Clawdcursor — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific mcp_server implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Control desktop applications via agent-guided UI automation

What we know

UI automation engine that combines accessibility and OCR into stable target selectors and exposes desktop action tools over MCP.

Maintenance / activity evidence

Exact GitHub repository pushed_at 2026-10-09T15:53:51Z

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Act on desktop UI: click/type/navigate and trigger external side effects Reported action classes: Act on desktop UI: click/type/navigate and trigger external side effects. Complete write authority is not verified.
OS accessibility and automation permissions
Sensitive access: Screen content, App sessions, Credentials displayed in UI

Use approvals and avoid unattended high-impact desktop actions
Desktop/shell control can take high-impact actions; approval and containment required, never describe as read-only.
Full desktop control via Accessibility/Screen Recording; consent and privileged UI access required; no safe-by-default claim.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

403 repository stars

Stars observed Oct 9, 2026.

Repository total for AmrDab/clawdcursor.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of Clawdcursor before the next review?

No verified blocker to PUBLIC RADAR TRACKING within the bounded first-party evidence reviewed; material permissions and mitigations are explicitly disclosed.

Use approvals and avoid unattended high-impact desktop actions
Desktop/shell control can take high-impact actions; approval and containment required, never describe as read-only.
Full desktop control via Accessibility/Screen Recording; consent and privileged UI access required; no safe-by-default claim.
Act on desktop UI: click/type/navigate and trigger external side effects
OS accessibility and automation permissions
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Reviewed write actions: Act on desktop UI: click/type/navigate and trigger external side effects
Sensitive access: Screen content, App sessions, Credentials displayed in UI
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.
Exact dated attributable activity evidence
Dated attributable implementation activity/usage not verified
full exact tool inventory or deployment-specific access configuration
production authorization and network isolation depend on deployment
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Desktop automation can access sensitive apps and perform destructive actions
Host OS permissions required
OCR/accessibility dependencies vary by OS
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

Exact GitHub repository pushed_at 2026-10-09T15:53:51Z

Technical identity

github.com/AmrDab/clawdcursor

Exact implementation source: https://github.com/AmrDab/clawdcursor ↗
Reviewed resource type: MCP Server
Repository identity: AmrDab/clawdcursor

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
amrdab/clawdcursor
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Claude Code

Publisher instructions with a documented client setup path.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Install the Node.js 20+ npm engine first. Desktop-control consent is a separate intentional authorization step; never auto-run consent --accept. Then register the stdio MCP command in an intentionally selected client.
npm i -g clawdcursor
Configure / authenticate
MCP100 setup guide
Review all desktop input, screen access and application permissions before consenting. Check consent status in the Check connection step. Only after informed approval use clawdcursor consent --accept; on macOS run clawdcursor grant interactively to approve Accessibility and Screen Recording. For Claude Code, register clawdcursor with the publisher-documented command.
Advanced configuration · sensitive consent
sensitive consent · Review before use
clawdcursor consent --accept
Advanced configuration · macos permission grant
macos permission grant · Review before use
clawdcursor grant
claude mcp add clawdcursor -s user -- clawdcursor mcp --compact
Check connection
MCP100 setup guide
Run clawdcursor status and clawdcursor consent --status to check local readiness and authorization; then inspect the clawdcursor server/tools in the intended MCP client. Local readiness alone does not prove the client registration succeeded.
clawdcursor status
clawdcursor consent --status
Remove / uninstall / revoke
MCP100 setup guide
Use the publisher `clawdcursor uninstall` to remove its managed config/data/OpenClaw skill integration; inspect the exact removal side effects before executing. For npm global installation only, `npm uninstall -g clawdcursor` removes the package, not residual client registrations.
For Clawdcursor desktop-control consent, use `clawdcursor consent --revoke`; this is separate from OS Accessibility/Screen Recording permission removal. No separate Clawdcursor cloud API credential is required for the local MCP mode. Review OS permissions manually after disconnect.
Advanced configuration · stop local modes
stop local modes · Review before use
clawdcursor stop
Advanced configuration · revoke desktop consent
revoke desktop consent · Review before use
clawdcursor consent --revoke
Advanced configuration · destructive data removal
destructive data removal · Review before use
clawdcursor uninstall
npm uninstall -g clawdcursor

Official Documentation & Sources

What it does

UI automation engine that combines accessibility and OCR into stable target selectors and exposes desktop action tools over MCP.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Control desktop applications via agent-guided UI automation

Representative uses

Inspect application UI
Click and type in apps
Run reusable scripts
Verify UI changes

Limitations

Desktop automation can access sensitive apps and perform destructive actions
Host OS permissions required
OCR/accessibility dependencies vary by OS
Use approvals and avoid unattended high-impact desktop actions
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OS accessibility and automation permissions
Permissions: Act on desktop UI: click/type/navigate and trigger external side effects
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Use approvals and avoid unattended high-impact desktop actions

Access scope and cautions

Write actions: Not verified Act on desktop UI: click/type/navigate and trigger external side effects
Sensitive access: Screen content App sessions Credentials displayed in UI
Risk level: high
Security notes: Desktop/shell control can take high-impact actions; approval and containment required, never describe as read-only. Full desktop control via Accessibility/Screen Recording; consent and privileged UI access required; no safe-by-default claim.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect application UI; Click and type in apps; Run reusable scripts; Verify UI changes.

What setup and authentication are documented?

Recorded installation/entrypoint step: clawdcursor mcp --compact. Recorded transport: stdio. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: OS accessibility and automation permissions

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Act on desktop UI: click/type/navigate and trigger external side effects. Recorded permission context: Act on desktop UI: click/type/navigate and trigger external side effects

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Screen content; App sessions; Credentials displayed in UI.

What limitations and risks should I check before use?

Use approvals and avoid unattended high-impact desktop actions. Desktop automation can access sensitive apps and perform destructive actions. Host OS permissions required. OCR/accessibility dependencies vary by OS. No independent release lifecycle audit; do not claim precise activity date. Desktop/shell control can take high-impact actions; approval and containment required, never describe as read-only. Full desktop control via Accessibility/Screen Recording; consent and privileged UI access required; no safe-by-default claim. Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.