v0.3.0 — One session grant for native app access

Session approval now also covers recognized native “Allow ChatGPT to use [app]?” prompts during app inspection.

• Requires explicit bridge session consent, the configured Computer Use server, the known wording, empty-form schema, and persistence-option metadata.
• Replies with session acceptance only; never asks for permanent approval.
• Unknown formats, extra fields, non-app permissions, and requests during mutations remain forwarded or denied.
• Stop/cancellation invalidates old callbacks. Native macOS permissions are unchanged.
• Exact-app launch trust alone does not authorize native approvals. Consequential-action confirmation remains the calling agent's responsibility.

Validation: 38 automated tests, lint, typecheck, build, and a live Calculator test that computed 4 + 5 = 9 with a screenshot and exactly one host approval request. The test cancels any extra native prompt rather than masking it.

There is no stable upstream app-access kind field. This intentionally conservative matcher falls back to prompting if the native format changes.

npm install -g --ignore-scripts https://github.com/pgeske/mac-computer-use-mcp/releases/download/v0.3.0/pgeske-mac-computer-use-mcp-0.3.0.tgz

Restart/reload the MCP connection after updating.

v0.2.0 — Session-level approval

Computer use now asks for one approval per session across apps, instead of prompting for each inspection, click, or keystroke.

• Approval is held only in memory and cleared by stop, idle expiry, errors, or reconnecting.
• Native OpenAI/macOS permissions remain separate and are never auto-approved.
• Exact-app launch trust and read-only mode remain supported.
• The calling agent is still instructed to confirm consequential actions. The bridge does not semantically classify clicks or enforce a separate send/delete/purchase gate after session approval.

Validated with 32 automated tests, including cross-app reuse, revocation, approval/stop races, new connections, and native permission forwarding; lint, typecheck, and build passed. This change was tested with mock backends; the existing live Calculator workflow is unchanged.

Install/update:

npm install -g --ignore-scripts https://github.com/pgeske/mac-computer-use-mcp/releases/download/v0.2.0/pgeske-mac-computer-use-mcp-0.2.0.tgz

Restart your MCP connection after updating. See README and SECURITY.md for scope and limitations.

v0.1.0 — Mac Computer Use MCP

Initial experimental release: OpenAI’s installed macOS Computer Use tools exposed through standard MCP, with your harness/model making the decisions.

• Native app state, screenshots, mouse, keyboard, and accessibility tools; live schema discovery.
• Per-operation MCP approvals by default; exact bundle-ID trust is an explicit launch option.
• Preserves native permission requests and uses on-request/read-only Codex thread settings.
• Private broker configuration, verified OpenAI binaries, no nested model or arbitrary-code tool.
• Out-of-band stop, cancellation, bounded orderly cleanup, and no automatic action retries.

Validation: 27 automated tests, lint, typecheck, build, zero reported production dependency vulnerabilities, and a live Calculator 4 + 5 = 9 test with native screenshot output. Tested with Codex CLI 0.153.3 and Computer Use build 1000926.

Requirements: macOS, Node.js 22.18+, and the separately installed official ChatGPT/Codex Computer Use components. Experimental backend compatibility and single-desktop-session limitations apply; see README and SECURITY.md.

Install the prebuilt package (no build scripts required):

npm install -g --ignore-scripts https://github.com/pgeske/mac-computer-use-mcp/releases/download/v0.1.0/pgeske-mac-computer-use-mcp-0.1.0.tgz
mac-computer-use-mcp --doctor

The attached SHA256SUMS covers the package. The release tag and source commit are signed. OpenAI binaries are not redistributed.