Computer Use MCP server — macOS desktop control for LLM agents. Screenshots, mouse, keyboard, window management, and app introspection.
Nova is a specialized computer-use MCP server with 13 tools for macOS desktop automation (screenshots, mouse/keyboard input, window management, accessibility tree reading). Tool definitions are well-structured with consistent schemas and descriptions, but several tools lack sufficient documentation of their side effects, idempotency guarantees, and recovery paths. Naming is verb-forward and mostly clear, though some tools expose low-level coordinate-based APIs that require agent reasoning about screen layout. Parameter types are properly specified (enums for choices, numbers for coordinates), but descriptions for several tools could better explain WHEN to use them and what makes them distinct from alternatives. Error handling is minimal, most tools lack guidance on failure recovery or actionable next steps. The server implements tool annotations (destructiveHint) for some tools, which is a small positive, but not comprehensively.
Activate or interact with a cached Accessibility element by mark ID.
Read the macOS Accessibility hierarchy for the frontmost or target window, with optional node filtering and mark assignment.
Query or control a paired Chrome document via the Nova.app native bridge (Chrome semantic bridge).
Click at a position in the last screenshot coordinate frame, or interact with a marked UI element.
Click a cached UI element mark (AX-based alternative to raw coordinates).
Press a key or key combination (modifiers + key).
List visible windows with titles and ownership information.
Duplicate tools with identical schemas and descriptions (read_ui and ax_read are aliases). This violates pattern:composition, LLMs waste reasoning cycles deciding between them.
Tool names rely on domain jargon (ax_read, ax_activate, chrome_semantic) rather than self-documenting verbs. LLMs cannot infer function from names alone without reading descriptions.
Missing output schemas for 11 of 13 tools. LLMs cannot plan downstream tool calls or extract relevant fields without knowing what fields to expect from responses.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | <=2025-11-25 | v2 |
Move the mouse cursor to a position in screenshot coordinate space.
Open or activate an application by name or bundle identifier.
Alias for ax_read: read the macOS Accessibility hierarchy.
Take a screenshot of the full display or a specific window, optionally with OCR text detection.
Scroll at a position in the screenshot coordinate frame.
Type text, respecting system keyboard layout and modifier keys.
Destructive and state-modifying tools (click, type, key, open_application, ax_activate, click_mark, chrome_semantic) lack error guidance. No recovery instructions, no distinction between retryable/fatal errors, no undo tools.
Coordinate-based tools (click, move, scroll) use 'screenshot coordinate frame' terminology without clearly specifying: Is it relative to the most recent screenshot resolution? Does it account for window decorations? What happens if coordinates are off-screen?
chrome_semantic tool mixes multiple actions (status, pair, release, read, activate, focus, set_value, scroll) into one tool with action-specific parameter sets (snapshot_id, node_id, value). Unclear which params apply to which actions; no per-action documentation.
No documentation of idempotency. Tools like type() and key() may have side effects if retried, LLMs need to know whether they can safely retry on ambiguous failures.
ax_read and ax_activate accept 'mark' parameters set by previous ax_read calls, but the relationship is underdocumented. LLMs cannot reliably chain them without explicit guidance (e.g., 'Call ax_read first to get marks, then pass mark to ax_activate').
Lack of permission/scope declarations. No documentation of what macOS permissions each tool requires (Accessibility, Screen Recording, etc.). Agents cannot know which tools will fail due to missing permissions.