computer-use-mcp

The server is designed to provide an AI model with extensive control over the host computer, encompassing mouse, keyboard, and screen interactions, as clearly stated in the project's README. This capability, while intentional, represents a significant inherent security risk, as a compromised or misdirected AI could perform malicious actions. Furthermore, when configured to use the 'http' transport (via `MCP_TRANSPORT=http`), the server exposes an unauthenticated HTTP endpoint. This is a critical vulnerability if not properly secured with external measures like a reverse proxy or if deployed in an untrusted network environment. The use of `nut-js` involves native system interactions, potentially requiring specific operating system permissions (e.g., accessibility access on macOS) which can be a point of friction or misconfiguration. No `eval` statements, hardcoded secrets, or explicit obfuscation were found in the provided source code, indicating the primary risks stem from its intended functionality and potential deployment without proper network security.