Munim Computer Use is an open-source computer-use MCP server that acts as a computer-use agent (CUA) backend, enabling any coding agent to use your computer like a human. It supports macOS, Windows, and Linux, works with Claude Code, Codex, Cursor, MT Code, or any other MCP client, and supports arbitrary models; the interaction process does not require a vision model. The project is built by Munim Technologies as the computer-use engine for MT Code and is released separately.
In terms of main capabilities, it follows an accessibility-first, pixels-second design. get_app_state returns the app's accessibility tree and stable element IDs, based on which the agent presses buttons instead of guessing coordinates, consuming fewer tokens than screenshots. It can quickly list what is visible on the screen, skipping and counting the parts beyond the viewport; when encountering dialogs, it prioritizes listing their controls. For Electron and Chromium apps (macOS), it proactively requests the accessibility tree. When an app has no labeled controls, it uses on-device OCR (Apple Vision on macOS, Windows OCR on Windows) to read the window, and images do not leave the local machine. Every ID is rechecked before an action; if an element disappears or its role or name changes, the action fails explicitly rather than misoperating. It waits for the app's accessibility notifications to stop rather than pausing for a fixed time. It supports background control; on macOS it sends events to the target window via SkyLight, and the agent never takes over your mouse and keyboard; it also provides a light purple agent pointer overlay that does not touch your cursor. Screenshots and zooming carry the screen origin and pixels per point, and zoom can capture any region at physical resolution.
In terms of usage, you can download the binary for your platform from Releases (munim-computer-use-macos-universal.zip, munim-computer-use-windows-x64.zip), or build from source, put it in PATH, run munim-computer-use request-permissions once on macOS to request Accessibility and Screen Recording permissions, and then register it in your agent. After that, you can ask the agent to complete tasks, for example, "Open Safari and findThe cheapest flight to Denver on Tuesday and record it in a note." The agent reads the interface via get_app_state, operates by element ID, and verifies with screenshot.
It can also drive your logged-in Chrome: the extension provides the agent with a separate, labeled tab group that does not interfere with your tabs unless you specify otherwise. browser_list_tabs all=true shows all tabs, browser_use_tab takes over a tab in place (without moving, activating, or reloading it), and browser_release_tab returns it early. Tabs opened by the agent's clicks belong to it and are closed during cleanup. Each MCP process has its own tab group, and one process can run multiple tasks via a stable session_id; tasks cannot drive or take over each other's tabs, and cleanup only closes its own tabs. Any number of MCP processes share the same extension, the first process owns it, the rest work through it, and after the owner exits another takes over without closing anyone's tabs. Tasks share Chrome's cookies and logins, but desktop apps and the clipboard are not isolated.
Browser operations support readiness checks and safe re-observation: browser_click, browser_type, browser_press_key, and browser_navigate accept wait_for_selector and return_state: true, and browser_snapshot also accepts the same wait without performing an action. The extension polls for any matching visible element in the top-level document, sharing the snapshot's visibility rules. wait_timeout_ms defaults to 8000 and accepts an integer from 0 to 10000, where 0 means check once. readiness: met means the specified condition was observed, but does not guarantee that all network requests, animations, or application work have finished; readiness: timeout means the condition was not observed within the budget.
For password security, browser_request_credentials asks the user to log in in a small Chrome window that shows the website's true origin, and what is entered goes directly into the page fields and is never returned to the model. browser_snapshot never shows the values of password fields, and typing into password fields is denied by default on the desktop. You can also use a policy file to decide which apps and websites the agent can touch:Place policy.json in a supported directory, or point to any file via COMPUTER_USE_POLICY. You can set allow, ask, or block per app or website; ask prompts the user on first access, and approval lasts until the end of that agent task. Apps match by name or bundle id (case-insensitive), websites match by host and subdomain, the most specific rule takes precedence, and the current page is rechecked on every browser operation. Changes take effect immediately without a restart, and an invalid file blocks everything rather than being ignored. Note that this is a behavioral guardrail, not a sandbox.
Use cases include having coding agents automate desktop app operations, browser tasks, background data reading, and more. In terms of limitations, background control capabilities differ across platforms: macOS guarantees it will not take over the user's pointer, Windows is best-effort and reports whether it went through the cursor, and pointer operations on Linux use the real pointer. Coordinate operations on minimized windows will error on some platforms and require restoring the window. Frames and shadow roots are not searched. Regarding fees, pricing, specific platform details, or other information not mentioned, the materials do not currently provide it.
