Nuphus MCP: A Desktop Automation MCP Server for Apps With No API

Most integration problems end the same way: the app has no API, no webhook, no SDK, nothing an agent can call. The only way in is the way a person gets in, by clicking, typing, and reading the screen. Nuphus MCP is a desktop automation MCP server built for exactly that gap. It exposes screen capture, window management, mouse and keyboard input, and Chrome control as standard MCP tools, so any agent that speaks the protocol can drive a real desktop the way a person would. It is free, open source, and new, first published on GitHub on August 1, 2026 by developer mrpulor-gh.

What This Desktop Automation MCP Server Actually Does

The repository ships 36 MCP tools, split roughly into 15 desktop tools and 21 browser tools. On the desktop side, the agent can take screenshots, list and activate windows, move and resize them, move and click the mouse, type text, run keyboard shortcuts, and read or write the clipboard. There is also a desktop_perceive tool that runs local OCR (via PaddleOCR, with optional icon detection through YOLO) so the agent can read what is actually on screen rather than guessing from pixel coordinates, and a desktop_vision tool that hands a screenshot to a vision model you supply your own API key for.

On the browser side, the tools cover navigation, clicking, typing, scrolling, tab and cookie management, and downloads, all driven through the Chrome DevTools Protocol against Chrome or Edge. It also reads accessibility-tree snapshots with coordinate references, which is the more reliable way for an agent to find the right element instead of clicking blind. There is support for pointing it at an already-running browser instance via a custom debug URL, useful if you are automating a browser profile that already has your logins in it.

The project is written in Rust and runs as a local process talking to the MCP client over stdio, not a network service. That matters for the trust model: there is no exposed port to accidentally leave open on a shared network.

Screen, Mouse, Keyboard, and Chrome, Specifically

This is the part worth being precise about, because "computer use" gets used loosely. Nuphus MCP is not simulating a sandboxed browser tab or a virtual display. It is driving the actual operating system input stack: real mouse movement, real keystrokes, real window focus changes on the machine it runs on. On Windows, both browser and desktop tools run at full capability through the Win32 API. On macOS, desktop control works once you grant Accessibility permission in System Settings, and screenshot capture will additionally prompt for Screen Recording access the first time it runs. On Linux, browser automation is fully supported, but desktop-level window and input control is described in the project's own documentation as partial.

This is the piece of infrastructure that makes AI-agent computer control practical for tasks that die at "this tool has no integration." A legacy desktop app, an internal tool with no API, a workflow that only exists as a GUI: an agent with this MCP server attached can operate it the same way a person does.

The Safety Question You Should Not Skip

The project's own SECURITY.md is unusually direct about what this tool is: it states plainly that it grants "full access to the machine" and is not sandboxed. That is worth sitting with before installing it. Any process capable of writing to the server's stdin gains the same control over your screen, mouse, keyboard, and browser session that you have, including access to whatever is already logged in, open, or visible.

The guardrails that exist are real but limited. Twenty-three of the write operations are flagged with a destructiveHint annotation so an MCP client can choose to prompt before running them, though whether your client actually does that is up to the client, not the server. The more meaningful control is strict confirm mode, turned on with the --confirm-write flag or the NUPHUS_MCP_CONFIRM_WRITE=1 environment variable, which makes the server reject any write action unless the caller explicitly passes "confirm": true. There is a desktop_clipboard_clean tool to wipe the clipboard after a paste, and the docs explicitly warn against routing passwords through it. Screenshot and file operations get basic path validation against directory traversal.

What is missing is any allowlist or scoped-permission system. You cannot tell it "only this app" or "never touch this folder." Access control is entirely external: whether you run it without elevated privileges, what machine it is on, and whether you trust whatever is calling it through your MCP client. If you run this, run it with confirm mode on from the start, and treat it the way you would treat handing someone your unlocked laptop, because functionally that is what it is.

Setting It Up

Installation is a one-line npm install -g @nuphus/nuphus-mcp, or a Rust build from source with cargo build --release. Prebuilt binaries are available for Windows (x64 and arm64), macOS (arm64), and Linux (x64 and arm64). For Claude Desktop, the config is a standard MCP server entry pointing at the nuphus-mcp binary, and the project's own example includes --confirm-write in the args by default, which is the right instinct.

Where It Fits

As of today the repository has 206 stars and 22 forks under an MIT license, up from 152 stars when it first crossed the radar less than two weeks ago, one of the fastest-growing new MCP servers in its category. That growth tracks a real gap: most MCP servers connect an agent to a service with an API. This one connects an agent to everything that does not have one. That is genuinely useful for automating the last mile of legacy software and GUI-only workflows. It is also the category of tool where the honest advice is to read SECURITY.md before you read the setup instructions, keep confirm mode on, and only point it at a machine and account where you have already decided what an unsupervised operator would be allowed to touch.