What is Munim Computer Use?
Munim Computer Use lets an agent operate the apps on your own computer. It reads each window's accessibility tree, the structured list of buttons, fields and labels that screen readers use, and hands the agent element ids to click, type into or scroll, falling back to on-device OCR when an app exposes no labels. Screenshots and a zoom tool are there to check results. A soft agent pointer shows where it is acting, and on macOS input goes to the target window without moving your own mouse.
It runs on macOS (a Swift server), Windows and Linux (a Rust server), with the same 38 tools on each. An optional Chrome extension, connected through Chrome's native messaging, adds 19 browser tools that work in a labelled tab group in your real, signed-in Chrome. A policy.json file sets allow, ask or block per app and per website.
Munim Technologies (Munim, Inc.) built it as the computer-use engine of its MT Code app and publishes it separately under Apache-2.0. The repository was created on 5 September 2026, has about 37 stars and 30 releases, and v0.13.0 shipped on 6 November 2026.
How to install Munim Computer Use
npx -y munim-computer-useIs Munim Computer Use worth it?
Munim Computer Use gets the fundamentals right. Reading the accessibility tree rather than screenshots means the agent presses a named button instead of guessing at pixels, and works with models that have no vision. Ids are rechecked before every action, so if a dialog swaps its buttons the call fails instead of clicking the wrong thing, and run_steps checks a whole list of actions before running any of it. On the project's own benchmark of 4 November 2026, a window read took about 0.12 s on Windows and returned about 2.0K tokens, ahead of every rival it measured; those figures are self-reported and the scripts are not published.
The browser side is where this differs from Playwright or Chrome DevTools MCP. Those servers start a separate browser; Munim works in the Chrome you are already signed into, in its own tab group, and can take over a tab you point it at. The extension holds Chrome's debugger permission and access to all URLs, so whatever you are logged into, the agent can read and act on. Two safeguards stand out: browser_request_credentials opens a window where you type a password straight into the page without the model seeing it, and desktop password fields refuse typing by default.
The security story is honest rather than complete. The policy file can block Keychain Access or your bank, prompts for ask rules expire as a no after two minutes, and an invalid file blocks everything. But the README calls it a guard rail, not a sandbox: a coordinate click lands wherever it points and a full-screen screenshot shows every window. Any text the agent reads, from a web page to an email in Mail, is a possible prompt injection with your whole desktop behind it. No port is opened; the server speaks stdio and reaches Chrome through a local socket or named pipe.
The catch: background input is only guaranteed on macOS. On Windows, Chromium, Electron, WPF and UWP apps still need the real pointer, and on Linux every pointer action moves it, while native Wayland apps get no coordinate clicks. The Chrome extension has to be loaded unpacked in developer mode. With about 37 stars, one main contributor and a release every few days, expect fast fixes and fast changes.
Our take: for a developer who wants an agent to file expenses in a desktop app or fill a form behind a login, this is a better-built starting point than the screenshot-driven servers; run it under a separate user account or a block-by-default policy until it has a longer record.
Where it earns its place
A finance assistant at a 20-person firm using a desktop accounting app with no API
Enter a stack of supplier invoices without retyping each field
The agent reads the app's form with get_app_state, fills fields by element id and checks each entry with return_state. Free to run apart from model tokens; a policy that blocks Mail and the browser keeps it on task.
A QA engineer testing a cross-platform Electron app
Run the same smoke test on macOS, Windows and Linux
Because tool names and schemas are identical on each system, one prompt drives all three. Expect the real pointer to move on Windows and Linux for Electron windows, so run those on spare machines.
A solo founder managing several SaaS dashboards behind single sign-on
Pull this week's numbers from three admin panels into a note
The agent opens its own tab group in the founder's Chrome, reads each page with browser_read, and signs in through browser_request_credentials when a session has expired. Mark billing and admin pages ask in policy.json.
Before you commit
- Setup
- claude mcp add munim-computer-use -- npx -y munim-computer-use, which fetches the signed binary on first run; Codex and Cursor configs are in the README. On macOS, run munim-computer-use request-permissions once for Accessibility and Screen Recording. For browser tools, load chrome-extension/ unpacked and run install-native-host.
- Integrations
- 38 tools: see (list_apps, get_app_state, screenshot, zoom, list_displays), act (click, type_text, set_value, press_key, drag, run_steps and others), clipboard read and write, and 19 browser tools such as browser_read, browser_fill, browser_upload_file and browser_request_credentials. Almost all are write actions; COMPUTER_USE_BROWSER=0 hides the browser set.
- Data and privacy
- Runs locally over stdio and opens no network port; the Chrome bridge uses a local socket or named pipe. OCR runs on the device. The agent can read and act in every app and signed-in site the policy allows, plus the clipboard and local files it uploads; screenshots and page text go to your model provider. No telemetry is mentioned in the README and the repo lists no security advisories.
- Cost at scale
- Free; cost is model tokens. Accessibility reads return about 1.0K to 2.0K tokens per window in the project's benchmark, far less than a screenshot loop, but long desktop tasks still run to many calls.
- Limits
- Background input is best effort on Windows and absent for Linux pointer actions; native Wayland apps get element actions but no coordinate clicks. Sandboxed agents on Windows get empty trees and black captures. Chrome only, and the extension must be loaded unpacked.
What’s good
- Accessibility tree with ids that fail rather than misfire
- Same 38 tools on macOS, Windows and Linux
- Background input on macOS; agent pointer overlay
- Per-app and per-site allow, ask and block policy
- Credential prompt keeps passwords out of the model
What’s not
- Agent can act as you in every signed-in app and site
- Background input only guaranteed on macOS
- Chrome extension loaded unpacked, with debugger access
- Two months old; benchmarks are self-reported
Best for
Developers on macOS, Windows or Linux who want an agent to operate desktop apps and logged-in websites, and who will write an app and site policy first.
Munim Computer Use alternatives
Munim Computer Use: common questions
- Is Munim Computer Use worth it?
- A carefully engineered open computer-use server, but it is two months old and can do anything you can do at your desk, so it should earn trust slowly. We rate it 3.7 out of 5.
- How much does Munim Computer Use cost?
- Free and open source (Apache-2.0). No paid tier; the model calls are paid to your own provider.
- What are the downsides of Munim Computer Use?
- Agent can act as you in every signed-in app and site; background input only guaranteed on macOS; chrome extension loaded unpacked, with debugger access; two months old; benchmarks are self-reported.
- Who is Munim Computer Use best for?
- Developers on macOS, Windows or Linux who want an agent to operate desktop apps and logged-in websites, and who will write an app and site policy first.
- How much does Munim Computer Use cost for a team or in production?
- Free; cost is model tokens. Accessibility reads return about 1.0K to 2.0K tokens per window in the project's benchmark, far less than a screenshot loop, but long desktop tasks still run to many calls.
- Is Munim Computer Use safe for company data?
- Runs locally over stdio and opens no network port; the Chrome bridge uses a local socket or named pipe. OCR runs on the device. The agent can read and act in every app and signed-in site the policy allows, plus the clipboard and local files it uploads; screenshots and page text go to your model provider. No telemetry is mentioned in the README and the repo lists no security advisories.
- What are the best Munim Computer Use alternatives?
- The closest alternatives we have reviewed are Playwright MCP, Chrome DevTools MCP and OpenTabs.
Answers checked Nov 11, 2026.