Clawd Cursor

What it does

Clawd Cursor is a local stdio MCP server for operating the computer you run it on. Clicks, typing, key combinations, reading the screen, moving and closing windows, opening apps, files and URLs: all of that is covered, plus driving Chrome or Edge over the DevTools protocol. The makers see this as the fallback for programs with no API or CLI, say an old accounting app.

Seeing the screen starts with the accessibility tree and OCR. The two get merged into a map of elements with stable ids, so later clicks point to an element rather than to pixels. Screenshots come last, for canvas apps. You can attach an expected outcome to an action, and the server looks again afterwards and reports when the UI did not change that way. One safety check sits in front of every call. Sends, deletes, purchases and apps like email or banking need a confirmation, and lock, log-out or shutdown key sequences are refused.

With the documented `mcp --compact` launch you get seven compound tools that take an `action` argument. Six of them bundle about 80 actions between them. The seventh, `batch`, runs a list of calls in one request and stops after 12 steps unless `maxSteps` says otherwise (src/tools/compact.ts, src/tools/batch.ts). Leave out `--compact` and the client sees the granular catalogue of 100+ single tools.

Privacy note: set `CLAWD_DISABLE_VISION=1` and no screenshot reaches the model at all, which leaves the client with accessibility and OCR text. The `--no-vision` flag belongs to the daemon commands and does not exist on `mcp` (src/surface/cli.ts).

There is also a `clawdcursor agent` daemon. It serves the same tools over HTTP on 127.0.0.1:3847 behind a bearer token, takes another port from `--port` or `server.port` in the config, and can run a model loop of its own for whole tasks.

What it needs

Windows 10/11, macOS 12+ or Linux. A one-time consent (`clawdcursor consent --accept`, the in-app prompt in hosts that support MCP elicitation, or `CLAWDCURSOR_CONSENT=true` set by the host). macOS: Accessibility permission (Screen Recording only for screenshots and OCR) and Xcode Command Line Tools for screenshots. Linux packages come from the system package manager. The `task` tool also needs the `clawdcursor agent` daemon running with a model provider set up through `clawdcursor doctor`.

Limits

• Limit Until consent is given, every tool call returns a consent message instead of acting. The server still starts.
• Limit The task tool fails unless the clawdcursor agent daemon is running with a model configured. It waits 45 seconds by default (1 to 50 with timeout), then returns a running status to poll.
• Size cap batch runs at most 12 steps by default, set higher or lower with maxSteps.
• Limit batch's allowConfirm is ignored, and the batch halts at a confirm-tier step, unless CLAWD_BATCH_ALLOW_CONFIRM=1 is set. The README does not mention this switch.
• Not covered Browser control covers Chrome and Edge only.
• Platform On Wayland, wtype gives keyboard input only. ydotool with ydotoold is needed for the mouse.
• Limit On Windows some hosts cannot find the clawdcursor or npx shims and need the command wrapped in cmd /c.
• Limit OpenAI Codex's 10-second startup timeout may be too short for the first launch.
• Not covered The HTTP daemon binds to 127.0.0.1 with no setting to open it. Remote use needs an SSH tunnel.

Until consent is given, every tool returns a consent message instead of acting. The `task` tool fails unless the separate agent daemon is running with a configured model; it waits 45 seconds by default and then returns a running status to poll. Browser control covers Chrome and Edge only. With `--compact` there is no `batch` tool, unlike the README's toolbox table. On Wayland, `wtype` gives keyboard input only. On Windows some hosts cannot find the `clawdcursor` or `npx` shims and need the command wrapped in `cmd /c`. OpenAI Codex's 10-second startup timeout may be too short for the first launch.

Who it suits

Suits someone who wants an assistant to operate desktop apps that offer no API, on any of the three main operating systems, and is willing to grant full input control of their own machine. The confirmation tier and on-screen stop banner suit attended use. When the target is only a website, a browser-only server is narrower; when an app has an API, CLI or its own MCP server, the makers themselves advise using that instead. Not for headless servers without a desktop session.