validation on its own Win32, WinForms and WPF windowsThe real validation shows its test windows without activation and closes them at the end; real mouse and keyboard checks run only when the PC has been idle for 120 s, otherwise they are reported as skipped.
Licence
MIT, see LICENSE. Copyright (c) 2026 Julien Piron.
Available Tools
5 toolsactADestructive
Act in ONE batch, in the background, on a NAMED window (hwnd), without reading the code: shared token, emergency stop and the user's pause are handled here.
Actions: click, double_click, right_click, type, set, clear, check, uncheck, select (option), expand, collapse, menu (path), key, scroll, drag, hover, wait (seconds, text), focus.
Target: target="Exact label", "#N", box_2d or x/y; ambiguous label refused. Steps ✓ = ~ ✗, status = the worst; follow next. Batch stopped on ~ or ✗, nothing more sent and no replay; look before resuming after an unknown outcome.
Outward actions (paying, sending, publishing, transferring, and the Enter key that would trigger them): confirm: true AND accord: "<token>" (on the step or as a parameter), returned by the first refusal that describes the exact action. Local destruction (permanent deletion, uninstalling, formatting, resetting): confirm: true alone. The user's explicit order = confirmation; your own initiative = ask first. Same batch without a look: refused.
foreground=True: real mouse/keyboard as a fallback only.
Example: {"hwnd": "Order", "steps": [{"action": "set", "target": "Name", "text": "Alice"}, {"action": "check", "target": "Accept"}, {"action": "click", "target": "Submit"}]}
| Name | Required | Description | Default |
|---|---|---|---|
| hwnd | No | ||
| then | No | none | |
| steps | Yes | ||
| accord | No | ||
| repeat | No | ||
| foreground | No | ||
| time_budget | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructiveHint/openWorldHint annotations: batch halts on ~ or ✗ with nothing more sent and no replay, ambiguous labels are refused, outward actions need `confirm: true` plus an `accord` token from a prior refusal, and local destruction needs `confirm: true` alone. The confirm-vs-accord split and the 'no replay after unknown outcome' rule are exactly the operational facts an agent needs to avoid causing damage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded and information-dense, but written in a compressed shorthand that costs parseability: 'Steps ✓ = ~ ✗, status = the worst' and 'follow `next`' require inference, and the action list runs as an unpunctuated stream. Nothing is redundant, but several lines do not earn their place because they cannot be decoded on first read.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a non-idempotent, open-world actuator with no output schema and no schema descriptions, this covers safety gating, failure semantics, and targeting comprehensively. The remaining gap is the return value: step statuses and `next` are alluded to but never characterized, and three parameters are left dangling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage the description must carry all parameter meaning. It covers hwnd, steps (with a full action vocabulary and example), accord, and foreground well, but `then`, `repeat`, and `time_budget` receive no explanation at all, and the referenced `next` is not even a declared parameter. Partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and scope: 'Act in ONE batch, in the background, on a NAMED window (hwnd), without reading the code.' That phrasing directly separates it from `look` (which reads the UI) and gives an agent a one-line mental model of what the tool is for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives the essentials for choosing this tool: batch-only, hwnd-targeted, `foreground=True` reserved as a fallback, and a hard precondition that a batch without a prior look is refused. It stops short of naming `look` explicitly as the required prior step, so the alternative is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
launchADestructive
Open an application (name such as "notepad.exe", or path), a folder or a document, like a double-click; the
opening is read back. Settings page: app="ms-settings:display" (opened behind the user's window, read back).
Refused: web addresses http, https, ftp (web pages: nexus-browser). args: arguments of a .exe program (a file to
open…), never for a document, a folder or an address; also accepted after the program in app, a path with
spaces is never split. Chromium/Electron apps: files only, never a switch.
Example: {"app": "notepad.exe", "args": "C:\Dev\notes.txt"}
| Name | Required | Description | Default |
|---|---|---|---|
| app | Yes | ||
| args | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond annotations: the opening is read back, settings pages open behind the user's window, web URLs are refused, paths with spaces are not split, and Chromium/Electron apps accept files only. These constraints materially affect invocation and are not covered by the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded and dense with useful constraints, with a concrete example. However, the phrasing is compressed and somewhat run-on, making it slower to parse than ideal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, but the description explains the read-back behavior. It covers the main invocation modes, exclusions, argument semantics, special settings behavior, and app-specific restrictions, leaving little an agent would need to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: `app` accepts executable names, paths, or protocol URIs, while `args` is restricted to .exe arguments, never documents/folders/addresses, and can also follow the program inside `app`.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: opens an application, folder, or document like a double-click. It also clearly distinguishes the tool from web-opening alternatives by explicitly refusing http/https/ftp and pointing to nexus-browser.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use examples, including a settings URI case, and explicit exclusions for web addresses. It also gives detailed guidance on when to use `args` and when not to, plus Chromium/Electron restrictions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookARead-onlyIdempotent
GOLDEN RULE: look → act in one batch, targets by label; never resend a batch without looking. See a NAMED window (hwnd: number, title or process) WITHOUT bringing it to the front (covered ones too): one line per element "[N] role "name" = "value" states @x,y"; image (WebP ≤ 2000 px) only if the tree is too thin, or with capture_screenshot=true, annotate (numbers drawn) or zoom=box_2d (area enlarged); query filters; format="json": compact JSON (box_2d 0-1000 per element). Same screen as the last image sent: not attached again. Unlocks a batch. Example: {"hwnd": "Notepad", "query": "save"}
| Name | Required | Description | Default |
|---|---|---|---|
| hwnd | No | ||
| zoom | No | ||
| query | No | ||
| format | No | text | |
| annotate | No | ||
| max_depth | No | ||
| output_path | No | ||
| max_elements | No | ||
| capture_screenshot | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive, so the description earns credit for adding behavior beyond them: it operates on covered/background windows without raising them, falls back to an image only if the tree is too thin, and notably does not re-attach the image if the screen matches the last one sent. That image-dedup rule is genuine behavioral context an agent could not infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The critical rule is front-loaded and every clause carries information, but the prose is over-compressed into semicolon run-ons and fragments ('Unlocks a batch.'), which costs parseability for an agent reading the definition cold. It earns its length but not its density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter, zero-annotation-coverage tool with no output schema, the description is largely sufficient: it explains the return format (one line per element, image fallback, compact JSON shape) and the main parameter semantics. The unexplained max_depth/max_elements/output_path leave a residual gap that keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the full burden and largely does: hwnd accepts an id, a window title, or a process name (much richer than the bare anyOf), query filters, format="json" yields compact JSON with box_2d in 0-1000, annotate draws numbers, zoom=box_2d enlarges an area, capture_screenshot forces the image, WebP capped at 2000px. max_depth, max_elements, and output_path are never explained, which keeps it off a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete verb and resource: see a NAMED window (hwnd, title, or process) without bringing it to the front, emitting one line per element with role/name/value/states/coordinates. It is specific enough to distinguish from 'act' (which it feeds) and from 'windows' (which presumably lists rather than inspects), though it never explicitly contrasts with 'window' or 'windows'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The front-loaded 'GOLDEN RULE: look → act in one batch, targets by label; never resend a batch without looking' gives an explicit workflow and names the sibling it precedes ('act'), and 'Unlocks a batch' reinforces the sequencing. What is missing is a when-not condition or guidance on choosing 'look' over the 'window'/'windows' siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
windowAIdempotent
Manage a NAMED window (hwnd: number, title or process). action="close": close it cleanly (UI Automation, then WM_CLOSE), the closing is read back; a "Save?" prompt, if any, is reported, never answered. Example: {"action": "close", "hwnd": 123456}
| Name | Required | Description | Default |
|---|---|---|---|
| hwnd | Yes | ||
| action | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond annotations: it names the close sequence (UI Automation, then WM_CLOSE), states the closing is read back (verification), and clarifies a 'Save?' prompt is reported but never answered, which is key context given destructiveHint=false. Still silent on what other action values do and on side effects beyond closing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the resource and target identification, then the action semantics, then a compact JSON example. Dense but each clause carries information; nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter mutation tool with no output schema, the close path is well covered including verification and prompt handling. However, the free-form 'action' parameter's other possible values and their behavior are entirely undocumented, which is a meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden. It adds real meaning for 'hwnd' (accepts a number, a title, or a process), but 'action' is an unconstrained string documented only with the single value 'close', leaving the valid action vocabulary ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('manage a NAMED window') and identifies targets by hwnd, title, or process, which distinguishes it from the sibling 'windows' that presumably lists them. However, only the 'close' action is spelled out, so the full scope of 'manage' is not clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (obtain/identify a window by hwnd, number, title, or process), but never explicitly says when to use this over 'windows' or 'act'. With sibling 'windows' present, an explicit 'call windows first to get the hwnd' instruction would have made this a 4-5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
windowsCRead-onlyIdempotent
List open windows: hwnd, title, process (the real application for UWP), position, foreground. by_app=true: grouped by application. Example: {"by_app": false}
| Name | Required | Description | Default |
|---|---|---|---|
| by_app | No | ||
| visible_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and non-destructive, so safety is covered and the description is not required to restate it. The description does add genuine value by enumerating the returned fields and clarifying that "process" is the real owning application for UWP apps — a non-obvious detail. It says nothing about ordering, snapshotting, or how many windows to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded with the purpose and return fields, which is good. But the 'Example: {"by_app": false}' line is a wasted, ambiguous fragment that contradicts the by_app=true sentence above it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, listing the returned fields is necessary and partially done, but the visible_only parameter and the difference from the sibling "window" tool remain unexplained. For a simple two-parameter read tool this is passable but leaves real gaps an agent would hit on first call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains by_app (grouped by application) but never mentions visible_only, which defaults to true and materially changes the result set. Half the parameters are effectively undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening clause gives a specific verb plus resource ("List open windows") and even enumerates the returned fields (hwnd, title, process, position, foreground), so the agent knows exactly what it gets. It does not, however, distinguish itself from the sibling tool named "window", which sounds adjacent enough to require a disambiguation sentence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is the by_app toggle behavior; there is no statement of when to use this versus siblings like "window" or "look", and no exclusions or preconditions. The trailing example {"by_app": false} is also at odds with the preceding by_app=true explanation, adding confusion rather than guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v3.6.0- Changed
launch1 field changed- added
Input schema / properties / argsAdded value: +{ + "default": "", + "title": "Args", + "type": "string" +}
5 tool updates
v0.1.0- First observed
act - First observed
launch - First observed
look - First observed
window - First observed
windows
TDQS
Scored across 5 tools
The core split is clean: launch opens things, windows enumerates, look observes, act manipulates, window closes. The single real hazard is 'window' (close one window) versus 'windows' (list all windows) — near-identical names with different scopes that an agent could easily pick wrong, though the descriptions do state their roles explicitly.
All names are single lowercase tokens, so the surface style is uniform, but the convention is mixed: launch/look/act are verbs while window/windows are nouns, and 'window' vs 'windows' differ only by a plural. Readable, but not the predictable verb_noun or verb_resource pattern that scales well.
Five tools is lean but well-matched to a multiplexed design where look and act absorb most verbs via action/step parameters. The only slight waste is 'window', which carries a single close action and could arguably live inside act, leaving one tool under-loaded relative to the rest.
The lifecycle is covered end to end: launch an app, enumerate windows, observe a named window, act within it, and close it, with foreground fallback and confirmation guards for destructive actions. Gaps are minor — no minimize/maximize/resize/reposition, no process-level kill, and web URLs are explicitly deferred to a companion server.
Maintenance
Related MCP Connectors
Eyes and hands on real Windows PCs — observe, click, type via Glasswarp API.
Give your AI hands on every computer you own. Remote control of your Windows, Mac and Linux machines from one ChatGPT, Claude or Cursor chat — even from your phone. Ask it to find out why the office server is crawling, update every PC in the house, sort out your mom's laptop from another city, or ship the site from your work machine while you're on a train. It runs commands, reads files and takes a screenshot when it needs to see the screen. You decide what each computer allows, and you can cut any of them off in a second.
Connect ChatGPT, Claude, Cursor or VS Code to your Windows PC: files, terminal, browser, apps.
Connect AI assistants to your approved computer for files, commands, browser and desktop tasks.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables safe Windows desktop automation and computer use through natural language, including window observation, UI Automation, and execution of verified actions like clicking, typing, and scrolling.2MIT
- AlicenseAqualityAmaintenanceEnables users to drive a selected Windows application toward a natural-language goal by reading the UI with local OCR/UIA and deciding next actions.65MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI to operate Windows applications through recursive grid-based screenshot navigation and proportional coordinates, with UIAutomation, mouse/keyboard control, sequential batch actions, and input locking.Apache 2.0
- AlicenseAqualityFmaintenanceLets Claude Desktop and Claude Code inspect and drive Windows desktop applications in the background, including clicking, typing, launching, and verifying results, while the user keeps their mouse, keyboard, and foreground window.71,249 PyPI4MIT