Cua Driver

What it does

Cua Driver is the MCP server in the trycua/cua repository, which also holds the Cua Spaces app and several other projects. It is a native Rust program. You start it as `cua-driver mcp` and it talks MCP over stdio, letting an agent inspect and operate desktop apps and browsers on all three major desktop systems. It reads each window through the platform's accessibility API plus a screenshot. From there it can click and type, and it also handles shortcuts, menu items, field values, drags and the clipboard.

Input goes to the target app in the background by default, so your own pointer and front window are left alone. If an app ignores background input, a call can ask for foreground delivery instead. There is also a Chromium side: the driver binds to a browser over CDP and handles page clicks and typing as well as select boxes, dialogs, uploads and downloads. Sessions can be recorded and replayed later. Several actions, or a whole JavaScript script, can run as one call. The driver calls no model of its own, since your agent client brings the model and the loop.

What the driver may do is fixed at startup by a permission mode. `standard` is the default and sends input to any app without prompting. `bounded` permits only what a capability manifest lists (tools, apps, files, browser origins), and `unrestricted` skips Cua's approval checks altogether.

The tools reference lists 67 tools, far more than the README mentions. Two details only show up in the source of release 0.38.0. An idle session expires after 300 seconds unless `CUA_DRIVER_RS_SESSION_IDLE_TTL_SECS` sets another value (runtime.rs). And an admin can set `CUA_DRIVER_DISABLE_UNRESTRICTED` so the driver refuses to start in unrestricted mode (authorization.rs).

What it needs

Install the `cua-driver` binary with its own script: `/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"` on macOS and Linux, or `irm https://cua.ai/driver/install.ps1 | iex` in PowerShell. The general Cua installer (cua.ai/install.sh) leaves the driver unticked by default. Add it there with `sh -s -- --select cua-driver`, which also installs the `cua` CLI. On macOS, run `cua-driver permissions grant` to start CuaDriver.app and switch on both permissions in System Settings. `cua-driver mcp` then proxies to that daemon. Any MCP client works, such as Claude Code or Codex.

Limits

• Platform Linux builds are x86_64 only. Native Wayland is experimental and stays off unless CUA_DRIVER_RS_ENABLE_WAYLAND=1 is set.
• Early release KDE/KWin and Hyprland support is marked experimental, and generic GNOME or KDE Wayland is read-only for browsers.
• Platform On macOS a raw `cua-driver serve` started outside CuaDriver.app is unsupported, as grants follow the app's identity.
• Not covered Background input lands only where the app and toolkit accept it. Others refuse, and a call must ask for foreground delivery.
• Not covered Apps that expose no accessibility elements (canvas, video) need a vision-capable model to target.
• Limit The permission mode is fixed at launch. A running daemon must be restarted to change it.
• Limit Sessions idle for 300 seconds expire by default (CUA_DRIVER_RS_SESSION_IDLE_TTL_SECS changes it).
• Limit Attaching to a logged-in Chromium profile needs `--grant existing-profile` or approval from the host app.
• Early release The history_status and history_query tools exist only in nightly macOS preview builds.
• Limit The optional cua-perception extension used by parse_visual_regions is AGPL-3.0-only, not MIT.

Platform coverage varies: macOS needs Accessibility and Screen Recording and some background scroll and drag shapes refuse; on Linux, toolkits that reject synthetic background events refuse, native Wayland is opt-in with CUA_DRIVER_RS_ENABLE_WAYLAND=1, and KDE and Hyprland support is experimental. Apps that show no accessibility elements (canvas, video) need a vision-capable model. Attaching to a logged-in Chromium profile needs `--grant existing-profile`. The permission mode cannot be changed without restarting the daemon. The `history_status` and `history_query` tools exist only in nightly macOS preview builds. The optional perception extension is AGPL-3.0, not MIT.

Who it suits

Suits a developer who wants an agent to work real desktop apps on their own machine without taking over the screen, and who can grant the OS accessibility permissions. For unattended runs, start it in `bounded` mode with a reviewed manifest. If you only need web pages, a browser-only server covers less ground and asks for fewer grants. It is not an official server of Apple, Microsoft or any app it operates.