agent-cu vs open-computer-use

agent-cu is a command-line tool for controlling desktop apps by clicking, typing, and reading interface information. It uses the accessibility tree that screen readers rely on to identify interface elements, then acts on them through references. Commands include snapshots, selectors, clicks, typing, scrolling, dragging, window management, and JSON output. Users can batch commands and reuse YAML workflows. The tool supports Electron apps through CDP, including Slack, Cursor, VS Code, Postman, Discord, and Notion. Its skill can be used with Claude Code, Cursor, Codex, Copilot, OpenCode, Cline, and 40+ other agents. agent-cu runs locally on macOS, Linux, and Windows; precompiled binaries are available for macOS Apple Silicon and Intel, Linux, and Windows. Installation instructions cover npm, pnpm, yarn, and bun. It requires explicit operating-system accessibility permissions to read and control apps. The project is free and MIT licensed. Its repository states that it is no longer maintained and recommends Cua and Cua Driver instead.

open-computer-use is a free, MIT-licensed local MCP server that lets AI agents inspect and operate desktop applications through accessibility interfaces. Its nine core tools cover app discovery, accessibility-tree and screenshot capture, clicking, scrolling, dragging, typing, key presses, secondary actions, and control-value changes. The project says it runs entirely on the user’s machine and uses the accessibility layer for core app actions without taking over the physical mouse and keyboard. Setup documentation covers Codex CLI and App, Claude Code, Gemini CLI, and opencode, with manual configuration for other MCP clients. A ZCode plugin installs the skill and connects an MCP server. macOS 14 or later requires Accessibility and Screen Recording permissions. Windows and Linux use a signed-in desktop session, and Linux requires AT-SPI2. Additional window-level tools are currently available on Windows, while macOS and Linux support is in progress. Password managers are refused; app launching, focus changes, and global input injection require explicit environment-variable gates. The project warns that high-privilege automation should be used only on authorized machines.