Interceptor v2.0.0

Interceptor v2.0.0

What is Interceptor?

Interceptor is an AI-agent control surface for the browser, desktop apps, and iPhone you already use. It works with your real signed-in sessions, so your cookies, accounts, tabs, and app state stay intact while an agent reads the interface and takes action.

Four surfaces, one CLI:

• Browser: drive your live Chrome, Brave, Edge, or Safari session from inside the page. Read the DOM and accessibility tree, click, type, navigate, observe network traffic without CDP, automate rich editors and canvas apps, capture client-side exports, and record workflows for replay.
• macOS: drive native apps through the Accessibility tree, trusted input, ScreenCaptureKit, and Apple's Vision, Speech, and Natural Language frameworks. Routine work stays in the background unless you explicitly ask the agent to show or focus an app.
• Windows and Linux (new): interceptor desktop drives native apps with the same verbs, flags, and JSON replies as interceptor macos, through a native provider that ships in the new Full packages.
• iOS: drive any installed app on an owned, unlocked, Developer Mode iPhone. The on-device XCUITest runner provides element trees, taps, text entry, scrolling, screenshots, and app control, while separate device-service and Instruments lanes expose logs, files, processes, telemetry, location, and WebKit inspection.

Interceptor ships as one interceptor CLI, a local daemon, a browser extension, a native macOS bridge or Windows/Linux desktop provider, and an iPhone runner. It requires no API keys and does not launch a separate automation browser. It can also expose every surface to MCP clients such as Claude Code, Codex, Gemini CLI, Cursor, and Claude Desktop with one command:

interceptor mcp install

Most browser automation starts a clean browser and talks to it through DevTools. Interceptor starts from the opposite premise: let the agent work in the same authenticated browser and apps as the human, see the real interface state, and carry a workflow across web, desktop, and phone.

---

What's new in v2.0.0

Version 2.0.0 follows 1.0.24. The headline: native app control now works on Windows and Linux, not only on the Mac. One command vocabulary, interceptor desktop, covers all three operating systems, and every OS ships only the agent skills, help, and MCP tools that apply to it.

interceptor desktop on Windows and Linux

• interceptor desktop <family> ... drives native apps on Windows 11 and Linux with the same verbs, flags, and JSON replies as interceptor macos: element trees and refs, background click, type, keys, scroll, and drag, menu and action, apps and windows, window screenshots, capture and stream (including stream record --media), clipboard, files and watches, PDF, thumbnails, URL fetching, OS logs, monitor and replay, overlays, script run --jsc, and the secret vault.
• Input goes to the target window without activating it or moving the cursor. On Windows, a chord that holds Ctrl, Alt, or the Windows key reaches only the window already in front, because Windows apps read the physical modifier state; the command says so instead of sending a plain key.
• The operating system fills in what it can: OCR (Windows OCR, Tesseract on Linux), face detection, language identification, calendar and reminders (Windows appointment and task stores, Evolution Data Server), contacts (Windows Contacts, EDS), notifications, file thumbnails and icons, and app launch.
• Bundled with the Full packages: hand, body pose, scene classification, and saliency vision models, sound classification, text embeddings, and speech recognition on Linux, all running on this computer. The local AI model behind ai, translate, detect, and the NLP entity and sentiment verbs downloads once, on first use, from a pinned revision checked by SHA-256 (INTERCEPTOR_AI_DOWNLOAD=off turns the download off).
• interceptor desktop capabilities lists every operation and says whether it works on this computer and, when it does not, why. What a host cannot do at all is listed in the desktop guide.
• On a Mac, interceptor desktop is the same as interceptor macos.

Each OS ships its own skills, help, and MCP tools

• Every installer now carries only its own operating system's copy of the agent skills, generated at build time. The Mac keeps interceptor, -browser, -research, -macos, and -ios; Windows and Linux Full get interceptor, -browser, -research, and the new interceptor-desktop skill. The Linux archives now install the skills too.
• On Windows and Linux, interceptor desktop --help and the MCP interceptor_desktop menu leave out what that OS cannot do, and the MCP server registers five tools (no interceptor_macos or interceptor_ios).

Safer MCP tool calls

• Every MCP tool now classifies the arguments the CLI will actually run, with global flags and their values removed first. A global flag's value could previously pose as the sub-verb and make a destructive or exec verb look like a read.

macOS fixes and additions

• Element refs from interceptor macos reads stay valid after a later find or tree. type into a read-only field refuses instead of typing into another field.
• Calendar: --span future on a recurring event no longer deletes past occurrences, and one occurrence can be updated or deleted on its own.
• New: stream record --media writes an H.264 MP4, type --keycodes-us types into virtual machines that ignore text events, music now-playing --include-system reads Music.app without bringing it forward, and contacts list --keys picks the fields returned.
• OCR runs in a helper process, so a stuck Vision call no longer hangs the bridge.
• A notification attachment is copied before it is posted, so your original file stays where it was.
• The Browser and Full macOS packages find the signed-in user even when the console belongs to the login window, so their post-install steps run for that user.

Recently shipped (1.0.24)

In case you skipped 1.0.24, its headline features carry into 2.0.0: interceptor macos click, drag, scroll, type, and keys reach a window that is in the background (with --window <id> to name the exact window), --trusted browser input works on an unfocused browser window, interceptor window new gives your tab group its own background window, and the native macOS bridge builds from source on Intel Macs (thanks to @kootik in #290).

How it was tested

• Installed the way a user installs them, then run against a catalog of about 910 cases that covers every verb and flag and checks after each case that the foreground window and the cursor did not move:
  • Linux ARM64 (Arch, Hyprland on Wayland): 910 pass, 0 fail.
  • Windows 11 ARM64: 909 pass, 0 fail, 1 skip (the skip is a reminder URL, which Windows tasks do not have; one case where Character Map took focus as it opened passed when its family ran again).
  • macOS (Apple silicon): 613 pass, 0 fail, with 297 cases skipped because they would take the screen or change real Photos, Calendar, Contacts, or Reminders on a shared Mac; three url cases that hit an httpbin.org outage passed when run again.
• The x64 Windows and Linux Full packages are built from the same source and checked for architecture, version, signatures, and (Linux, in an x86_64 container) that the provider starts and accepts its engine bundle. The parity catalog was run on ARM64 hosts.
• Both Linux Browser archives pass install, version, mode, and uninstall checks in Ubuntu 24.04 containers (x64 and arm64).
• CI: typecheck, the full TypeScript suite, the capability-blind audit, and the macOS bridge build on Apple silicon and Intel.

Limits worth knowing

• On Windows and Linux, 2.0.0 does not ship vm (beyond list), photos (beyond status), maps, the music library and Apple Music catalog, authdialog fill, or the Apple-only families (runtime, tcc, appintent, AirDrop, Reading List). desktop capabilities and the desktop guide list every gap.
• Windows: Contacts has no groups, tasks have no URL field, sudo is refused (UAC consent runs on the secure desktop), and background chords that hold Ctrl, Alt, or the Windows key are refused (see above).
• Linux: OCR, face detection, language identification, and personal data need their distribution packages (tesseract, gst-plugin-opencv, libexttextcat, evolution-data-server); without one, desktop capabilities names the package. The Full archives need glibc 2.39 or newer.
• The provider runs in your own desktop session. A command started from an ssh login is refused on purpose.
• The bundled llama-server engine is the upstream llama.cpp build and is not Authenticode-signed; Interceptor checks it against a pinned SHA-256 before running it.

Everything ships together

The CLI, daemon, Chromium MV3 extension, Electron MV2 extension, native macOS bridge, Safari extension, iPhone runner, Windows desktop provider, Linux desktop provider, Windows x64 and ARM64 installers, and Linux x64 and ARM64 archives all report 2.0.0.

---

Install

Choose the package for the computer and control surface you need:

Download	Platform	What it installs	When to pick it
Interceptor-Browser-2.0.0.pkg	macOS 11+	CLI, daemon, and browser extension	You want browser automation without macOS Accessibility or Screen Recording prompts.
Interceptor-Full-2.0.0.pkg	macOS 15+	Browser package plus the native macOS bridge and LaunchAgent	You also want to drive Finder, Mail, Slack, system dialogs, and other desktop apps.
Interceptor-Safari-2.0.0.pkg	macOS 14+	Safari containing app and Web Extension	Add Safari support after installing either core macOS package.
Interceptor-Browser-2.0.0-windows-x64.exe or windows-arm64.exe	Windows 11 24H2+	Signed per-user browser-only install	You want the browser surface on Windows.
Interceptor-Full-2.0.0-windows-x64.exe or windows-arm64.exe	Windows 11 24H2+	Browser install plus the native desktop provider and its engines	You also want to drive Windows apps with interceptor desktop.
Interceptor-Browser-2.0.0-linux-x64.tar.gz or linux-arm64.tar.gz	Linux	Browser-only archive	You want the browser surface on x64 or ARM64 Linux.
Interceptor-Full-2.0.0-linux-x64.tar.gz or linux-arm64.tar.gz	Linux, glibc 2.39+	Browser archive plus the native desktop provider and its engines	You also want to drive Linux apps with interceptor desktop.

Start with Browser unless you need native app control. The Safari package is an add-on. The macOS packages are built for Apple silicon; on an Intel Mac, build from source.

Checksums. SHA256SUMS is the signed manifest for the Linux archives (SHA256SUMS.cms, verified by verify-release-manifest.sh with linux-release-apple-root.pem). SHA256SUMS-ALL lists every file in this release. The Windows installers are Authenticode-signed, and the Browser installers also carry GitHub build attestations.

After installation:

interceptor status
interceptor open "https://example.com"
interceptor mcp install

For native macOS control with the Full package:

interceptor macos trust --walkthrough
interceptor macos tree

For native control on Windows or Linux with a Full package:

interceptor desktop capabilities
interceptor desktop tree

On Linux, verify and install the Full archive from your graphical session:

bash verify-release-manifest.sh .
tar -xzf Interceptor-Full-2.0.0-linux-arm64.tar.gz
cd Interceptor-Full-2.0.0-linux-arm64
bash scripts/install.sh --full

For an owned, unlocked, Developer Mode iPhone connected to a Mac with Xcode:

interceptor ios setup
interceptor ios status

Already installed? Run interceptor update.

The Chrome Web Store version may arrive after Google's review. The unpacked extension included with the packages matches the installed 2.0.0 CLI immediately.