Release v0.8.8

What's Changed

• chore(deps): bump platformdirs from 4.12.0 to 4.12.1 in the all-dependencies group by @dependabot[bot] in #442
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #444
• chore(deps): bump pyjwt from 2.14.0 to 2.15.0 by @dependabot[bot] in #443
• Show AI control, temporarily block physical input, and allow user takeover by @zengfanfan in #445
• Update dependencies by @temotskipa in #446
• Fix process-global GetCursorPos argtypes pollution breaking cursor tracking by @iwccx in #447
• Fix input latency: the hook pump must block, not sleep 10 ms per tick by @iwccx in #448
• Run UIA-bound tools on the event-loop thread to preserve COM affinity by @legendteddy in #449
• fix(tree): allow excluding processes from UIA traversal by @legendteddy in #450
• Run UIA-affine tools on a dedicated worker thread by @legendteddy in #451
• chore(deps): bump platformdirs from 4.12.2 to 4.12.3 in the all-dependencies group by @dependabot[bot] in #452
• chore(deps): bump the all-dependencies group with 2 updates by @dependabot[bot] in #454
• chore(deps): bump posthog from 7.63.0 to 7.64.1 in the all-dependencies group by @dependabot[bot] in #455

New Contributors

• @iwccx made their first contribution in #447
• @legendteddy made their first contribution in #449

Full Changelog: v0.8.7...v0.8.8

Release v0.8.7

What's Changed

• fix(tree): stop Snapshot recursing on a repeated ancestor RuntimeId by @mmhh256 in #429
• fix(app): verify foreground window before reporting switch success by @xut1021 in #430
• chore(deps): bump the all-dependencies group with 4 updates by @dependabot[bot] in #431
• fix(input): reject malformed sign strings in _as_point coordinates by @rudratoshs in #434
• chore(deps): bump the all-dependencies group with 2 updates by @dependabot[bot] in #433
• chore(deps): bump pyjwt from 2.13.0 to 2.14.0 by @dependabot[bot] in #435

New Contributors

• @mmhh256 made their first contribution in #429
• @xut1021 made their first contribution in #430
• @rudratoshs made their first contribution in #434

Full Changelog: v0.8.6...v0.8.7

Release v0.8.6

What's Changed

• ci: block releases when version strings disagree by @Jeomon in #360
• docs: add PyPI downloads badge to the README by @Jeomon in #361
• Update project dependencies by @temotskipa in #363
• Update Python version and dependencies by @temotskipa in #364
• chore(deps): bump the all-dependencies group with 3 updates by @dependabot[bot] in #365
• chore(deps): bump posthog from 7.37.0 to 7.37.3 in the all-dependencies group by @dependabot[bot] in #368
• Fix/annotated screenshot race by @Anantctrl in #378
• chore(deps): bump the all-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #379
• fix: update star history chart so it renders again by @OctoBored in #381
• chore(deps): bump the all-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #384
• fix(snapshot): restore missing view imports by @git-ksk in #386
• Add optional region capture to Screenshot and Snapshot tools by @udoheld in #388
• Update dependencies by @temotskipa in #391
• fix(tree): prune dead UIA elements during traversal by @insane66613 in #394
• Update dependencies by @temotskipa in #396
• fix: stability batch - self-pipe busy loop, UIA walker, console flash, screenshot fallback, emoji crash by @Jeomon in #397
• fix: keep the server alive when the watchdog cannot start (#374) by @Jeomon in #398
• fix: back off when the watchdog rebuild is triggered by degradation by @Jeomon in #399
• fix: make the UIA focus watchdog opt-in by @Jeomon in #400
• chore(deps): bump the all-dependencies group with 3 updates by @dependabot[bot] in #402
• fix: resolve localized Start Menu app names by @atirna in #403
• chore(deps): bump the all-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #405
• Update dependencies by @temotskipa in #406
• chore(deps): bump posthog from 7.47.0 to 7.47.1 in the all-dependencies group by @dependabot[bot] in #410
• fix: reject negative element labels instead of indexing from the end (#418) by @sxh313 in #422
• chore(deps): bump the all-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #423
• fix(screenshot): fall back to the next backend when dxcam raises COMError by @zzz27578 in #426
• fix(manifest): list the WaitFor and DisplayInventory tools by @zzz27578 in #425
• fix(scrape): read the DOM scroll position from node metadata by @zzz27578 in #424
• chore(deps): bump the all-dependencies group with 2 updates by @dependabot[bot] in #427

New Contributors

• @Anantctrl made their first contribution in #378
• @OctoBored made their first contribution in #381
• @git-ksk made their first contribution in #386
• @udoheld made their first contribution in #388
• @insane66613 made their first contribution in #394
• @atirna made their first contribution in #403
• @sxh313 made their first contribution in #422

Full Changelog: v0.8.5...v0.8.6

Release v0.8.5

Highlights

Protocol integrity. The server no longer writes to stdout, which on the default stdio transport is the JSON-RPC channel. Tree traversal was printing every word of every editable control it encountered, interleaving plain text into the framing the client parses (#359).

Reliability under load. Snapshot and WaitFor tree capture is now size-bounded to prevent hangs and oversized output (#353), the UIA watchdog self-heals after repeated COM failures (#334), and a corrupted comtypes.gen cache from concurrent generation is now handled (#358).

Multi-monitor. Display captures are aligned correctly, annotated captures stay within screenshot bounds, and a structured per-monitor display inventory was added (#303, #329).

Added

• Structured per-monitor display inventory by @zengfanfan in #329
• Explicit-start drag support for Move by @zengfanfan in #328
• WINDOWS_MCP_WATCHDOG switch to disable the UIA watchdog by @mvanhorn in #333
• Strict executable launch by @zengfanfan in #335

Fixed

• Stop writing to stdout, which carries the stdio JSON-RPC protocol by @Jeomon in #359
• Corrupted comtypes.gen cache from concurrent generation by @pranco388 in #358
• Report missing startup dependencies instead of exiting with a bare traceback by @dgonick in #355
• Bound Snapshot/WaitFor tree capture size to prevent hangs and oversized output by @Veloflott in #353
• Self-healing UIA watchdog reconnect on repeated COM failures by @Jeomon in #334
• Multi-monitor snapshot annotations by @sposer and @ackinul in #303
• Raise on failure so isError=true on the MCP wire by @sanjibani in #300
• Retry get_active_window on transient empty UIA results by @Austin519 in #294
• Paste long text via clipboard to avoid SendKeys scan-code race by @Austin519 in #293
• Guard auth banner against non-UTF-8 stdout by @Austin519 in #292
• Reject invalid input boolean values by @zengfanfan in #330
• Reject invalid WaitFor timing values by @zengfanfan in #336

Tests & CI

• Unit test workflow for pull requests by @JezaChen in #343
• Repair broken isError-compliance regression test by @JezaChen in #341

Docs

• Add Autohand Code MCP setup by @igorcosta in #325

Maintenance

• Dependency updates by @temotskipa in #307, #311, #337
• Packaging metadata resynced: manifest.json and server.json's package entry had drifted two releases behind pyproject.toml
• Routine automated dependency bumps

Contributors

Thank you to everyone who contributed between v0.8.2 and v0.8.5:

@zengfanfan	#328, #329, #330, #335, #336
@Austin519	#292, #293, #294
@temotskipa	#307, #311, #337
@JezaChen	#341, #343
@Jeomon	#334, #359
@sposer / @ackinul	#303
@sanjibani	#300
@igorcosta	#325
@mvanhorn	#333
@Veloflott	#353
@dgonick	#355
@pranco388	#358

New contributors

@Austin519, @sposer, @sanjibani, @igorcosta, @zengfanfan, @Veloflott, @dgonick and @pranco388 made their first contributions in this release. Welcome, and thank you.

Full Changelog: v0.8.2...v0.8.5

Release v0.8.2

What's Changed

• chore(deps): bump click from 8.3.3 to 8.4.0 in the all-dependencies group across 1 directory by @dependabot[bot] in #247
• fix: register windows-mcp serve subcommand + match README usage by @mvanhorn in #248
• fix: strict TOML type validation for server.host/port/auth_key/oauth_* by @mvanhorn in #250
• test: paired-flag validation for --ssl-* and --oauth-* CLI options by @mvanhorn in #249
• chore(deps): bump idna from 3.10 to 3.15 by @dependabot[bot] in #251
• refactor: decompose Desktop service into focused modules -- Phase II by @JezaChen in #254
• feat: add WaitFor condition waits by @LaplaceYoung in #255
• chore(deps): bump posthog from 7.14.2 to 7.15.0 in the all-dependencies group across 1 directory by @dependabot[bot] in #252
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #259
• chore(deps): bump the all-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #258
• chore(controls): fix five docstring typos by @mvanhorn in #262
• chore(deps): bump the all-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #263
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #271
• chore(deps): bump starlette from 0.50.0 to 1.0.1 by @dependabot[bot] in #270
• chore(deps): bump the all-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #269
• fix(install): remove elevation requirement and fix wrong-binary wrapper by @Jeomon in #275
• fix: drop .python-version so requires-python drives interpreter selection by @Jeomon in #276
• fix: coerce loc/locs/labels from JSON string in coordinate tools by @Jeomon in #277
• chore(deps): bump the all-dependencies group with 2 updates by @dependabot[bot] in #273
• chore(deps): bump fastmcp by @temotskipa in #278

New Contributors

• @LaplaceYoung made their first contribution in #255

Full Changelog: v0.8.0...v0.8.2

Windows-MCP v0.8.1

• Highlights

• Added Firefox IAccessible2 / MSAA fallback for DOM extraction.

• Added --stateless-http support for streamable-http.

• Improved screenshot capture feedback with a visible Win32 glow overlay.

• Aligned README and client examples with the current serve subcommand.

• Documented auth helper, OAuth/stateless HTTP env vars, and corrected tool names.

• Bumped package metadata from 0.7.5 to 0.8.0.

• Pi integration of Windows-MCP

Contributors

• @sergeikabuldzhanov : Firefox IAccessible2 / MSAA DOM extraction fallback and follow-up API/docs cleanup.
• @exalsch : screenshot flash/glow overlay work, including Win32 layered-window rendering and follow-up test/refactor changes.
• @iillyyaa1997 : --stateless-http for streamable-http.
• @mvanhorn : PostHog write-key configuration fix.
• @richard-devbot : Pi integration of windows-mcp
• @Jeomon / jeomon: merges, authlib CVE-2026-44681 patch, and v0.8.0 release prep.

Full Changelog: v0.7.5...v0.8.0

v0.7.5 — Security patch: CORS & DNS rebinding (GHSA-vrxg-gm77-7q5g)

Security fix

This release addresses GHSA-vrxg-gm77-7q5g reported by @dodge1218.

What was wrong

HTTP transports (sse, streamable-http) emitted Access-Control-Allow-Origin: * unconditionally, allowing any cross-origin browser page to open an unauthenticated MCP session and invoke the PowerShell tool. There was also no Host header validation, leaving localhost-bound servers open to DNS rebinding attacks.

What changed

• No wildcard CORS by default. OptionsMiddleware and CORSMiddleware no longer emit Access-Control-Allow-Origin: *. Without an explicit origin list, no CORS headers are sent — browsers block cross-origin requests via Same-Origin Policy.
• --cors-origins opt-in. Operators who need a browser-based MCP client can pass a comma-separated list of trusted origins (--cors-origins https://my-client.example.com). Only those origins receive CORS headers. Also available as WINDOWS_MCP_CORS_ORIGINS env var and cors_origins in ~/.windows-mcp/config.toml.
• DNS rebinding protection. TrustedHostMiddleware is now applied automatically based on the bind address (loopback → localhost/127.0.0.1/[::1]; specific host → that host). Requests whose Host header doesn't match are rejected before reaching the MCP control plane.

Upgrade

uvx windows-mcp@0.7.5 serve
# or
pip install --upgrade windows-mcp

No configuration changes are required for the default stdio transport or for existing HTTP deployments that don't rely on cross-origin browser access.

Release v0.7.4

Fixes

• Detected double caching of tree nodes, making 2 COM calls per node, now 1 COM call per node, further improved the tree traversal speed.
• Updated the MCP config for setting Windows-MCP in Claude Desktop from Windows Store.
• Handling UIA Errors Cleanly in UIA
• PowerShell Tool missing environment variables fix (Thanks to @JezaChen)

Windows-MCP v0.7.1

Added

• Added PowerShell execution logic extraction into a clean, static PowerShellExecutor class for improved code organization and stability (#158)
• Added MSIX App path resolutions to support natively launching MSIX / UWP Windows applications for AI agents (#126)
• Added Dependabot configuration for weekly and grouped updates to streamline package management (#145, #125)
• Added WINDOWS_MCP_SCREENSHOT_SCALE environment variable to documentation and explicitly handle coordinate mismatches across multiple displays (#116)
• Added .idea/ to .gitignore to exclude JetBrains IDE configurations natively (#120)
• Added dependency lock mapping for cryptography<=46.0.6 to guarantee win_arm64 ARM PyPI installation stability (#149)

Fixed

• Fixed process attachment AttachThreadInput "Access Denied" errors when interacting with protected or elevated processes (#123)
• Fixed graceful two-stage subprocess timeouts for Windows process trees to prevent orphaned tasks (#151)
• Fixed mouse coordinate mismatches by replacing screenshot_size with screenshot_original_size for precise desktop plotting (#116)
• Fixed Snapshot crashes caused by comtypes VARIANT marshaling on non-ASCII application UI layouts (#148)
• Fixed UI rendering breakages by stripping out Unicode Private Use Area characters from tool readouts (#120)
• Fixed Notification tool failing to display toast messages silently (#121)
• Fixed missing scroll attributes in scrape tool (#119)
• Prevented child process freezes by ensuring stdin=DEVNULL is passed to the shell loaders natively

v0.7.0

What's Changed

• fix: keyboard focus not transferred when switching foreground window by @JezaChen in #106
• fix: import _INPUTUnion from enums to fix NameError by @JezaChen in #108
• fix: resolve Known Folder GUID paths before launching apps by @JezaChen in #110
• feat: Screenshot tool with DXCam backend reporting and UIAutomation hang fix by @yasuhirofujii-medley in #104
• refactor: extract tool definitions into tools/ subpackage by @yasuhirofujii-medley in #111
• fix: validate app ID via shell:AppsFolder instead of string check by @JezaChen in #112

Full Changelog: v0.6.9...v0.7.0