Q: Does anything leave my machine?

No. There is no account, no telemetry and no server of ours involved. Screenshots go to the MCP client you configured - the same place the rest of your conversation goes - and nowhere else.The same rule holds for this website: no analytics, no cookies, no third-party requests. The only tag anywhere on the site is application/ld+json structured data, which your browser does not execute - never a program. View source and check.
Q: How is this different from the other macOS MCP servers?

Capability-wise, not enormously - screenshots, clicks, keystrokes, the accessibility tree. The difference is what happens in the hours you are not watching. It works in windows behind the one you are in and leaves your pointer where you put it, so it does not take over the machine while you use it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. And it will not go near your password manager. If you only ever watch it work, most of that is wasted on you.
Q: Why is the audit log fingerprinted instead of plain?

Because a complete record of every keystroke is exactly the file an attacker would want. The fingerprint proves two actions typed the same thing without ever storing what it was. It is scrambled with a random ingredient that only exists while it runs - a fingerprint without that random ingredient, of an eight-character password, is guessable offline, which would have made the log the very thing this promise is against. The cost is honest: comparison works within a run, not across runs.
Q: Can I turn the redaction off?

Yes - redact: false on a single screenshot. It is per call and never sticky, and the result says plainly that the image was not redacted.
Q: Does it ask me before it does things?

Not for ordinary work - it acts, and every call lands in the log. A few things never happen without a person saying yes: your password manager, anything that deletes or clears, and starting a screen recording. In the default mode they wait in the menu bar icon - a password manager cannot be approved there, so it is refused. If you would rather be asked once up front, CMCP_MODE=ask puts a single session-granting dialog in front of the first write, and ignoring that dialog refuses the action rather than allowing it.
From c130a5b2d63baeb1cdac253e4ca199f933c489c7 Mon Sep 17 00:00:00 2001
From: Gustav Louv <gustav@agent360.dk>
Date: Wed, 30 Sep 2026 13:51:21 +0800
Subject: [PATCH] docs: credit Gustav Louv as maker, linked to gustavlouv.com

Adds a 'Made by Gustav Louv' link in the footer and a schema.org creator
(Person) next to the Agent360 author, so the product page and the maker's
own page point at each other.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/docs/index.html b/docs/index.html
index d4b3c8fe..b59b5286 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -6,7 +6,7 @@
 <meta name="msvalidate.01" content="582C4D765316F7C90DBE1E6F244968DF">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <title>Computer MCP - computer use you can actually leave running</title>
-<script type="application/ld+json">[{"@context": "https://schema.org", "@type": "SoftwareApplication", "name": "Computer MCP", "applicationCategory": "DeveloperApplication", "operatingSystem": "macOS 14 or later", "description": "macOS computer use built for unattended runs: it acts on windows behind the one you are in and leaves the pointer alone, it reports failures instead of pretending, several sessions run at once, password managers ask every time, and every call lands in an append-only log. 30 tools, 14 read-only. No account, no API key, no network calls of its own.", "url": "https://computermcp.dev/", "downloadUrl": "https://www.npmjs.com/package/@agent360/computer-mcp", "codeRepository": "https://github.com/Agent360dk/computerMCP", "license": "https://opensource.org/licenses/MIT", "softwareHelp": "https://computermcp.dev/docs/install-claude-code/", "featureList": ["Acts on background windows without moving your pointer or raising anything", "Reports refusals and failures instead of carrying on as if they worked", "Several sessions at once - no session lock, no one-at-a-time limit", "Password managers ask every time, in every mode", "Secure text fields blacked out before the screenshot is written", "Append-only audit log, fingerprinted rather than stored in clear", "No shell execution, no file access, no network calls of its own"], "offers": {"@type": "Offer", "price": "0", "priceCurrency": "USD"}, "author": {"@type": "Organization", "name": "Agent360", "url": "https://agent360.dk"}}, {"@context": "https://schema.org", "@type": "Organization", "name": "Agent360", "url": "https://agent360.dk", "sameAs": ["https://github.com/Agent360dk", "https://browsermcp.dev", "https://jesperai.com"]}, {"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Does anything leave my machine?", "acceptedAnswer": {"@type": "Answer", "text": "No. There is no account, no telemetry and no server of ours involved. Screenshots go to the MCP client you configured - the same place the rest of your conversation goes - and nowhere else.The same rule holds for this website: no analytics, no cookies, no third-party requests. The only <script> tag anywhere on the site is application/ld+json structured data, which your browser does not execute - never a program. View source and check."}}, {"@type": "Question", "name": "How is this different from the other macOS MCP servers?", "acceptedAnswer": {"@type": "Answer", "text": "Capability-wise, not enormously - screenshots, clicks, keystrokes, the accessibility tree. The difference is what happens in the hours you are not watching. It works in windows behind the one you are in and leaves your pointer where you put it, so it does not take over the machine while you use it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. And it will not go near your password manager. If you only ever watch it work, most of that is wasted on you."}}, {"@type": "Question", "name": "Why is the audit log fingerprinted instead of plain?", "acceptedAnswer": {"@type": "Answer", "text": "Because a complete record of every keystroke is exactly the file an attacker would want. The fingerprint proves two actions typed the same thing without ever storing what it was. It is scrambled with a random ingredient that only exists while it runs - a fingerprint without that random ingredient, of an eight-character password, is guessable offline, which would have made the log the very thing this promise is against. The cost is honest: comparison works within a run, not across runs."}}, {"@type": "Question", "name": "Can I turn the redaction off?", "acceptedAnswer": {"@type": "Answer", "text": "Yes - redact: false on a single screenshot. It is per call and never sticky, and the result says plainly that the image was not redacted."}}, {"@type": "Question", "name": "Does it ask me before it does things?", "acceptedAnswer": {"@type": "Answer", "text": "Not for ordinary work - it acts, and every call lands in the log. A few things never happen without a person saying yes: your password manager, anything that deletes or clears, and starting a screen recording. In the default mode they wait in the menu bar icon - a password manager cannot be approved there, so it is refused. If you would rather be asked once up front, CMCP_MODE=ask puts a single session-granting dialog in front of the first write, and ignoring that dialog refuses the action rather than allowing it."}}]}]</script>
+<script type="application/ld+json">[{"@context": "https://schema.org", "@type": "SoftwareApplication", "name": "Computer MCP", "applicationCategory": "DeveloperApplication", "operatingSystem": "macOS 14 or later", "description": "macOS computer use built for unattended runs: it acts on windows behind the one you are in and leaves the pointer alone, it reports failures instead of pretending, several sessions run at once, password managers ask every time, and every call lands in an append-only log. 30 tools, 14 read-only. No account, no API key, no network calls of its own.", "url": "https://computermcp.dev/", "downloadUrl": "https://www.npmjs.com/package/@agent360/computer-mcp", "codeRepository": "https://github.com/Agent360dk/computerMCP", "license": "https://opensource.org/licenses/MIT", "softwareHelp": "https://computermcp.dev/docs/install-claude-code/", "featureList": ["Acts on background windows without moving your pointer or raising anything", "Reports refusals and failures instead of carrying on as if they worked", "Several sessions at once - no session lock, no one-at-a-time limit", "Password managers ask every time, in every mode", "Secure text fields blacked out before the screenshot is written", "Append-only audit log, fingerprinted rather than stored in clear", "No shell execution, no file access, no network calls of its own"], "offers": {"@type": "Offer", "price": "0", "priceCurrency": "USD"}, "author": {"@type": "Organization", "name": "Agent360", "url": "https://agent360.dk"}, "creator": {"@type": "Person", "name": "Gustav Louv", "url": "https://gustavlouv.com/"}}, {"@context": "https://schema.org", "@type": "Organization", "name": "Agent360", "url": "https://agent360.dk", "sameAs": ["https://github.com/Agent360dk", "https://browsermcp.dev", "https://jesperai.com"]}, {"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Does anything leave my machine?", "acceptedAnswer": {"@type": "Answer", "text": "No. There is no account, no telemetry and no server of ours involved. Screenshots go to the MCP client you configured - the same place the rest of your conversation goes - and nowhere else.The same rule holds for this website: no analytics, no cookies, no third-party requests. The only <script> tag anywhere on the site is application/ld+json structured data, which your browser does not execute - never a program. View source and check."}}, {"@type": "Question", "name": "How is this different from the other macOS MCP servers?", "acceptedAnswer": {"@type": "Answer", "text": "Capability-wise, not enormously - screenshots, clicks, keystrokes, the accessibility tree. The difference is what happens in the hours you are not watching. It works in windows behind the one you are in and leaves your pointer where you put it, so it does not take over the machine while you use it. It tells you when something failed instead of carrying on as if it worked. Several can run at once. And it will not go near your password manager. If you only ever watch it work, most of that is wasted on you."}}, {"@type": "Question", "name": "Why is the audit log fingerprinted instead of plain?", "acceptedAnswer": {"@type": "Answer", "text": "Because a complete record of every keystroke is exactly the file an attacker would want. The fingerprint proves two actions typed the same thing without ever storing what it was. It is scrambled with a random ingredient that only exists while it runs - a fingerprint without that random ingredient, of an eight-character password, is guessable offline, which would have made the log the very thing this promise is against. The cost is honest: comparison works within a run, not across runs."}}, {"@type": "Question", "name": "Can I turn the redaction off?", "acceptedAnswer": {"@type": "Answer", "text": "Yes - redact: false on a single screenshot. It is per call and never sticky, and the result says plainly that the image was not redacted."}}, {"@type": "Question", "name": "Does it ask me before it does things?", "acceptedAnswer": {"@type": "Answer", "text": "Not for ordinary work - it acts, and every call lands in the log. A few things never happen without a person saying yes: your password manager, anything that deletes or clears, and starting a screen recording. In the default mode they wait in the menu bar icon - a password manager cannot be approved there, so it is refused. If you would rather be asked once up front, CMCP_MODE=ask puts a single session-granting dialog in front of the first write, and ignoring that dialog refuses the action rather than allowing it."}}]}]</script>
   <link rel="icon" type="image/svg+xml" href="/logo.svg">
   <link rel="icon" type="image/x-icon" href="/favicon.ico">
   <link rel="apple-touch-icon" href="/apple-touch-icon.png">
@@ -344,6 +344,7 @@ <h2 style="margin-top:0">Give it a look before you give it your hands.</h2>
 
 <footer><div class="wrap">
   <span>Computer MCP - by <a href="https://agent360.dk">Agent360</a></span>
+  <span>·</span><span>Made by <a href="https://gustavlouv.com/" rel="author">Gustav Louv</a></span>
   <span>·</span><a href="https://github.com/Agent360dk/computerMCP">GitHub</a>
   <span>·</span><a href="./security.html">Security</a>
   <span>·</span><a href="./privacy.html">Privacy</a> - <a href="https://browsermcp.dev">Browser MCP</a> - <a href="https://jesperai.com">JesperAI</a>
