Open-source desktop control tooling for MCP-compatible AI clients on Windows and Linux.
Status reviewed 2026-10-25: no production release, installer or publicly released plugin. The original local MCP status-core source is tracked by Draft PR #22, not on
main; owner-run Windows/Linux regression and local security scanners passed, but independent semantic review remains pending. A prior real private ChatGPT diagnostic call and post-revocation denial were verified in M01 Issue #28; this does not establish a released or current host installation. Do not rely on this repository for production computer control.
- File reading, searching, structured edits, and reversible changes when feasible.
- Terminal and process management with bounded sessions, logs, and explicit cancellation.
- Native desktop input and accessibility automation across supported Windows and Linux configurations.
- Browser automation through tested browser-native interfaces.
- Device pairing and user-controlled tool, skill, path, network, and privilege permissions.
- Local-first development with a later option for hosted remote MCP and self-hosting.
An AI client makes decisions; this project will provide tools and a local execution bridge, not another AI agent.
The public system atlas provides four source-linked Mermaid views: local runtime and trust boundaries, product milestones, the GitHub/QA/release chain, and the planned install/update lifecycle. Every view separates the historical and Draft-only evidence from unimplemented target capabilities; no private device information belongs in this public document.
Desktop Control uses product-outcome milestones M01–M06 and M07+ (unbounded) to present real user-visible progress, dependencies and evidence; they are not the six timeboxed development sessions. See the product roadmap and milestone/evidence register. Full GitHub milestone/Project-v2 migration is not yet independently verified (Issue #28 is assigned milestone object #7, but that does not certify the whole migration): the non-destructive migration issue #25 tracks verified owner/UI follow-up.
Current private checkpoint — 2026-10-25: PR #33, source 6c513db22f396143b2ad8086d36e19e650582e99, has fresh root verification: Windows 232 tests / 224 passed / 0 failed / 8 skipped; Debian 12 232 / 208 / 0 / 24. Skips are platform/environment-specific and remain explicit; these totals do not certify every native feature. Installed private plugin 0.0.1-preview.5 comes from 847bf6aef517e1f6f17f86c4b10a08e76338cdf2; its version/status and local settings window were observed in the actual host. Recovered permission/management changes are newer source work, not installed by that preview. The unattended bridge updater remains OFF. Remote PR #34 is a default-OFF health-only prototype: one existing OS-protected staging license, no deployed remote service or accepted Internet device session. No license secrets or device identifiers belong in public evidence.
Hosted verification remains failed: run 40240436331, source 6c513db22f396143b2ad8086d36e19e650582e99, failed four Windows elevated-principal positive tests. This is separate from the passing normal-user local matrix above; no all-green CI or merge-readiness claim follows from those local results.
Historical S02 evidence: S01 architecture #5 and PR #21 completed/merged; S02 #6 read-only MCP status-core was tested on Windows/Linux on Draft PR #22, not accepted or merged. Windows: 29 unit/9 platform-applicable protocol tests passed, 2 Linux-only tests skipped; Linux: 29 unit/10 protocol passed, 1 Windows-only test skipped; local OSS security scan checks passed. A previous private ChatGPT diagnostic end-to-end connection was demonstrated on 2026-10-24; that older run does not certify the newer installed package, and there is no installer or released application. The independent semantic security review remains an outstanding gate. Formal S03–S06 sessions remain not started; selected private capabilities from their scope are now owner-authorized, separately tracked and not automatically accepted; session history is preserved separately.
MCP-compatible AI client
|
MCP gateway / protocol layer (planned)
|
authenticated device channel (planned)
|
local desktop bridge (planned)
|
Windows / Linux capabilities (planned)
The gateway, local bridge, identity model and transports remain subject to design review and real tests. No cloud service or public registration is live. See architecture overview and threat model.
- Product milestones M01–M06, migration and evidence semantics
- Changelog — merged changes versus in-review work
- Public information classification and repository freshness
- German masterplan (scope, decisions, architecture, sources and six sessions)
- Cross-chat recovery protocol
- Machine-readable project state snapshot
- GitHub automation, security and DevSecOps operating standard
- Research and authoritative sources
- 29 Desktop Commander tool coverage plan
- Final GitHub Work administration assignment
Plans and snapshots are not live execution results. Read actual GitHub main, open PR branches and issues before any write. S02's current evidence is on Issue #6, Draft PR #22 and the feature-branch state snapshot. GitHub milestone descriptions and private Project metadata may lag; do not interpret completion percentages as proof of tests or independent review.
The AI will use its own persistent browser profile, separate from the user's existing browser. The specification covers history, bookmarks, cookies/login state, session restoration, downloaded files, site permissions and a password manager or OS-backed credential vault subject to security validation. Browser automation will use Playwright where practical, with a visible black virtual cursor only during mouse actions. Sensitive browser credentials must not be exposed to AI tools. See browser profile specification, proposed ADR, and feature tracking issue #14. A separate visible browser/controller exists on private Draft PR #33. Complete account consent, downloads, native lifecycle and cross-platform acceptance remain open; this is not a public browser release. Formal S04 remains unstarted; selected private browser development is authorized.
Computer control is a high-trust capability. An unrestricted shell is not contained by a command blocklist or an allowed-directory configuration. Production designs must use OS-enforced isolation where a strong boundary is required. See SECURITY.md before reporting a vulnerability or experimenting with privileged execution.
GitHub auto-merge is enabled at repository level, but it must not be enabled on an individual PR until mandatory reviews and stable required status checks are enforced on the protected main branch. See Auto-merge safety and release gates. Historical tokenless quality and isolated M03 trial results exist, but the current private hosted Windows verification remains failed as recorded above. PR31 is merged into the private feature branch, not main. None of these results constitutes a release or automatic merge approval.
Read CONTRIBUTING.md, GOVERNANCE.md, SUPPORT.md, and CODE_OF_CONDUCT.md. Use the issue templates for proposals or bug reports. Do not submit real credentials, private machine data, or security exploit details in public issues.
Project-authored source and documents are licensed under MIT, unless a file explicitly states otherwise.
The MIT license permits copying, redistribution and forks; it is not a copy-prevention mechanism. Copyright and official project identity explains what belongs in the public repository and what remains separate from the source code. Third-party code retains its original license and notices; see the reuse policy. This project is independent of Desktop Commander and other referenced projects, and does not claim affiliation.
Private plugin developer presentation: Anon Allman. Existing project/third-party copyright notices remain unchanged.
Maintained by the repository owner and contributors; contributors and reviewers are credited only for work actually performed.