Windows-MCP
An open-source MCP server for Windows desktop automation, built on the Windows UI Automation (UIA) framework. It translates desktop GUI elements into a structured semantic tree for manipulation by AI agents, and supports local STDIO pipe communication without requiring network ports.
Timeline (last 90 days)
CursorTouch Windows-MCP is an open-source project that runs as a local server, acting as a translation layer between language models and the internal architecture of the operating system.
Windows-MCP relies at its core on the Windows UI Automation (UIA) framework, translating the desktop interface into structured hierarchical text documents and extracting metadata and coordinates for every button and window.
After stripping out image encoding and cloud-based inference, Windows-MCP reduces the latency of each discrete action to between 0.2 and 0.5 seconds.
Windows-MCP uses local STDIO pipes, with the host application launching its Python executable as a same-machine subprocess, where client and server communicate only through standard input/output streams, with zero TCP ports exposed to the local network or the public internet.
Capability discovery requests, tool calls, and status reports all circulate within the closed loop in JSON-RPC 2.0 message format.
Windows-MCP's Python server performs clicks by triggering Win32 hardware interrupts, causing the operating system to behave as though a real mouse hardware device is moving.
If a human operator physically moves the mouse while the agent is simulating hardware interrupts, the real signal collides with the synthetic signal and causes the cursor to deviate; when the UI state is not updated, the client triggers a timeout and stops the agent, which is an intentional fail-safe mechanism.
Windows-MCP's Python server inherits the full privilege level of the host application that launches it, and the default toolset includes system administration capabilities such as PowerShell execution and registry editing.
Agents lacking isolation face indirect prompt injection attacks when scraping local HTML documents or websites containing maliciously hidden prompts, as language models cannot reliably distinguish legitimate commands from hidden payloads embedded in documents.
Operators can narrow the attack surface by editing the host client's execution parameters (typically located in the claude_desktop_config.json file) to pass in an exclude tools flag at initialization, revoking access to PowerShell and registry modifications.
1 more timeline events
All Facts (11)
CursorTouch Windows-MCP is an open-source project that runs as a local server, acting as a translation layer between language models and the internal architecture of the operating system.
50%UnverifiedWindows-MCP relies at its core on the Windows UI Automation (UIA) framework, translating the desktop interface into structured hierarchical text documents and extracting metadata and coordinates for every button and window.
50%UnverifiedAfter stripping out image encoding and cloud-based inference, Windows-MCP reduces the latency of each discrete action to between 0.2 and 0.5 seconds.
50%UnverifiedWindows-MCP uses local STDIO pipes, with the host application launching its Python executable as a same-machine subprocess, where client and server communicate only through standard input/output streams, with zero TCP ports exposed to the local network or the public internet.
50%UnverifiedCapability discovery requests, tool calls, and status reports all circulate within the closed loop in JSON-RPC 2.0 message format.
50%UnverifiedWindows-MCP's Python server performs clicks by triggering Win32 hardware interrupts, causing the operating system to behave as though a real mouse hardware device is moving.
50%UnverifiedIf a human operator physically moves the mouse while the agent is simulating hardware interrupts, the real signal collides with the synthetic signal and causes the cursor to deviate; when the UI state is not updated, the client triggers a timeout and stops the agent, which is an intentional fail-safe mechanism.
50%UnverifiedWindows-MCP's Python server inherits the full privilege level of the host application that launches it, and the default toolset includes system administration capabilities such as PowerShell execution and registry editing.
50%UnverifiedAgents lacking isolation face indirect prompt injection attacks when scraping local HTML documents or websites containing maliciously hidden prompts, as language models cannot reliably distinguish legitimate commands from hidden payloads embedded in documents.
50%UnverifiedOperators can narrow the attack surface by editing the host client's execution parameters (typically located in the claude_desktop_config.json file) to pass in an exclude tools flag at initialization, revoking access to PowerShell and registry modifications.
50%UnverifiedOrganizations should enforce human-in-the-loop operational protocols for all important tasks and disable the global auto-approve setting.
50%